> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/medium/bart.md). # Bart ## Gaining Access Nmap scan: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-27443a19e138a845bd6247041a13c601735383c2%2Fimage.png?alt=media) Only one port was available. We had to add `forum.bart.htb` to our `/etc/hosts` file to access the website. ### Web Enum The website was a standard company page: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ec347381e0792a268b61dd08c90b61837a1b0194%2Fimage.png?alt=media) I checked the page source, and found a unique bit here. Seems like there was a user that was not shown for some reason. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8b6f592546b0454fd666caf5e86cfc5750c1f9d6%2Fimage.png?alt=media) harvey is the user we probably need to access. We can fuzz subdomains using the `bart.htb` domain to find more places to visit. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-faa5d8c55bf1137f13ffb888d81120bff1dd6ef2%2Fimage.png?alt=media) ### monitor.bart.htb We can visit this to see that it's running PHP Server Monitor v3.2.1. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7182a0eca4a2c011c52f886c46f4eb50f874ee96%2Fimage.png?alt=media) `harvey:potter` works as credentials to let us log in. There, we would view an internal chat instance. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3aa7312b7464224cd9a43a250b4b087ffbf301e8%2Fimage.png?alt=media) I looked around and found the settings for this internal chat service, and found another subdomain. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-6961ea2ddcccc2804836395956cd0c5d0e6fa263%2Fimage.png?alt=media) We can head to that domain to find another application running. ### Simple Chat Log Poisoning There's a login page within the new page. Our previous credentials of `harvey:potter` do not work here. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-5e10eec5d9f373b8f8eec55514fe9fbb951a441b%2Fimage.png?alt=media) However, what's interesting was the URL of the website, at `http://internal-01.bart.htb/simple_chat/login_form.php`. Googling around, we can find the exact simple\_chat PHP application being used as it is a open-source project. {% embed url="'" %} Within the source code, we can view the register.php to see how to register a new user. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8c9ed85c30fbe1759b8443b380d9473221584e0f%2Fimage.png?alt=media) All we need to do is sent a POST request with the `uname` and `passwd` parameters to register. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d5db4c85c8bb8be8fbe8f67e2d3acc6c4d1cef0e%2Fimage.png?alt=media) Afterwards, I logged into the server. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9256a625f15987dcb44074423fa0d6a01618d9d4%2Fimage.png?alt=media) Within this page, there's the ability to view the Log files, and when we do, we would first get a pop-up similar to xss with 1, and have this GET request be sent to the machine. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7c4dc348688539846107c144c1ed2577efcfeb81%2Fimage.png?alt=media) When viewing this log, I noticed that the User-Agent was copied from my machine. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-db30a557442ae2d8ae31476ab521cf6ea95ad372%2Fimage.png?alt=media) I played around with this and altered my `User-Agent` field to something else, and it was still copied over. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3194950dc93c2cef51e4b454362ee319d31ab881%2Fimage.png?alt=media) ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ad142486124f806945bcfe0fffb5f9e99270ced4%2Fimage.png?alt=media) With this, because it is a PHP page, I attempted to write a webshell within the HTTP header and also change the page to a PHP page by altering the `filename` parameter. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f87217509649427421910fda151f769556c759bb%2Fimage.png?alt=media) With this, we can easily gain a reverse shell into the machine using Invoke-PowerShellTcp, as other shells don't work out well. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c33f6429330a6357b29ed1497cecf0b6752166a0%2Fimage.png?alt=media) ## Privilege Escalation ### JuicyPotato When checking our privileges, we notice we have the SeImpersonatePrivilege enabled. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3480ebbe43c42b7d2d3e7452282dec85ff83c774%2Fimage.png?alt=media) Checking `systeminfo`, we also find that a vulnerable version of Windows was running with no hotfixes. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d1a5bdda47b7bf0306eec84ff8f92197b7e7edd0%2Fimage.png?alt=media) We can run the JuicyPotato exploit to get a reverse shell as root. First, we need to create a .bat file that would be run. I used nc.exe to run my shell: ``` C:\Temp\nc.exe -e cmd.exe ``` Then, we can get JuicyPotato on the machine and run it with a CLSID. We can find one from this page: {% embed url="" %} ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-6e715eda50c43bd5a4c86284016830b43b873910%2Fimage.png?alt=media) Afterwards, we would catch a shell as the administrator. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-0b40f51e8c9bbe343e95a769b5c71639fd154694%2Fimage.png?alt=media)