Academy
Last updated
Last updated
Hi all, the primary purpose of this write-up is to practice scripting skills when possible, and try to be less reliant on already-built tools
IP
We will start by enumerating the ports on the target machine, to do so, we can write a Python script that will enumerate the ports and perform banner grabbing to identify services running
We can run the following script with the following
This script checks ports given in a range
Performs banner grabbing to identify services running on the machine
From what we can tell we have
SSH
webserver running (Apache/2.4.41)
Most likely a Ubuntu server
we can add the hostname "academy.htb" to our hosts file
to write and quit in the Vim editor
Now we can navigate to the web server
First thing, we are greeted with a web page with two options
from wappalyzer we can confirm the web page uses PHP and it is indeed a Ubuntu server
with this information we can do some directory busting to find any hidden directories for this we are going to use Feroxbuster, to install feroxbuster install Rust onto our system
to find hidden directories we can run the following command
we are using seclists to provide our wordlist
we want to add the PHP extension since we now the web page uses php
we found one interesting directory
admin.php
within the login.php common credentials are not successful
within the register.php let's register an account and see what access we have
logging in with the user we just created we are greeted with a static page with little to no functionality
Lets catch the web request and see what is being sent to the server when we register an account, instead of using burp or ZAP we are going to catch the request using a tool called mitmproxy where we can use its python API and script our attack
for our proxy we need to set up a few things
once installed in our browser we need to configure the plugin to redirect traffic through our proxy
within foxyproxy click Options -> Add
follow the configurations
we need to install mitm certificate in the terminal run mtimproxy
within your browser settings search certificates → certificate manager → import → within your downloads directory click on the certificate from mitm → tick the box “Trust this CA to identify websites"
Now we can activate mitmproxy
let's register another user
we will register the user
within the terminal, we will see a POST request from /register.php
We can just click on the request and we can see the parameters being sent to the server
what of real interest is the "roleid" parameter being equal to 0, Now what if we register another account and set "roleid" to be equal to 1
for this, we can write a Python script to automate catching the request and modifying the parameter using mitm's API
Now lets register a new user
if we look at the recent POST request in our terminal we can see the changes made
we have successfully changed roleid from a 0 to a 1
let's try our new user creds within the admin.php page
we can successfully login in and we are greeted with what looks like a planner
Already we have some juicy details looks like we have some usernames and a subdomain
users
subdomain
let's add the subdomain to our /etc/hosts
looks to be an open-source web application framework called Laravel
from the page, we can see a lot of information showing up
from a quick Google search, we have a good hunch that Laravel is vulnerable to CVE-2018-15133
we can use the following exploit
we can clone the repo into our working directory
cd into the repo and install the requirements.txt
for the exploit to work, we need the API_KEY which we found within the Laravel app
In preparation of our reverse shell let's setup a netcat listener
now for the exploit, we will use a one-liner bash tcp reverse shell
we have specified the command we want to run on the system (bash reverse shell) the url and API_key
we should have a hit on our netcat listner
In our new shell, we are present as a low-level user
Our next move is to find a way to elevate our privileges, and progressively search our way through if we look at the /var/www/html/academy/ directory we will find a hidden folder .env
we will find the .env file which at times can contain sensitive material, in our case it does
we found a unique password, next lets search the /etc/passed file to find users on the system
from what we can see we have multiple users
Now that we have a list of users and a password lets script a ssh_password_sprayer
we'll create a file containing our user list and a file containing, once that is done we can run our script as follows
We get a hit for successful creds
we can SSH as cry0l1t3
from here the user.txt is within the /home/cry0l1t3 directory
lets upgrade our shell
when we look at the id of our user
we can see our user is part of the group "adm" group, being part of the "adm" group usually members have permission to read log files inside /var/log
lets focus on the /var/log/audit logs for this we can create a simple bash script to search for keywords comm="su" and comm="sudo"
we do need to create this script from our local machine and then transfer it over to Once we have our script ready to go we need to set up a python server for us to grab from our shell
local machine python3 server
from our target machine, we need to cd into the /tmp directory and we will use wget to retrieve the script
we need to give it execute permissions
now we just need to run it
we do find something interesting in the results
what we have highlighted is a log entry but what we are most interested is the
comm="su": This indicates the command that triggered the event. In this example, the su command was executed.
data=6D7262336E5F41634064336D79210A: This part contains additional data associated with the event, typically in hexadecimal format. The meaning of this data can vary depending on the specific event.
lets convert this hex value to ASCII using python script
we have a possible password
let's change our user to mrb3n
we are now user mrb3n
let's fix our shell
let's check our current sudo privs
we are now root
we can check the technologies the web page is using with wappalyzer, you can install it from the following
we want to install the foxyproxy plugin for our browser
in our browser activate the mitm configuration in foxyproxy, then head to and download the certificate for your system, for us we want the Linux option
navigate to
looks like we can use the composer command with sudo privs, if we look at we can see we can escalate our privileges to root
