# BrainFuck ## Gaining Access Nmap scan:
We can add `brainfuck.htb` to our `/etc/hosts` file and visit the HTTP wesbites. ### Wordpress Ticket System Website revealed a Wordpress site:
Because this was a HTTPS website, we can take a look at the certificate first to find an email address.
Looking at the alternate DNS names, we can find another hidden subdomain, which we'll visit later.
We can run `wpscan --enumerate p,t,u` on this website. This returns a plugin that is outdated and exploitable.
For this version, there are SQL Injection and Privilege Escalation exploits available.
Based on the PoC for the Privilege Escalation one, we have to create some HTML code that would allow us to login as the administrator. Earlier, we found an email address for the user `orestis`. We can use that for our exploit. Here's the HTML frames we need: ```markup
Username:
``` Afterwards, we just need to set this up on a Python server and visit the site. The username is based on the username of the first post we saw.
Initially, nothing happens when we click the login button, however after refreshing the page, we are notified that we have logged in as the administrator.
### SMTP Creds When viewing the plugins, we can find another plugin that enables SMTP on the Wordpress site.
When viewing the SMTP configuration settings, we can find the username and password for port 110.
The password can be taken by viewing the page source to reveal the hidden value.
We can then proceed to enumerate the SMTP instance. ### Reading Emails We can sign in to the service on port 110.
Then, we can view the messages sent using `list`.
We can read both the emails, and one of them has credentials for a forum page.
These are probably credentials for the secret subdomain we found earlier. ### Forum Page We can login to the forum page here using the credentials we found earlier. Then, we can view the pages that are present.
Some of the forum pages mention sending SSH keys somehow.
There was also an encrypted few posts.
There was clearly a URL within that, and it seems that numbers **are not being scrambled**. This means this is a letter-only cipher. After a bit of research and testing on CyberChef, Vignere cipher is the one used here.
Then, we can head to that website to find the `id_rsa` file for `orestis`.
The file is password encrypted, so we have to use `ssh2john.py` to convert this to a hash for `john` to crack.
Then we can use `openssl rsa` to write the key out.
Afterwards, we can simply SSH in using this key.
## Privilege Escalation ### lxd When enumerating using LinPEAS, we can see that the user is part of the `lxd` group.
Being part of this group means that we can create and manage extra containers for this machine. The exploit path is to create a container where we have root privileges and it is mounted onto the main disk. {% embed url="" %} I downloaded an alpine distro to the machine. Then, we can execute the commands from HackTricks: ```bash # import the image lxc image import ./alpine*.tar.gz --alias myimage # It's important doing this from YOUR HOME directory on the victim machine, or it might fail. # before running the image, start and configure the lxd storage pool as default lxd init # run the image lxc init myimage mycontainer -c security.privileged=true # mount the /root into the image lxc config device add mycontainer mydevice disk source=/ path=/mnt/root recursive=true # interact with the container lxc start mycontainer lxc exec mycontainer /bin/sh ``` The last command would drop us into a root shell, where the `/root` directory has been mounted and we can grab the root flag.
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/insane/brainfuck.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.