Hacking Dev

Heya people! So, I am back with another one because this is fun. So, this box also belongs to one of the few boxes that are given in the TCM PEH course. This was a tricky one for me because I am dumb. I missed many things and that led to me wasting my precious time. Not that I have anything better to do than hacking boxes but still time is time.

So, let’s start without any further dinging donging. The box was pretty straightforward if I was smart enough to do it straightforwardly but you have to bear with my dumbness here. Like with every other hack/box/CTF let us start with nmap scan. Command used: nmap -T4 -v -p- -Pn -A target > file.txt, simply waited for the scan to complete and well as usual watched some awesome video of networkchuck and TCM. I won’t use the same tactic here, don’t worry.

Scan presented to me was like so:

nmap scan

Too much info. So, my dumbness here was to directly go to the port 80 and 8080 and find entry points there, but if I was smart enough, I would go 2049 nfs and see if it gives me something, but let us follow my dumbness here and go to port 80 and 8080.

So I browsed to port 80 and saw there was an information leakage there which told me that bolt was used as a framework and it was misconfigured.

port 80 website

So after this, I went to port 8080 it served me this:

port 8080 website

So I ran a directory brute force attack on the site with port 8080, you can use any tool, I liked the feroxbuster tool so I have been using that. I got some interesting directories but one stood out and gave me an admin password: http://10.0.2.19:8080/dev/pages and found a member.admin page with a password — “I_love_java” now this password could be used in ssh also if the dev was not wise enough to use different passwords we will try that in a while because we still don’t know the user.

Admin logged in successfully by that password. So there was a version leak in the website which said that the version running was 6.03 so I went out to the sage of knowledge i.e. google, and searched for an exploit for boltwire 6.03 and I found LFI in a particular page

LFI

so I ran that and read the /etc/passwd file and I got a username Jeanpaul so now we know the password and the username for ssh but well it didn’t work because my dumb ass didn’t feel to try nfs port.

So after a while of exploring the website at 8080 I went to 80 and ran directory brute force and got many directories there and a possible database file so I save it for later. There was not much in other directories so after getting stuck for a while I finally went for nfs port 2049.

I used command showmount -e IP to locate the mount folder and then simply created a folder in mnt folder mkdir /mnt/dev and just mounted it like so:

/srv/nfs is the result of showmount -e.

From there I found a file save.zip which was apparently password protected. So I looked on the internet of there is any way to crack this password and well I did find one which was fcrackzip so I used the tool to crack the password and hoped for the best

Command used: fcrackzip -v -u -D -p wordlist file .zip file

And luckily, I got the password and 2 files came out when unzipped the folder. One was todo.txt and the other was id_rsa and finally, I was happy. My agony and depression went away. I ssh’d the hell out of the box.

Command used: ssh -I id_rsa username@IP

Password was I_love_java so I did get access to the machine now let’s get to root. So, like any other privilege escalation tactic, I ran sudo -l to see what kind of program I can run as a privileged user. I found out that zip can be used as sudo then well…

I went to gtfobins and looked up zip

I ran the command using sudo and got root access and then went to the root folder and boom I became Hacker man.

Here are my very short notes