11 KiB
HackTheBox-Breadcrumbs
Rustscan
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 127 OpenSSH for_Windows_7.7 (protocol 2.0)
| ssh-hostkey:
| 2048 9d:d0:b8:81:55:54:ea:0f:89:b1:10:32:33:6a:a7:8f (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD1/bmEHFv3nRSf2uH/akLLIfkmpxbSWiVReOdwmJrM2iD9g1gqVHIceIxat222PnYkLHYG23lUQMiTXcvuwBHeB+dMUNv09IHDKCCT9XOTWc
+900zrFLRoyR6LQ2O3vQ+JgWpWlvtZAV6FvcSSK3ai767qIdBNG8SAxwwQZlSxX7D/n28VJlPcXXtzoiSt+lQ1T1sq7qIXPM2CyY7qoTLjcvDz/IYqbXbinsLLOCZ9MnRnDbE8E9tLeAJGcxhpNg
k0LNN6xGbj49zVhy1TRrVNhh4RD+uczVqufMQIHdCnL61p9ZIepQxhJvwSf4IHH+oaM6wy3Yu0W6pg5wQWXIkj
| 256 1f:2e:67:37:1a:b8:91:1d:5c:31:59:c7:c6:df:14:1d (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMPvEspRGrd2/vma82j25vli6C/Td5Gvl44e9IhXeZOlvojawx4tbo/OdBytc+X9b/OSP01kLK
4Od62NrQmN39s=
| 256 30:9e:5d:12:e3:c6:b7:c6:3b:7e:1e:e7:89:7e:83:e4 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII+TY3313X2GdjXH6r6IrDURWI4H4itbZG41GaktT00D
80/tcp open http syn-ack ttl 127 Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1h PHP/8.0.1)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
443/tcp open ssl/http syn-ack ttl 127 Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1h PHP/8.0.1)
| ssl-cert: Subject: commonName=localhost
| Issuer: commonName=localhost
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2009-11-10T23:48:47
| Not valid after: 2019-11-08T23:48:47
| MD5: a0a4 4cc9 9e84 b26f 9e63 9f9e d229 dee0
| SHA-1: b023 8c54 7a90 5bfa 119c 4e8b acca eacf 3649 1ff6
| -----BEGIN CERTIFICATE-----
445/tcp open microsoft-ds? syn-ack ttl 127
3306/tcp open mysql? syn-ack ttl 127
| fingerprint-strings:
| NULL, SIPOptions:
|_ Host '10.10.14.196' is not allowed to connect to this MariaDB server
5040/tcp open unknown syn-ack ttl 127
7680/tcp open pando-pub? syn-ack ttl 127
49664/tcp open unknown syn-ack ttl 127
49665/tcp open unknown syn-ack ttl 127
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open unknown syn-ack ttl 127
49668/tcp open unknown syn-ack ttl 127
49669/tcp open unknown syn-ack ttl 127
PORT 145/445 (SMB)
I tried to anonymously connect to smb but couldn't
PORT 80
We can see a button Check Books it will take us to book.php
Now here I didn't know any books so I just started with letter A so it returned a bunch of books
Viewing these dialog boxes doen't really help us so I intercepted the request with Brup Suite
Here we can see a paramter book which is taking a filename so there's a chance that LFI (Local File Inclusion) exists here so to test it for index.php
It throws an error as index.php is not in /books directory so we need to go parent directory where index.php is using ../
So it does work we can see the source code of index.php now since this is a windows machine we can try to view the hosts file
../../../../../../WINDOWS/system32/drivers/etc/hosts
We saw previously from erros regarding bookController.php so let's try to read the file
../../../../../../Users/www-data/Desktop/xampp/htdocs/includes/bookController.php
On reading we can db.php so maybe there must be some credentials we can find
../../../../../../Users/www-data/Desktop/xampp/htdocs/db/db.php
Although the port is open to use (3306) but still we are not allowed to connect to mysql service
I tried to read the apache error log and was sucessful in reading so we can do Log poisining to get RCE
../../../../../../Users/www-data/Desktop/xampp/apache/logs/error.log
So in User-Agent we will add a php GET parameter
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Tried doing this but couldn't get LFI to RCE so went step back to do fuzzing with dirsearch
Found a directory named portal portal
We can try to signup an account on the site
After going through all the site I read the login.php page I found it was using authController.php page
We can see that there's a JWT token involved also there's a php file cookie.php and we can see the salt being used in there to generate PHPSESSID
Also we can see in files.php that username should be "paul"
So going to JWT.io to create a token for paul
Then generating PHPSESSION
Here I ran the file in loop because of the random number it's going to take in generating the cookie so that cookie worked when I replaced it with the current cookie
After hitting refresh the user got changed and we logged in as paul
Going to File Management we can upload files but there's a restriction that only zip files are allowed
Testing for uploading a zip file
On uploading it gives us an error
So Intercepting the request we can see that there's a .zip extension that will added to a file name we can by pass it by adding a .php extension
So I downloaded a php script from https://github.com/flozz/p0wny-shell, copied contents of the shell.php file then pasted the contents along with adding .php file extension
Host ncat64.exe on your local machine
And download it on the target machine
We can see a folder pizzaDeliveryUserData
There's a user juliette
So going back to that directory we can see the json file for the user and can find credentials in there
There's ssh port open on the machine we can try to login through ssh using these credentials
Looking at the contents of todo.html
As the html file says about Stick Notes let's see if we can find where Windows saves sticky notes so going to this link I was able to find where the notes were stored
https://www.thewindowsclub.com/where-are-sticky-notes-saved-in-windows-10
Now to save this on our machine we need to transfer it by creating a smb share on our local machine and making sure it has both read and write permissions so doing nano /etc/samba/smb.conf
Start the service and transfer the file using copy filename \\ip\share
Make sure to copy all plum files and unfortunately you will need to transfer these files to Windows and copy them in the same location where you found these files on the target machine
Now just launch Sticky Notes application on Windows
Now that we got the password for another use development we can access his folder and see what's in there
Here we see a binary called Krypter_Linux so again copy that file to local machine's smb share
Running strings command on binary we can see a domain name on port 1234
Let's further analyze the binary with Ghidra
We can see that it's in the form of a GET parameters so we can send a request to that port with this data but before we do that let's do port forwarding for port 1234
So doing dynamic port forwarding through ssh
Now let's make the request to that port
We get an aes key but don't get a password so we can try to sql injection on the parameters by using sqlmap
Now we have the encrpyted text and then aes key so we need to decrypt it , I visited this online tool
https://www.devglan.com/online-tools/aes-encryption-decryption
Now we just need to decode it from base64
And that's it we got administrator on the machine
Things Learned
- If you got LFI always look around in the source code you will find how the application works
- If you find a binary make sure to analyze what's in there
- We can transfer files from windows to linux by running smb service on linux machine