# Base (Tier 2)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 2
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Windows
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Vulnerability Assessment / Custom Applications / Source Code Analysis / Authentication\
  &#x20;              / Apache / PHP / Reconnaissance / Web Site Structure Discovery / SUDO Exploitation\
  &#x20;              / Authentication bypass / Clear Text Credentials / Arbitrary File Upload\
  &#x20;              / Information Disclosure / PHP type juggling

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7KZKBp3eJpAUPkukMDy3%2Fimage.png?alt=media&#x26;token=4a53c7f1-1218-4f5c-a007-d2fc1797b4c3" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=2</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.93.15 -p- -Pn --min-rate 2500 -oN scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fa4217HNHv0lcd2aMaTie%2Fimage.png?alt=media&#x26;token=71bd5a77-2b38-4c5e-ad37-4745aca3668f" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F0slXGKIinFEhv3gZBwcB%2Fimage.png?alt=media&#x26;token=da1d9a18-3161-459d-a6c6-a580df05ec9a" alt=""><figcaption></figcaption></figure>

> Answer: _**22,80**_

***

* Then, to learn more about the services running on the open ports, I did an exhaustive scan

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.93.15 -p22,80 -sVC -oN serv_scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9J4U1gZJpAPZlh0GZlaL%2Fimage.png?alt=media&#x26;token=76a80ef6-767f-4d3a-a5f5-7bb82b3742d9" alt=""><figcaption></figcaption></figure>

***

* I found the HTTP protocol running on port 80, so I went to the browser to explore the content and found a website for the services of a company. I explored the sections of the site, but for the moment, the only interesting thing was the _Contact_ section, which had a form that I filled out, but when I tried to submit, it didn't work and showed an error message

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F8IVoXtu15TGU20YJZck5%2Fimage.png?alt=media&#x26;token=1a93a402-913a-4ec3-947a-f2a23f3a54f3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FfDyfpX9kOkrIh7D0P9EH%2Fimage.png?alt=media&#x26;token=e94a3543-bae5-4b4b-96ca-a7923c692c2a" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* I continued exploring the sections, reaching the _Login_ button, which redirected me to a login page. I tried logging in with common credentials, but it didn't work. What caught my attention was the route to this site on the URL, which wasn't calling the source file directly but using a relative route. Based on this, I tried reaching just the folder from which it was being taken and noticed other exposed files

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FxGISD71pX5vZjYTRkukr%2Fimage.png?alt=media&#x26;token=79857046-2d82-4cef-b25a-285a0126d0fd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FgEOSww2E6dVas3u8T334%2Fimage.png?alt=media&#x26;token=e41b183b-01a8-476f-9cf7-12e9f198a330" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, we answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FsGbZy243kAtvotbjPKuy%2Fimage.png?alt=media&#x26;token=232ff82c-9e23-46b8-9215-3c6790d75263" alt=""><figcaption></figcaption></figure>

> Answer: _**/login/login.php**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJR2o4fIyIbhyC9exErk3%2Fimage.png?alt=media&#x26;token=9998a470-9c6e-4aa0-9771-45aaa39eb906" alt=""><figcaption></figcaption></figure>

> Answer: _**3**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCtRhR6Ia5XM88R6EDiNr%2Fimage.png?alt=media&#x26;token=ba2f4aa4-211f-48ee-a679-7401f9134205" alt=""><figcaption></figcaption></figure>

> Answer: _**.swp**_&#x73;trcmp()

***

* With a little research, I found that the _.swp_ extension is for temporary files from text editors such as _vi, vim, nvim_, etc, so I downloaded the _login.php.swp_ file and used the `vim` command with the `-r` flag to recover the file, save it to a new file, and read its content, now visualizing the source code properly. We noticed it was making a comparison for the confirmation of the credentials using the _strcmp_ function

{% code overflow="wrap" lineNumbers="true" %}
```bash
vim -r login.php.swp 

# Inside vim
:w login.php
:q!
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F0awfWPelvLFBCvzuKHV8%2Fimage.png?alt=media&#x26;token=c867faa7-de56-42b5-b19e-538d1ac90320" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FSRndas6zwuHHxJbc1Np9%2Fimage.png?alt=media&#x26;token=edf1e156-2f7f-4663-9a8b-bb1293a525ed" alt=""><figcaption></figcaption></figure>

> Answer: _**strcmp()**_

***

* So, searching about this function and its possible flaws, I found out that it could be affected via _PHP_ Type Juggling, by passing the parameters from the request as arrays instead of variables. So I intercepted the petition to modify it using [_FoxyProxy_](../../../web-exploitation/tools-and-utilities#foxyproxy) and [_Burp Suite_](../../../web-exploitation/tools-and-utilities#burp-suite), then forwarded it, and reached a new page with an upload option

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FQhik4Uo6xb11fzxVksqc%2Fimage.png?alt=media&#x26;token=73ad970f-1684-4385-966a-a185ad431892" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fdw4ZoAzIU49VplSPkPOR%2Fimage.png?alt=media&#x26;token=a7c9e689-67c4-4aae-b3a8-7e88691e0680" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FXuurclnXTmn7Fll7BQj8%2Fimage.png?alt=media&#x26;token=7f871951-4622-4084-b31e-47d05118fa32" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about _PHP_ Type Juggling, you can go [here](../../web-exploitation/broken-access-control/php-abuse-php-type-juggling)
{% endhint %}

***

* Once here, I tried uploading a script for getting a reverse shell in _PHP_, and it worked, but I didn't know where the files were being saved. So, to find the location, I tried fuzzing the URL to find possible routes, and after some attempts and finding the correct dictionary, I found a route _/\_uploaded,_ which seemed to be the correct location. Then I went to that route and confirmed the file was there

{% code overflow="wrap" lineNumbers="true" %}
```bash
gobuster dir -u http://10.129.93.15 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -o fuzz.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FkyssdPHGCJINiO0rOs86%2Fimage.png?alt=media&#x26;token=b5e84fd7-ecad-4e86-aef2-fbd76fe82f0f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FnEisdHQEgenQvnlgNbGi%2Fimage.png?alt=media&#x26;token=3e0564c0-7e69-42d4-a6ee-2da28a70e317" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FNVMhBIVuKaUkaObDuhaP%2Fimage.png?alt=media&#x26;token=5a52a803-2bf6-496c-be12-9a7afa0ffc93" alt=""><figcaption></figcaption></figure>

> Answer: _**/\_uploaded**_

***

* So, to gain the reverse shell, I set up a [_Netcat_](../../../networks/tools-and-utilities#netcat) listener to catch the connection and tried accessing the file from the browser. I noticed it kept loading, and the listener successfully caught the connection. Then, I sanitized the terminal to interact better with it

{% code overflow="wrap" lineNumbers="true" %}
```bash
nc -nvlp 4444
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FKzeQ6dmxjiMu1D26j99G%2Fimage.png?alt=media&#x26;token=02130acc-698e-4b9d-9f54-ba04ccaba770" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FImhIGX86IVGo1C3PQ1Z7%2Fimage.png?alt=media&#x26;token=0bbf7abe-498b-4177-bd02-c56d9ca43186" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FkxchgGWoTeLBminvj6VQ%2Fimage.png?alt=media&#x26;token=972b4850-3a1a-4b8c-bf84-8141aac8bc64" alt=""><figcaption></figcaption></figure>

***

* As I was a default user from the web server, I had to find a way to make lateral movement to another user on the system with less restricted actions. First, I went to explore the server files in the default folder _/var/www/html,_ finding a curious file under the _/login_ folder named _config.php_, and checking its content, I found a password for the _admin_ user was being leaked

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FIGaVnhJBP8pZHzir7cx8%2Fimage.png?alt=media&#x26;token=70152953-14dc-4582-804e-b361e6e6b479" alt=""><figcaption></figcaption></figure>

***

* I had the credentials for a user on the website, but I was looking for one on the system, so maybe these credentials could also work there. I tried changing to the user _admin,_ but it failed, so it wasn't a user on the system. So I went to the _/home_ folder to see if there was any folder related to another user and found one named _john_. Once again, I tried changing to that user, assuming it would have the same password, and it worked successfully

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FRRMRHYPLGtyDwQgubloH%2Fimage.png?alt=media&#x26;token=654db30d-72d7-41e1-828d-1c7d01e60675" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrcwQTOInIYUriM6ipJcG%2Fimage.png?alt=media&#x26;token=e8c91d50-c98b-4082-96b9-4cecbb6b5b04" alt=""><figcaption></figcaption></figure>

> Answer: _**john**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FWs4vY7IdfHZdtC1q3Wm6%2Fimage.png?alt=media&#x26;token=60de119a-dd6a-4d6c-88e2-36af12d3513f" alt=""><figcaption></figcaption></figure>

> Answer: _**thisisagoodpassword**_

***

* Once there, I went to its _/home_ folder, found a _user.txt_ file, and retrieved the user flag from its content



<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FPg4m283O1S3hM1rVhPRX%2Fimage.png?alt=media&#x26;token=98786098-a092-483b-961b-219760503a8a" alt=""><figcaption></figcaption></figure>

***

* What was left was to escalate privileges, so I checked the `sudo` execution permissions for this user, and it could execute the `find` command as a privileged user

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FcHFyMLHBMPdr2Vo0VhzL%2Fimage.png?alt=media&#x26;token=face239c-a815-46c7-98ec-2f26994f8d92" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FdZY7DlOGlA4YSm7Mzb3n%2Fimage.png?alt=media&#x26;token=0c2505ad-dc15-4fed-a2b5-fbf299c1836c" alt=""><figcaption></figcaption></figure>

> Answer: _**/usr/bin/find**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FgIZNZcZNKGfRbvj34jcc%2Fimage.png?alt=media&#x26;token=7e43eb26-3c9b-4404-b721-183d9d699399" alt=""><figcaption></figcaption></figure>

> Answer: _**exec**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCo1DMyGXicEyKFHfPVJd%2Fimage.png?alt=media&#x26;token=456cd876-47ce-41a2-8fd8-f7f62ee3087f" alt=""><figcaption></figcaption></figure>

> Answer: _**f54846c258f3b4612f78a819573d158e**_

***

* Knowing that, I went to [_GTFOBins_](../../../penetration-testing/process-stages/post-exploitation/tools-and-utilities#gtfobins) to see if there was any related exploitation for the `sudo` permissions on this binary, and fortunately, it was, so I used it and successfully gained a shell as the _root_ user

{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo find . -exec /bin/sh \; -quit
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FIadai6tVwPXnqJfLQkju%2Fimage.png?alt=media&#x26;token=49eb40b2-a9dc-454d-b242-619012d1d354" alt=""><figcaption></figcaption></figure>

***

* Finally, I went to the _/root_ folder and listed its content, noticing a _root.txt_ file, and reading its contents, I obtained the root flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F36uUrnhN1iZZm4DMgS0w%2Fimage.png?alt=media&#x26;token=43a7e386-1a92-4198-a0ca-edcf928b84a6" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7IT97FbkPlTo5KtwskbE%2Fimage.png?alt=media&#x26;token=04037b77-8ec9-429a-87d1-9f8e19d957fe" alt=""><figcaption></figcaption></figure>

> Answer: _**51709519ea18ab37dd6fc58096bea949**_
