Horizontall
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.84.249
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-30 00:38 EDT
Nmap scan report for 10.129.84.249
Host is up (0.030s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpAdd horizontall.htb to our /etc/hosts file to view the website.
Horizontall Subdomain
This is a typical corporate website advertising a product:
Viewing the page source, we can see a small interesting bit here:
I don't usually come across this, and it appears to be intentionally left there by the creator because the message is customised. We can try to view the JS code that's within this, and perhaps we would find something new. I searched for the box name, and found a new subdomain within the app.js file:
Interesting! We can add that to our hosts file and view it.
API Reviews
This is what we see when we visit that page:
When we head to the /reviews directory, we would see some JSON
I ran gobuster to scan the directories present on this website and check if we can find anything new.
Viewing /admin would bringus to a strapi login page:
Googling for exploits pertaining to strapi shows this:
Running the script would spawn a "terminal" for us and also reset the administrator password.
Great! We have RCE. Now, we can easily get a reverse shell.
Grab the user flag within the developer user home directory.
Privilege Escalation
Port Forwarding
Within the user's home directory, there are some file regarding a project:
Since there is a PHP file, there might be another application running on another port. We can run netstat to check this:
We can spawn another shell to port forward this using chisel. Since the strapi has a home directory, adding an authorized_keys file is pretty easy. Then, I downloaded chisel via wget and ran these commands:
Then we can visit the page!
Laravel Debug RCE
The website just has the default Laravel page:
We can run a directory scan to see what's available.
Interesting. Viewing the /profiles leads to a 500 error and brings us to a debug page.
This application enabled the Debug mode and also had Laravel v8 running. It appears to be vulnerable to an older exploit that allows RCE through Laravel Debug mode.
This exploit uses phpggc to create a malicious serialised PHP file that would allow us to execute commands. So, we need to download phpggc to the machine and run the following command:
The first part would allow us to create a phar file that executes id on the system. When we run the exploit, this is what we would get:
Works! Now we just need to specify a longer command. In this case, I decided to make /bin/bash an SUID binary. We just need to run these commands again
Then we can easily get a root shell on the machine.
Rooted!