Walkthrough of Hackthebox DevOops system

Written by on
Hello Guys, it been a while since I have wrote a blog. Well without wasting any time lets dig into the devoops system of hackthebox as the title describes.

Let fireup the namp on ip of devoops which is 10.10.10.91 and wait for port scan results.



So we have 2 port open ssh(22) and http(5000)
Lets check whats there on http as it may contain the door (vulnerabilities) which may allow us to get initial foothold.



Hmm! Nothing interesting let fireup our favorite directory buster (gobuster).



We Found 2 directory let view upload directory as the name looks very interesting.
Well it seems the application allow us to upload xml file. Interestingly whenever I think of xml I always remember XXE attack. But in our case we need to craft the complete xml file with proper required elements.



So we have crafted the xml with our payload to view the /etc/passwd file and boom 🎆 we got the passwd file.



Now as we know that the XXE can be exploited so lets find some way to gain RCE on the server so that we have control on the server.
After struggling for hours I remember that I haven't enumerated user home directory on the System :( So I started to view the files present in the users home directory and found the ssh key which can be used to login via ssh on the system.
So here we goo /home/roosa/.ssh/id_rsa :) Let log into roosa account using the ssh key which I found.



Finally got the shell so lets start to enumerate the box. While enumerating I notice one interesting user "gituser". So I started enumerating about it and found git application was running as root user and accessible by current user (roosa) and there are some project under git.While enumerating I found an bash script which point to /home/roosa/work/bloogfeed/src



It confirm that there is something related to git for privilege escalation but what???
After searching on google for some time about git and its command, and reading the man page of git I found out about "git log" command which looked interesting so though of exploring the same.



There was a comment in the commit reverted accident commit with proper key . Now I got a feeling that somehow I need to retrieve the key. Well once again google to rescue. But I failed to find anything on google so at the end I asked one of my friend for hint and explained all the situation and current status were exactly I am stuck. I got very interesting hint Time machine use freaking Time machine, I was like Okay!!!!!
Again started to search on google like git time machine, git travel back , git past , git code past , git history, git commit history and git code history.
At the end searching yield me fruit.
git log -p origin/master At that point I felt like I should read man pages and it's parameter details with my eyes open.
And after many many hours of struggle found ssh key from git log.



Well Now I formatted the ssh key and used it to logged as root.



Thanks for reading the post.
Special Thanks to all my friends who help / supported / motivated me for writing blogs. 🙏

Comments

Post a Comment

Popular posts from this blog

Information Disclosure - Internal Path Disclosure (PHPWCMS) - CVE-2018-12990

Written by on
Image
Hello All, ​INTRODUCTION T​he  purpose  of this post is to let you know how I managed to get one more CVE​. Throughout this post, I will give you relevant examples/screenshots that demonstrates how I ended up finding the vulnerability. ​Alright, lets plunge into the Proof-Of-Concept ! ​ PATH OF EXPLORATION ​ After submitting the first vulnerability (Stored Cross Site Scripting) to the developer for phpwcms application I continued to test further for finding more vulnerability. While testing I saw that CSRF Token was submitted in all the request. I tried to tamper with the parameter which contained the CSRF Token and found that the application throws an error which discloses the Internal Path of the application where it has been hosted. THE MOST AWAITED DEEP DIVE POC​ 1) While submitting the profile page request I saw that the application passes one parameter (csrf_token_value) which as per the name suggest contains the csrf token as you can refer the ...
Read more

Introduction to Callidus

Written by on
Image
Hello All, Performing Red Team assessments are becoming challenging day by day. In mature environments we see a lot of custom tool development and new techniques are getting discovered by the community to overcome various challenges. While thinking about such challenges, I came up with the idea of creating a tool that can leverage legitimate services for establishing command & control communication channel which is likely to be whitelisted or are less monitored due to the nature of services used by the corporate environments. This is not a new technique, we have already seen similar projects that were developed to leverage legitimate services for command & control. Communication channels such as Slackor for Slack C2, DaaC2 for Discord C2 or  Domain Fronting techniques etc. In this post I will introduce you to a tool called "Callidus" which I created to learn & to improve my knowledge about developing custom toolset in C# and learning how to leverage ...
Read more

Process Injection - Part I

Written by on
Image
Hello All, After publishing the post about Dumping Process Memory with Custom C# Code my friend Himanshu suggested me to write a tool & a blog post about Process Injection for learning and he referenced his post about Code Injection which covers the concept about the vanilla process injection technique. It was quite interesting to learn and understand the core concepts about Process Injection techniques and as a learning path to code in c# leveraging Windows API I started writing the tool for Process Injection. What is Process Injection ? Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. Why Process Injection ? ...
Read more