HTB:UpDown(Linux)
We will start with a normal nmap scan to get the open ports- 80,22.
Now we go to the port 80 and find a website siteisup.htb which tells us whether a website is up or not. There is no way forward with this, hence we do directory busting and find a few directories including /dev, /server-status, /dev/.git, etc. Among these finding /dev/.git is definitely something i would focus on, so we download the .git folder using git-dumper.
We also do a subdomain busting and find a dev subdomain which is not accessible cause its a forbidden resource.
We find a .htaccess file in the git directory we downloaded, which shows we need a special header only4dev .
We also find several other admin.php and pages which show that only admin has access to them.
Also there is a logic of checking the type of file, whether they are allowed or not and a code to delete the uploaded file as well.
Now gauging all this, we should probably try to access dev.siteisup.htb with the required header and for that we can use FlexHeader extension and there are many other extensions available. We create a Special-Dev header with value only4dev and we are now able to access the dev.siteisup.htb
Now we observe that we can upload a file here. But when we upload any text file that gets delete instantly so i can’t access that in the uploads folder and the folder also gets deleted after some time. So instead I try other extensions and one important observation i saw is that a zip file is not allowed to be uploaded but if we change the extension for that it gets uploaded and somehow the content is not cleared immediately.
Since the website technologies show Apache HTTP server, lets explore further and prepare a php file to get more info on the same.
After this we simply zip it with a random extension because zip is not allowed.
Now when we see the uploads we find the info.xyz but if i try to access the php file from there i can’t. So after digging up a bit there is a method using phar format (phar://archive/file), this would add the php extension by itself. Doing so, I got the info php page where there are listed disabled functions.
Most of the functions which could help with getting a shell are blocked over here, but proc_open is not blocked. We can leverage that to make a script for getting reverse shell.
Now we simply zip it like earlier in shell.xyz now and then upload it. We need to access it in the same format /?page=phar://uploads/upload-id/shell.xyz/shell
Get Eagle Hacks’s stories in your inbox
Join Medium for free to get updates from this writer.
Also we need to ensure out netcat is listening and we get a shell for www-data.
Now I am not able to interact in this shell so I would need to open a tty shell.
We can’t get the user flag as yet, so maybe we need horizontal privilege escalation. We actually can’t see the user.txt as it is owned by root and is present in the developer group.
Upon checking the home directory we find a folder for developer and it has a dev directory which contains two files, there is SUID bit set for siteisup script and from there maybe we can get access to developer group.
When i read the code, i know that i need to provide python code to the script when we run it.
We simply get a shell as developer but the group is still www-data which means i can’t read the user.txt file.
If we further check we find the ssh key of developer user which we can copy to our system and then login as developer and we do get the shell as developer.
Now we easily get the user file and then we move on to privilege escalation which is quite simple.
The developer can run easy_install with root access. And easy_install requires an argument, a file which it needs to install. So we create a file with our script.
We run easy_install with our script and get root shell.
