> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/luanne.md).

# Luanne

NetBSD machine!

## Gaining Access

Nmap scan:

```
$ nmap -p- --min-rate 10000 10.10.10.218
Starting Nmap 7.91 ( https://nmap.org ) at 2021-03-25 11:33 EDT
Warning: 10.10.10.218 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.10.218
Host is up (0.023s latency).
Not shown: 58365 filtered ports, 7167 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
9001/tcp open  tor-orport
```

### Port 9001 Password

I wanted to see what Port 9001 had for us, but I didn't get very far because it required credentials to access.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-67643202efaabc693dd8d682f5645af1e0575fd9%2Fimage.png?alt=media)

Default credentials of `admin:admin` worked! Then, we were able to view the Supervisor program running on it.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9ad7039be49d97d130c622ef5db689217d84cc63%2Fimage.png?alt=media)

When clicking on the processes, I was able to find quite a few that were rather interesting:

```
root        348  0.0  0.0  74136  2928 ?     Is    3:33PM 0:00.01 /usr/sbin/sshd 
_httpd      376  0.0  0.0  35244  2008 ?     Is    3:33PM 0:00.01 /usr/libexec/httpd -u -X -s -i 127.0.0.1 -I 3000 -L weather /usr/local/webapi/weather.lua -U _httpd -b /var/www 
root        402  0.0  0.0  20216  1664 ?     Is    3:33PM 0:00.01 /usr/sbin/cron 
```

Most notably, we can see that the `_httpd` user was running some kind of .lua script for the weather. Perhaps this would be used later.

### Weather API Enum

When viewing the page, we get a 401 Unauthorized code because we don't have any credentials. Default and weak credentials don't work here.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-406b4baebe3ceaa186498c3d20d4f3ca7875793c%2Fimage.png?alt=media)

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-96c36ec72d39e5508bce476d820cc0580c6dab7b%2Fimage.png?alt=media)

I ran a `gobuster` scan on port 80 in the hopes that I would find something else, and I did find a `robots.txt`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b3314e54ccc8a8d15c165e98ee083ab9fb1affa9%2Fimage.png?alt=media)

Viewing `robots.txt` revealed this file:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7a46815f50d22275a80485137055e65a0a16db30%2Fimage.png?alt=media)

I ran another `gobuster` on this `/weather` directory and found another hidden endpoint.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-45bebf83a9a2763b8810e435f101e003f390f4b7%2Fimage.png?alt=media)

When interacting with this endpoint, we get some instructions on parameters to send.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c985f4bcb4a9457d56f98dd17c2148dc07af715c%2Fimage.png?alt=media)

We can interact with this API and it will return certain bits of information to us about the weather forecasts in cities.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-358f6313790bf574832a75b063e2802e5c258623%2Fimage.png?alt=media)

### RCE Discovery

Initially, I thought that there was an LFI within this, and that the city names were actually file names. So I ran a few `wfuzz` tests with for directory traversal but it all failed. Earlier, we found that some user was running a .lua script on the machine for the weather, so I tested some Lua Command Injection payloads:

{% embed url="<https://www.stackhawk.com/blog/lua-command-injection-examples-and-prevention/>" %}

I tried a few of the `os.execute()` payloads, and it worked!

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8c76077c2a87d2f945a31293e4053afcb381d777%2Fimage.png?alt=media)

We now have RCe, and we can easily use a `mkfifo` shell to gain a reverse shell.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b54230cb5323df28b13b4c287c518badba076377%2Fimage.png?alt=media)

## Privilege Escalation

### Port 3001 LFI

Afterwards, I found the `.htpasswd` file for the webpage I was blocked from earlier.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3b716344d92653eed13f8a9941d5fb99dc14520e%2Fimage.png?alt=media)

With this, I was able to crack the hash to give `iamthebest` as the password and login to the service on port 80. We can view the `Authorization` header here.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-bab8b27c7da6df309171add8d87329359eb86d01%2Fimage.png?alt=media)

With this, I enumerated the users on the machine, of which there was just `r.michaels`. I enumerated the processes he was running, and found that he was running a similar process to the `_httpd` user, but on port 3001 instead.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d48f4918e5757e305e3b87838376ecb2ec23bf65%2Fimage.png?alt=media)

Interactions with this instance revealed that it was similar to the weather API we found earlier.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c865890f3176fc58780a2d557f995460ffb2f3f0%2Fimage.png?alt=media)

However, no command injection seems to work here. Perhaps this was a patched version of the script.

In the command, we can see that the creator of the box used `httpd -u`, which makes the root directory of the script accessible. This means that we should be able to read the files of the `r.michaels` user. I attempted to read his SSH keys with our credentials, and it worked!

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1dd2fb6c00d89e272d419e14e5ad105b7b27e55a%2Fimage.png?alt=media)

With this, we can SSH inas the `r.michaels` user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e52fec374918792d962623148fb39dc6225c993e%2Fimage.png?alt=media)

### Tar Backup -> doas

Within the user's directory, we would find a `devel` backup file.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f12c7321ad48fa35a19c9ffc57d3af6b3e86aff2%2Fimage.png?alt=media)

Since this was a BSD machine, the commands and binaries are a little different. I searched for all the binaries within this machine (since `gpg` was not available) and found that `netpgp` was downloaded. With `netpgp`, we can decrypt this file.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-eabd0e9b5c9ff17d8a5c46bb7874a7d18e49ce6b%2Fimage.png?alt=media)

Then, we can decrypt this file and find another `.htpasswd` file.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a8c15cf10537179492aa3e355a3c7a3137ec3d9f%2Fimage.png?alt=media)

The hash would crack to give `littlebear`. I wanted to check whether this was the root user's password, but this machine does not have `sudo`. Instead, it has `doas` and this password works in spawning a root shell.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2fa0cc5ed86fbab16d5eec85eec74b7e2e06247f%2Fimage.png?alt=media)

Rooted!