> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/friendzone.md).

# FriendZone

Full of rabbit holes and garbage enumeration. I'll be skipping them.

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8b32f8afe944f40c9185c1da8db1c009fba80c9f%2Fimage.png?alt=media)

Lots of ports open.

### SMB + Web RCE

We can enumerate the SMB shares to find that we have write permissions over one of them.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-10e2bb54f6a1489b9218a01aae68609851d46cde%2Fimage.png?alt=media)

This folder contains nothing, but the fact that we have write access indicates that we should probably be adding something to it. We can also find some credentials in the other share.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-36055d1a808cbd43d485ab68c53b140b1008a5d7%2Fimage.png?alt=media)

Now, DNS is open, so we can expect to have loads of sub-domains. This machine has so many and it's rather painful to exploit. So I'll cut to the chase, we have to visit `administrator1.friendzone.red` that has a login page for us:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e5ddd8c609b26fe6214c73720ca8a5290376e4a5%2Fimage.png?alt=media)

We can login using the credentials we found earlier in the SMB share. The page then tells us to visit `dashboard.php`, which is a Smart Photo Script.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-89bc972fc477db77586923570162036722e3a6ee%2Fimage.png?alt=media)

The `pagename` parameter is vulnerable to LFI, and since this is a PHP application, we can place a PHP reverse shell file somewhere and execute it using this page. That's where the share that we can write to comes in.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2daeac2d0a94f82cf814ad09d20a33e2aa68f754%2Fimage.png?alt=media)

Then we can just simply access it by visiting this:

```
http://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=/etc/Development/rev,
```

This works because the `pagename` paramter automatically truncates the `.php` extension. The original page included a timestamp at the bottom that is being dynamically generated.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-5bb02238e209f1f055e1804ce68aa03349ae7fe5%2Fimage.png?alt=media)

This points towards to some script being used in the backend, and thus we can replace that with our own malicious PHP script to gain a shell.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-97f65688e8e45b862253d5b76efd211e72676361%2Fimage.png?alt=media)

## Privilege Escalation

### SQL Credentials

As `www-data`, we have limited access over everything. The first place to look is within the `/var/www` file which can contain some credentials.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1edd38916ff2848bb10e89e7db1c20c6fd844227%2Fimage.png?alt=media)

We can use this to `su friend`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-46220a9ca68eb05a8c71129cdddeede99049cc94%2Fimage.png?alt=media)

### Python OS Tampering

When we run `pspy64`, we can see that `root` is runnin some scripts in the background:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e3fdd9fbba720b6beee84ebce325bce05faf4f35%2Fimage.png?alt=media)

When we read this script, we can see that it contains some random code that we can't really exploit because we cannot edit it:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f6d7cec09890d2473f926a30ab457d1cabce2b64%2Fimage.png?alt=media)

We can see that `import os` is used, and any external modules could be exploitable. Conveniently, the machine let's us have write permission to `os.py`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2ae9c966a5f92dc1f477aa1d8583ce152e7dfd15%2Fimage.png?alt=media)

Then, we just need to append a Python reverse shell to this:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-834764620170d1459111c261ea4bac73a8cbd576%2Fimage.png?alt=media)

After opening a listener port and waiting, we would catch a root shell.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-24baa08a2042ee8dc5e902064977e29706a67173%2Fimage.png?alt=media)