Spectra

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.244.152
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-30 23:05 +08
Nmap scan report for 10.129.244.152
Host is up (0.0055s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql

HTTP and MySQL are open. I did a detailed scan as well:

$ nmap -p 80,3306 -sC -sV --min-rate 3000 10.129.244.152
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-30 23:07 +08
Nmap scan report for 10.129.244.152
Host is up (0.010s latency).

PORT     STATE SERVICE VERSION
80/tcp   open  http    nginx 1.17.4
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.17.4
3306/tcp open  mysql   MySQL (unauthorized)

We can start Burpsuite and begin enumerating the web service.

Web Enum -> WP Creds

The website just showed two links, and mentions Jira, which is a ticket tracker software.

When the page HTML is viewed, we can see where the link takes us.

After adding spectra.htb to the /etc/hosts file, we can take a look at what software the websites are running. The first website brought me to a Wordpress site:

We can use wpscan to enumerate the website for us. This was an older machine, so Wordpress Core will definitely be outdated. There were quite a few plugins found to be outdated, but I didn't manage to exploit them. wpscan did find one user though:

Anyways, moving to the testing/index.php site, it just shows us an error:

Loading the /testing directory shows us a listing:

What's interesting was the .save file, which could actually be read with curl to find credentials:

Using this password, we can login as administrator to the Wordpress site. Using this, I tried to get a reverse shell by manipulating the 404.php within the theme being used.

However, this error popped up:

We'll have to find a different method to get a shell.

Akismet Plugin -> RCE

There are 2 plugins installed on the site:

Instead of finding a public exploit, we can actually edit the plugin directly on Wordpress. Using the Plugin Editor, I replaced the PHP code with a webshell. In this case, I replaced the code for akismet.php, and it can be triggered using curl:

Then, we can easily get a reverse shell:

Privilege Escalation

Autologin -> Katie Shell

This machine was a ChromeOS machine, as specified from the home directory:

I didn't know a lot about how ChromeOS functioned, but tools like pspy64 didn't work. Within the /opt directory, there were some interesting files:

The autologin.conf file contained some interesting stuff:

From what I gathered, there's a password in the /etc/autologin directory:

Using this, we can ssh in as katie.

Sudo Privileges -> Root

This user could run initctl as the root user:

This binary allows us to initialise daemons:

Also, I checked which files were owned by katie and the developers group:

It appears that we own quite a few test.conf files, meaning that we can edit it. The configuration files contained some bash lines:

I added chmod u+s /bin/bash to test2.conf, and then started the process. Then, we can easily get a root shell:

PreviousSoccerNextSquashed

Last updated