HACK THE BOX — HELP
OS: Linux
Difficulty: Easy
Status: Retired
Hello fellow hackers!
Today i would like to share my walkthrough of the Hack The Box “Help” machine.
In this write-up, i will demonstrate the full exploitation path, from initial reconnaissance to privilege escalation.
Additionally, I will demonstrate an alternative privilege escalation method that I did not find in other publicly available HTB walkthroughs.
As usual, we begin with an Nmap scan.
The scan reveals three open ports:
22/tcp — SSH
80/tcp — Apache
3000/tcp — Node.
Let’s check port 80.
Since the hostname cannot be resolved, we add the domain to the ‘/etc/hosts file.
After updating the `/etc/hosts` file, the application becomes accessible.
The page displays the default Apache web page.
Next, we run ffuf to enumerate hidden directories.
While ffuf is running, let’s check port 3000.
What we see here is some kind of hint, I presume, ok we’ll remember that.
Get Alleyezonme’s stories in your inbox
Join Medium for free to get updates from this writer.
Let’s check the ffuf results.
OK, we now have two accessible directories. Let’s take a look at the support directory.
This appears to be an open-source helpdesk system. Let’s google it and see if there are any known vulnerabilities. While we’re doing that, let’s run ffuf against the files in this directory.
A few vulnerabilities we have in our results. But we don’t know exact version of our application, let’s check out ffuf results then.
We have a couple of useful results, including readme.html and License.txt. Let’s examine readme.html first.
So now we have the exact version of the vulnerable application. According to the previous screenshot, there is an upload vulnerability. Let’s check if it exists in searchsploit on Kali Linux.
And it does. Let’s copy Python script in our working directory using -m flag and examine it.
As stated in the script, we need to upload our PHP shell via the ticket submission form and then invoke it. However, we don’t know where the uploaded file is stored. Obviously, it is not uploaded to the root directory, so we first need to determine its location.
This repository https://github.com/ViktorNova/HelpDeskZ/ suggests that the application using following path for uploads: HelpDeskZ/uploads/tickets.
So let’s try it out using aforementioned Python script.
First we need to upload our shell. I used a common PHP shell from the /usr/share/webshells/php/ directory on Kali and modified the IP address according to my network settings.
After that, I go to the web-site and try to upload the shell via “Submit a Ticket” form.
The application threw an exception,but I decided to try exploiting it anyway(who knows?).
I setup a listener on my Kali machine and ran the exploit. My attempt was rewarded, and i obtained reverse shell!
First of all, let’s spawn a pseudo-TTY using Python.
After that, I decided to upload linPEAS(https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS) to gather as much information about the OS as possible. I set up a Python web server on my Kali machine and uploaded the script.
I made linpeas.sh executable(chmod +x) and ran the script using tee, so that in case something went wrong, I would at least have an assessment file. I could also upload that file to my machine to examine it more easily.
After linPEAS finished it’s execution. I started examining the linpeas.txt file. The first thing I noticed was that the Linux kernel was quite old, and also linPEAS suggested exploit for that kernel version. gcc was available for us, so let’s give it a try!
I searsploit again for that exploit and copied it to my working directory.After that, I delivered the exploit to the victim machine using a Python web-server.
I then compiled the exploit using gcc, executed it, and successfully obtained root privileges.
This is the standard Privesc path for this machine, but I chose to explore alternative exploitation methods.
In the linpeas.txt file, I noticed an uncommon SUID binary named s-nail-privsep.
After searching on google, I found a known exploit for it(CVE-2017–5899).
https://www.exploit-db.com/exploits/47172. The exploit is also available in searchsploit on Kali. It leverages a race condition, so the first execution did not grant root access, but after a couple of attempts, it worked!
Happy white‑hat hacking!
Thank you for taking the time to read this walkthrough!
