> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/hard/falafel.md).

# Falafel

## Gaining Access

Nmap scan:

![](/files/I5jhK7zvk9hmgWvzYarC)

### FalafeLovers

Port 80 reveals a kind of social network website.

![](/files/JpMY6Y4dticJvenxKNc2)

I ran a `gobuster` scan on the website, and it revealed tons of interesting directories.

![](/files/3jj90eyLtMUHZCEevC0T)

On the `cyberlaw.txt` file, we can find some hints on what to do next.

![](/files/ucX4Ufpk7TN338GmTcOp)

Interesting. So there's a `chris` user and he hacked the website first.

### SQL Injection

There was a login page on the website we could access.

![](/files/BK8OTQGWL6O6xpH1pGCs)

When trying to enter credentials for the `admin` user, this was the error received.

![](/files/vWmROc5ToIrWAW6f5GyK)

When a random input as the user, we get a different error.

![](/files/jk4BtBvbVOO8ZxPJtqm3)

It seems that there's a boolean condition present on the website. I proceeded to test this with `sqlmap` using `--level=5 --risk=3` flags. I also included the `--string` flag to signify which was the boolean condition to use.

![](/files/F8pwpSMCItJyPgLNN9h4)

We can then dump out the database.

![](/files/gfWHIPJq8Ps3d0JsrAzl)

Now we can login as `chris`.

### Type Juggling

Viewing the profile of chris reveals a hint to use PHP Type Juggling.

![](/files/JoUCiZVANgX3sy6Ag9BS)

PHP Type juggling was a type of vulnerability that can be used to **force the returning of true** through using specific hashes.

{% embed url="<https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09>" %}

There are repositories of hashes that we can use easily.

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Type%20Juggling/README.md>" %}

When using these hashes as the password in the login page, we can login as the `admin` user.

### Word Limits

Viewing the profile of the `admin` user shows a hint to bypass some kind of limit.

![](/files/U9kwzuznk0mgmprQEKTh)

Didn't know how to abuse this yet, so I tried to exploit the image upload function that we now had access to.

![](/files/7KN8lP1BzLW843CetxDn)

I attempted to upload some PHP webshells, but it did not work.

![](/files/NQCMXTainSmwyOvTwLMk)

When uploading a jpg file, this is the output we get.

![](/files/eMfTjQcoelXSkUi62Ydd)

Attempting to access our webshell does not work. However, we can see how the name of our file can be manipulated to fit the CMD being executed. Seeing the hint earlier on the `admin` profile about the limits of the file name.

So, I tested this via changing the file name to something absurdly long.

![](/files/CqFwUBtSbnAEd3HVIPAz)

There was this `Trying to shorten...` bit that was rather suspicious. Perhaps we could use this to **remove the .jpg extension and leave a .php extension**. So what I did was attempt to upload a `cmd.php.jpg` file, and have the name of the file be such that it would shorten to `cmd.php`. This truncation of the name would allow me to upload my webshell.

This would mean having a file name of 236 characters (which was the max when counted), and this works in uploading the file.

![](/files/Wk4e5v90e6v092OnC5rr)

We can then test our RCE.

![](/files/h4yPfCwQqvvVlAe6dN37)

Then we can get a reverse shell easily.

![](/files/NkTtE1TVkVUX7u74bgp8)

## Privilege Escalation

### Moshe Credentials

First, we can view the users present on this machine by reading the `/etc/passwd` file, and see that `moshe` and `yossi` are present.

![](/files/o5ONlwDMbxKIUY5JVOOw)

Then, we can view the files for the webroot. In there, we can find some SQL credentials.

![](/files/Ce4sNMrGz9kbuPqWxA9e)

We can then `su` to moshe.

![](/files/ThBumKSptTBZPCLGbSbv)

### Video Group

When running LinPEAS, we see that `moshe` is part of the `video` group.

![](/files/8cXbVPOXn2YW30VlWdxc)

Users part of the `video` group have access to a video device or the screen output. I first checked if there were other users logged in via `w`, and `yossi` is logged in.

![](/files/aCxhmC2UpPSZe5Axysqe)

This means we can take a screenshot of his session and see if we can find any credentials. This blog was useful in exploiting it.

{% embed url="<https://steflan-security.com/linux-privilege-escalation-exploiting-user-groups/>" %}

```bash
cp /dev/fb0 /tmp/fb0.raw
width=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f1)
height=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f2)
```

Then, we can run this perl script to convert the raw data into a screenshot.

```perl
#!/usr/bin/perl -w

$w = shift || 240;
$h = shift || 320;
$pixels = $w * $h;

open OUT, "|pnmtopng" or die "Can't pipe pnmtopng: $!\n";

printf OUT "P6%d %d\n255\n", $w, $h;

while ((read STDIN, $raw, 2) and $pixels--) {
   $short = unpack('S', $raw);
   print OUT pack("C3",
      ($short & 0xf800) >> 8,
      ($short & 0x7e0) >> 3,
      ($short & 0x1f) << 3);
}

close OUT;
```

Afterwards, we can transfer this back to our machine and find that it is an image file.

![](/files/aU3490mjrLoUUIViPIes)

Initially, the picture looked like some kind of rubbish.

![](/files/gofl26Z73vYnwE6m8ViL)

Then I realised it was probably because I messed up the dimensions of the image, so I changed to to these values using `gimp` as per the script to reveal some credentials:

![](/files/YtHWP95lFPiajIFaOBZY)

![](/files/xbDDbXzeDV9vrkGJPWCO)

Then, we can `su` as `yossi`.

### Disk Group

Earlier, we found that `yossi` was part of the `disk` and `cdrom` group. Perhaps there was something mounted on the machine that we can access.

![](/files/Yre5SvfvNI4pXnoW4C55)

Using `debugfs` on the `/dev/sda1` filesystem (which just looked off), we find out that we can access the `/root` directory.

![](/files/nmi1JxZbJ6xKBgRrCdat)

We can also find the private SSH key for `root`.

![](/files/7Dq5uHNGX77iSUYZVvLE)

Then, we can SSH in as `root`.

![](/files/ieXyrTPBW8zdw7w7KDM9)