Walkthrough of Hackthebox DevOops system

Written by on
Hello Guys, it been a while since I have wrote a blog. Well without wasting any time lets dig into the devoops system of hackthebox as the title describes.

Let fireup the namp on ip of devoops which is 10.10.10.91 and wait for port scan results.



So we have 2 port open ssh(22) and http(5000)
Lets check whats there on http as it may contain the door (vulnerabilities) which may allow us to get initial foothold.



Hmm! Nothing interesting let fireup our favorite directory buster (gobuster).



We Found 2 directory let view upload directory as the name looks very interesting.
Well it seems the application allow us to upload xml file. Interestingly whenever I think of xml I always remember XXE attack. But in our case we need to craft the complete xml file with proper required elements.



So we have crafted the xml with our payload to view the /etc/passwd file and boom 🎆 we got the passwd file.



Now as we know that the XXE can be exploited so lets find some way to gain RCE on the server so that we have control on the server.
After struggling for hours I remember that I haven't enumerated user home directory on the System :( So I started to view the files present in the users home directory and found the ssh key which can be used to login via ssh on the system.
So here we goo /home/roosa/.ssh/id_rsa :) Let log into roosa account using the ssh key which I found.



Finally got the shell so lets start to enumerate the box. While enumerating I notice one interesting user "gituser". So I started enumerating about it and found git application was running as root user and accessible by current user (roosa) and there are some project under git.While enumerating I found an bash script which point to /home/roosa/work/bloogfeed/src



It confirm that there is something related to git for privilege escalation but what???
After searching on google for some time about git and its command, and reading the man page of git I found out about "git log" command which looked interesting so though of exploring the same.



There was a comment in the commit reverted accident commit with proper key . Now I got a feeling that somehow I need to retrieve the key. Well once again google to rescue. But I failed to find anything on google so at the end I asked one of my friend for hint and explained all the situation and current status were exactly I am stuck. I got very interesting hint Time machine use freaking Time machine, I was like Okay!!!!!
Again started to search on google like git time machine, git travel back , git past , git code past , git history, git commit history and git code history.
At the end searching yield me fruit.
git log -p origin/master At that point I felt like I should read man pages and it's parameter details with my eyes open.
And after many many hours of struggle found ssh key from git log.



Well Now I formatted the ssh key and used it to logged as root.



Thanks for reading the post.
Special Thanks to all my friends who help / supported / motivated me for writing blogs. 🙏

Comments

Post a Comment

Popular posts from this blog

Process Injection - Part I

Written by on
Image
Hello All, After publishing the post about Dumping Process Memory with Custom C# Code my friend Himanshu suggested me to write a tool & a blog post about Process Injection for learning and he referenced his post about Code Injection which covers the concept about the vanilla process injection technique. It was quite interesting to learn and understand the core concepts about Process Injection techniques and as a learning path to code in c# leveraging Windows API I started writing the tool for Process Injection. What is Process Injection ? Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. Why Process Injection ?
Read more

Introduction to Callidus

Written by on
Image
Hello All, Performing Red Team assessments are becoming challenging day by day. In mature environments we see a lot of custom tool development and new techniques are getting discovered by the community to overcome various challenges. While thinking about such challenges, I came up with the idea of creating a tool that can leverage legitimate services for establishing command & control communication channel which is likely to be whitelisted or are less monitored due to the nature of services used by the corporate environments. This is not a new technique, we have already seen similar projects that were developed to leverage legitimate services for command & control. Communication channels such as Slackor for Slack C2, DaaC2 for Discord C2 or  Domain Fronting techniques etc. In this post I will introduce you to a tool called "Callidus" which I created to learn & to improve my knowledge about developing custom toolset in C# and learning how to leverage
Read more

Exploring the Dark Side of Package Files and Storage Account Abuse

Written by on
Image
 Hello All, In this blog, we dive into the dark side of package files and Storage Account abuse within the Azure Function App service. We explore how package files can be leveraged to enhance the functionality of the Functions Apps, shedding light on the potential abuse of package files. By examining the connection between the Function App and Storage Account, we uncover how attackers can abuse the Storage Account's connection string to gain unauthorized access to the Function Apps. We will provide step-by-step insights into replacing binary files and deploying custom code, enabling attackers to take control of the Function App.  The research was jointly done by  Raunak and myself . What are Function Apps? Function Apps (Lambda in AWS) are serverless computing services provided by Azure Cloud. They allow developers to build and deploy small, functions that can be triggered by events such as simple HTTP request. Function Apps provide an environment for executing our code without th
Read more