Heal Writeup
Machine Name: Heal
Difficulty: Medium
Release Date: Retired
IP Address: <IP>
I started off with a full port scan:
But what really caught my attention was the HTTP service not following the redirect, so I just opened it in my browser and saw it took me to http://heal.htb.
Used the Developer tools, and we can see that while signing up we get a new subdomain ie axx.heal.htb, this can also be fuzzed by ffuf.
Now, checking the new subdomain.
Next page after that new subdomain is resume builder after signing up. And if we look carefully it will redirect us to a new subdomain.
Viewing the page source of txxx-surxxx.heal.htb. We get the technology the site is using.
Now adding /admin to the txxx-suxxx.heal.htb
Back to Resume builder page:
Get Shagun Garg’s stories in your inbox
Join Medium for free to get updates from this writer.
Inspecting the Developer page we get a new link. You can use burp suite also for the same.
This filename parameter has a lfi(local file read) vulnerability.
Now, by some googling i got to know theres a gemfile in this version.
By opening the tables specified in the file, we get hardcoded credentials.
These are hashes. can be cracked by hashcat or john the ripper.
Logging using the credentials we got-
Vulnerability:
Theres a Exploit of Limesurvey which gives you RCE. You are just left with cloning the exploit and then uploading it to a zip file to the /admin panel of the take-survey.
By this you will get a web shell.
