Compromised - HackTheBox смотреть онлайн

Compromised was a medium-hard box from HTB... Because it was a lengthy one, I recorded voice with the screen. Thus the keyboard ASMR and many cuts to make it shorter.


00:00 Nmap
00:47 Web
07:08 Foothold
20:50 User
22:23 Root


Nmap:
- Port 22 and 80 open. Standard Linux environment.


Web:

- A litecart website. Using `searchsploit`, we find a upload vuln for a PHP shell.
- `Dirbuster` finds a `/backup`.
- The exploit needs a user/pass for admin. Which can be found from the backup! `/admin/login.php` has a comment with a logfile-name which can be accessed from the box along with the admin cred!


Foothold:

- Python script doesn't work out-of-box. Modifying it to display `phpinfo` reveals disabled `system` function and the PHP version.
- From an online exploit, the PHP disabled functions can be bypassed for this PHP version. It is a PHP script which can be implemented in our exploit!
- RCE is working, however cannot get a rev shell... Some unusual users in `/etc/passwd`.
- Using `mysql -u root --password=changethis -e "use mysql; select * from func"`, we can execute commands as the MySQL user using `exec_cmd()`.
- A b64 encoded payload works with curl to give us ssh access!


User:

- Doing `cat *|grep -ri password` on the home folder of the MySQL user reveals another password.
- This password works with sysadmin user via ssh.


Root:

- Linpeas detected nothing... :(
- There is a PAM backdoor at `/lib/x86_64-linux-gnu/security/pam_unix.so`.
- Reversing it will give us the root password!
- In the `pam_sm_authenticate` function, we find two hex-encoded strings. converting them to little endian and decoding them as hex, we get the root pass!