Shoppy

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.227.233
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 14:12 EDT
Nmap scan report for 10.129.227.233
Host is up (0.0063s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
9093/tcp open  copycat

We have to add shoppy.htb to our /etc/hosts file.

HTTP

Port 80 reveals a count down to the release of a website.

Doing a gobuster scan reveals a few directories:

There's a login page.

I tested SQL Injection, but it didn't seem to work. We can still fuzz subdomains using wfuzz, and I did find one:

Mattermost

The sub-domain brought me to another login page.

Directory scanning and searching for public exploits returned nothing useful, so let's come back to this later.

NoSQL Injection

On the main shoppy.htb website, I tried NoSQL Injection using both regular HTTP parameters and JSON. I was able to bypass it using this:

With this, we can login to the admin dashboard:

There was a Search for Users function, and since this application is already vulnerable to NoSQL Injection, we can use a similar payload to see what we get:

Then we can download the export to see some credentials:

The hash for josh cracks.

Using that, we can login to Mattermost and see that there are credentials on the screen!

We can use this to ssh in as the user.

Privilege Escalation

Password Manager RE

As this user, we can run a command using sudo as deploy.

When run, it prompts us for a password, and I tried to reuse both of the passwords we found earlier but it doesn't work.

We can transfer this back to my machine and decompile it with ghidra. When opened, we can see the master password it is compared to.

We can use this to get the real password:

We can then su to deploy.

Docker Group

As this new user, we are part of the docker group.

We can use this to create a new container that has access to the filesystem of the machine, and make ourselves root of the container. This effectively gives us root access over the files of the main machine too.

With this, we can go to /mnt/root/root.txt to read the root flag. We can also drop our public SSH key into the authorized_keys file or make /bin/bash an SUID binary.

PreviousServmonNextSupport