HTB - Busqueda » IslandDog Cayman Islands

🔎🦶Enumeration/Foothold

Before I begin each machine I kick off a full port scan with RustScan and pipe the open ports found into NMAP.

Copy

Noticing Port 80 is available I navigate to the website. I change my host file (sudo mousepad /etc/hosts) and refresh to show the following –

Shows the Searchor 2.4 application running.

I search Searchor 2.4 noted at the bottom for an exploit. I found multiple… (which I believe is just because this box came out a few months ago). Doing some additional research I found GitHub – ArjunSharda – Pull 130 which I believe directly highlights the bug. I also noticed a .git directory on the box upon getting the svc account so in the future I might (probably won’t) come back and try a different approach. Long story short this version is exploitable to a remote command injection. By putting in the following in the What do you want to search for: area-

Copy

and changing your ATTACKER_IP and PORT and starting of an nc listener you can get a shell. Once on the box I use ssh-keygen to create myself a public/private key so I can get a more stable shell.

Copy

Generating public/private rsa key pair.
Enter file in which to save the key (/home/kali/.ssh/id_rsa): /home/kali/Documents/htb/busqueda/id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/kali/Documents/htb/busqueda/id_rsa
Your public key has been saved in /home/kali/Documents/htb/busqueda/id_rsa.pub
The key fingerprint is:
SHA256:0C5jZ8ryuEvXR2b00HyfOldN8iC1/mPpqd7jvQrVN9Q kali@kali
The key's randomart image is:
+---[RSA 3072]----+
|              .  |
|       .   o . ..|
|      . . o + =.E|
|       o . o +o*o|
|      + S + ...+*|
|     o B +  . ..=|
|    o + . .. o =.|
|   . =   .  . *.+|
|    +o.     .++*+|
+----[SHA256]-----+

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCgCLdUctorzHIc+BQvP9iBpm8opjJokNw8ZdrfaD0xMATtw8vuGYKD598753eLhvcMugroMpHJ9BEB5ykECMtJd1dJZ+PnSlEwBinozWscq1Yen9e5kXwOidr0XiMjNoKPQCUgQxkHlVfcGKBcYYorMDDreykdVV9T4+07KtwEX01jCTq2MkEM9Mhg0nU4NeCHsq0vspQgeTB9+ttqX19GespucoqMkG7Ji8j4teUXSLw5K1j7I27LzvxFHfniHKS9NnPyRDOi3X+DIADXuPzBhCM8U0/T0JGOPqoVqnlbZE9hEWfDGCQlHHi/SC69w51J9CXxXANS20+e2hJ9MRjhpYmufVCny0sxtav65SW/Au+sDBXjpdZrkh+N3MIuMLRVKglviGuYgNRi60JFTaUHIU2va/p5M3qnUjgtw4VAtx+7tTNDCB7MFIYPyGPk3P4B0SuvJHxnMJuWdHPLtylRS/f6QVdgncVPhz8rRSexBH5+RSqo4gzKx6Uv1rx+S5E= kali@kali

Copy

Once on the box I navigated over to app to do a deeper dive. I remembered I saw a git folder once I got on the box so I looked up the config and associated commits.

Copy

Using the information found in the config file we can now see a new user cody and a new subdomain, gitea.searcher.htb. After adding the sub-domain to my hosts file mouse /etc/hosts I navigate over to the URL.

Gitea running on the gitea.searcher.htb sub-domain.

I logged in as Cody and was able to find nothing useful. I checked the Gitea version, keys and commits with no avail. I decided to run LinPEAS on the box and added Andy’s password. It came back with a hit –

Copy

Running the command shows the following –

Copy

I found a guide earlier when trying to do docker escapes which highlighted using inspect to find the configuration of the container Exploit-Notes – Docker.

Copy

I copied it over to my local machine and ran it through jq to make it pretty:

Copy

The json export provided me with a username and password for the gitea database –

🔝Escalation to Root

With this new password I tried multiple avenues until I realized it was the other user, Administrator found in the gitea application. Logging in showed the full-checkup.sh and system-checkup scripts from earlier.

#!/bin/bash
import subprocess
import sys

actions = ['full-checkup', 'docker-ps','docker-inspect']

def run_command(arg_list):
    r = subprocess.run(arg_list, capture_output=True)
    if r.stderr:
        output = r.stderr.decode()
    else:
        output = r.stdout.decode()

return output

def process_action(action):
    if action == 'docker-inspect':
        try:
            _format = sys.argv[2]
            if len(_format) == 0:
                print(f"Format can't be empty")
                exit(1)
            container = sys.argv[3]
            arg_list = ['docker', 'inspect', '--format', _format, container]
            print(run_command(arg_list)) 
        
        except IndexError:
            print(f"Usage: {sys.argv[0]} docker-inspect <format> <container_name>")
            exit(1)
    
        except Exception as e:
            print('Something went wrong')
            exit(1)
    
    elif action == 'docker-ps':
        try:
            arg_list = ['docker', 'ps']
            print(run_command(arg_list)) 
        
        except:
            print('Something went wrong')
            exit(1)

elif action == 'full-checkup':
        try:
            arg_list = ['./full-checkup.sh']
            print(run_command(arg_list))
            print('[+] Done!')
        except:
            print('Something went wrong')
            exit(1)

if __name__ == '__main__':

try:
        action = sys.argv[1]
        if action in actions:
            process_action(action)
        else:
            raise IndexError

except IndexError:
        print(f'Usage: {sys.argv[0]} <action> (arg1) (arg2)')
        print('')
        print('     docker-ps     : List running docker containers')
        print('     docker-inspect : Inpect a certain docker container')
        print('     full-checkup  : Run a full system checkup')
        print('')
        exit(1)

In the system-checkup script the full-checkup.sh is not a fully defined path. We can take advantage of this by building our own full-checkup.sh and executing the script in the same directory with sudo. I built a one-liner using python3 as it was on the box and called it full-checkup.sh. I uploaded it to the box, setup a netcat listener and executed the previous command in the same directory:

Copy

full-checkup.sh

Copy

Rooted.

https://www.hackthebox.com/achievement/machine/245261/537

Published On: April 3rd, 2024 / Categories: HTB, Technology / Tags: .git, docker, gitea, kavigihan, PATH, Searchor, sub-domain /

HTB – Busqueda

Busqueda from HTB features a vulnerable Searchor web app. On the box we use git, gitea, password reuse and running scripts for root.

🔎🦶Enumeration/Foothold

🔝Escalation to Root

Rooted.

Leave A Comment Cancel reply

HTB – Busqueda

Busqueda from HTB features a vulnerable Searchor web app. On the box we use git, gitea, password reuse and running scripts for root.

🔎🦶Enumeration/Foothold

🔝Escalation to Root

Rooted.

Related Posts

HTB – MonitorsTwo

HTB – Pilgrimage

HTB – Keeper

HTB – Trick

Leave A Comment Cancel reply