> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/medium/faculty.md).
# Faculty
## Gaining Access
As usual, we start with a Nmap scan.
There's the `faculty.htb` domain running on port 80. We can add this to the `/etc/hosts` file.
### SQL Injection
Basic PHP login page for a Faculty Scheduling System is present here:
Checking for common directories such as the `/admin` endpoint reveals another login page.
Proxying the traffic in Burp, sending a `'` character as a username triggers an SQL error.
Now that we have confirmed SQL Injection is present, we can dump out all the tables within the database from this using `sqlmap`.
The `users` table had an `Administrator` user with a hashed password, however the hash cannot be cracked.
In this case, we can dump the `faculty` table and attempt to login via the original login method. There's a PIN number associated with the `Administrator` user and we can use that to login.
### PDF Generator LFI
WItin the website, there's a PDF Generator that would display certain courses.
We can download this PDF and use `exiftool` to find out more information about it.
mPDF 6.0 is vulnerable to an LFI exploit that would allow for us to read the files on the server. With this, we can have to send this payload encoded with Base64:
```
```
This would load a PDF file that contains the `/etc/passwd` file.
The `/etc/passwd` file would be attached to the main PDF like this:
We can then read it to find out the users that are present on the machine.
From here, we can try to find the `admin.php` or `db.php` file within the machine to find some credentials. Doing a quick `gobuster` scan reveals that there is a `db_connect.php` file that we can read to find a password.
With this, we can `ssh` in as the `gbyolo` user using the password found.
## Privilege Escalation
### Meta-Git RCE
The other user found on the machine is the `developer` user. When checking the `sudo` privileges of the `gbyolo` user, we find this:
`meta-git` is a binary that allows us to clone repos as per git. However, this was vulnerable to an RCE exploit, meaning we can execute commands as `developer`.
{% embed url="" %}
Using the PoC, we can read the `id_rsa` file from the user's home directory.
Then, we can SSH in as `developer`.
### GDB Attaching
Doing initial enumeration reveals that the `developer` user is part of the `debug` group.
Running LinPEAS also reveals that we can run GDB as we are part of the `debug` group.
In this case, `gdb` can be used to attach ourselves to a process **run by root** and spawn more child processes. These child processes would all be running as root and we can basically gain RCE as root in this manner. This would stop the execution process and make the root thread spawn whatever other functions that we want.
First, we would need to find a process running as root, and preferably a Python or Bash one so we can execute commands easily.
The PID in this case is `621`, so we can run `gdb -p 621` to attach ourselves there. Afterwards, I called the `system()` function to spawn a reverse shell as root.
