HTB - Horizontall (Part 2)
Continued from Part I --> https://pillothecat-hacks.tumblr.com/post/672411290205093888/htb-horizontall-part-1
Find the user flag
Find the user flag in home/developer/user.txt
------------------------
Privilege Escalation
Next, we’ll need to upgrade our privilege to root shell to obtain the root flag.
Let’s start off by looking for additional vulnerabilities from our new shell.
After much search for any files with open permissions, command executions, and network connections, we’ll notice additional open ports with programs running on them.
--> netstat -antup
After curling a few of the ports on the victim’s local host, we’ll find that port 1337 is running mysql and port 8000 is utilizing a Laravel v8 php framework.
From searching exploits for Laravel v8, we can find another remote code execution script CVE: 2021-3129.
------------------------
SSH keygen and login
For the exploit found in the previous step to work, we’ll need to port forward 8000. As seen from netstat enumeration, we’ll need to connect to the victim’s loopback address by first “ssh”ing into the system.
In order to achieve this, first create an ssh-keygen from our local machine.
--> ssh-keygen *from Kali
Then copy the key into the victim’s machine; the key is saved in ~/.ssh/authorized_keys
--> echo ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDbjR2N81pTJ31fRwPBIrwn/g5JglLgJFcfrK/2QzJ/xwgJrVP/PybeYpXkZTpS5pFMs2b8B5jOgNpMEM2Q3hEjaHrqvzfj1MGcqLhXnw8ohUHQqXkF33XxFsz/S8h99m3A/dJcgn6QhnU2OyEDKs/2SqJNsIgs0PfRXGp+GlD8vHPakKTulwBAmjBJLsZGJA1z4ALnSVLVqgzUFb9ZdldrAXTLJVD8GZym5u5vwHOhyJAR21Z+6Ht4mGzqzIL17hxrR6eHi+/4qHzsev/f2FypJie/g0Gzw+hoNkuHAqHaBZkjQ+KyumlBkfEGDJoeqMvGsA5jtxguzoB/gkih/vnH9LBIsHqW+h/ORfsYGDtM1UllmISDBndeDeLL4iH596P3cqpxGCQZW/dtOGxDhg/YNssbj1zvxgCF8euz4h96xiFw9KvNNommcjXjTox8lij8xyf0usDK7KvDxLzBWq0tBQtInX/EPl0BhDXPenc8bM4UddFSFllN8dNLqiJSjgk= kali@kali > ~/.ssh/authorized_keys *from Horizontall machine
** Note that the path /usr/lib/openssh/ssh-keysign was listed when we checked for files with open permissions, and thus indicated that we are able to create a key in our victim’s machine
Now back in our Kali, we can ssh into the victim’s machine with our key that we’ve generated and forward the port.
For more information on the syntax --> https://linuxize.com/post/how-to-setup-ssh-tunneling/
Let’s check and confirm to see if the port has been forwarded by viewing it from the browser (with the loopback IP, since we are now on the localhost)
From a new terminal in Kali, we can now execute the RCE (CVE2021-3129). Exploit can be found and downloaded from here
--> https://github.com/nth347/CVE-2021-3129_exploit
Upon executing the script we receive the following message for the proper syntax.
The output states that we can use Monolog/RCE1 as the <CHAIN> . As for the <CMD>, since we are looking for the root flag, we can direct our command to “cat /root/root.txt” to retrieve the root flag!
