search

Help

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 -Pn 10.129.71.39
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 15:38 EDT
Nmap scan report for 10.129.71.39
Host is up (0.0079s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3000/tcp open  ppp

We have to add help.htb to the /etc/hosts file to access port 80.

hashtag
GraphQL

This port had a HTTP API running:

$ curl http://help.htb:3000/                      
{"message":"Hi Shiv, To get access please find the credentials with given query"}

I ran a gobuster scan to find any places that I could send queries.

GraphQL was present. So we need to send query parameters and hopefully find some credentials or other information from this. We can use this to see all types and argument accepted:

At the top, we see this:

This means we can query username and password fields from user, which would make {user{username,password}}.

The hash is crackable on CrackStation.

hashtag
HelpDeskZ

On port 80, it just shows the default Apache2 page:

Doing a gobuster scan reveals some directories:

/support reveals a HelpDeskZ instance:

We can login with helpme@helpme.com:godhelpmeplz. From the HelpDeskZ repository, there's a readme.html file present where we can find the version that is running.

This version has an exploit available:

First we need to open a ticket and then upload a cmd.php webshell.

Then we can submit this, and even though the website says the file type is not allowed, the file is still uploaded onto the website. Then, we can use 40200.py to find it.

Then, we can get a reverse shell easily and capture the user flag.

hashtag
Privilege Escalation

hashtag
Kernel Exploit

The machine is running an outdated version of Linux:

We can use this kernel exploit to get a root shell:

LogoLinux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege EscalationExploit Databasechevron-right
PreviousHeistNextHorizontall