HTB:Sau(Linux)

Starting the box with an Nmap scan, we get 2 open ports:

nmap scan

The port 55555 hosts a website which is running request-baskets version 1.2.1 . Now the usual approach would be to find any exploits for this particular finding. The initial research provides information about SSRF attack possible in this request-baskets version.

Get Eagle Hacks’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We have different POCs available as well, I found entr0pie github repository which helps in creation of a basket which we can access through our localhost on port 80.

script execution

After executing the script we simply try to access the newly created basket and we see a page which is not loading properly and is showing maltrail version 0.53 being used.

maltrail

I found an exploit that is an RCE for Maltrail v0.53 by spookier. I didn’t even change the code and simply ran it over on the request basket we had created and got shell as puma.

exploit for reverse shell access

shell as puma user

If we do a simple sudo -l we get to know that the puma user can run systemctl with sudo privileges:

sudo -l output

Now when we simply run this with sudo command and once we do that we see the running status of maltrail:

systemctl output

Now this comes to a standstill and there is an input we can provide, if we input !sh we actually get the root shell.

root access