> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/medium/hawk.md).

# Hawk

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e7fa6ba9eedd15022d25cadccb6ca1a4bda4260f%2Fimage.png?alt=media)

Interesting ports that are open here. Running a detailed scan would provide clearer resolution on what's running on the machine.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e4de19c0afcc62a8be0853488d1359b29c0ea398%2Fimage.png?alt=media)

### FTP Anonymous Login

Firstly, I checked the FTP port to see if I could login without credentials, and it worked.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-30a27e1d865f7a4c81eddeeb966f1f71cbf681e3%2Fimage.png?alt=media)

Within the FTP directories, there was an encrypted message left behind.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f5cbec2414e1a4b433b59a29b699cf4cde17e24e%2Fimage.png?alt=media)

### OpenSSL Brute

First, we have to enumerate the type of encryption used on this file.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-adf661c07ee8a847e90eff0e23c3e6c8cc00cf34%2Fimage.png?alt=media)

Since this was encrypted using `openssl`, we can download and use `openssl-brute` to decrypt this message and find some Drupal credentials.

{% embed url="<https://github.com/deltaclock/go-openssl-bruteforce>" %}

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-21f7ded0a9b86c4dc6da187c6fcae5f847f3e5af%2Fimage.png?alt=media)

### Drupal RCE

We can head to port 80 to find out where to use these credentials:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-edbc0edae9f3364f34c79e07880977dcda39a24e%2Fimage.png?alt=media)

This seems to work. Using `admin` as a username, we can login. Upon login, we have the permission to edit the contents of pages.

To gain a reverse shell on Drupal manually, we would need to edit the contents of a PHP page to execute some malicious code.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e46b51ff8782f3b2b61b86a13e19ce9ceab8ec84%2Fimage.png?alt=media)

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-de53a537563f65352864938a9ee6d25ed4f6de45%2Fimage.png?alt=media)

Lastly, we need to change the configurations to allow execution of PHP code.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ff01b2c176eb3418ff4765d66d8be52590f91ee2%2Fimage.png?alt=media)

Then we can upload the changes after selecting the PHP Code option.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c5a0106b9dc0362a751feef7f4972c662a85f44b%2Fimage.png?alt=media)

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ddbf1002da653218805bfb8e4e02b407e940f218%2Fimage.png?alt=media)

## Privilege Escalation

### Daniel Creds + Escape

Once we are in, we can go view the configuration files for this Drupal instance. Within the `/var/www/html/sites/default/settings.php` file, we can find this:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-80e05581dba2037ac89e219234a1534964da4bf5%2Fimage.png?alt=media)

Earlier, there was mention of a `daniel` user. We can use the credentials we found to SSH in as him.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-fe5e925a535832bf5eee7813a00ac1d9f88fb647%2Fimage.png?alt=media)

The most interesting thing is being dropped into a Python shell, which we can break out easily using `import os;os.system("/bin/bash")`.

### H2 RCE

We can enumerate the ports to see what services are running via `netstat -tulpn`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4420fc28e0e906dd730afecfd0989468639991cb%2Fimage.png?alt=media)

Earlier in the Nmap scan, we found port 8082 to be running but we couldn't access it. Also, cheking on the processes running reveals that the root user is running a h2 databsae instance on this machine.

```
root        814  0.0  0.0   4628   868 ?        Ss   Apr01   0:00 /bin/sh -c /usr/bin/java -jar /opt/h2/bin/h2-1.4.196.jar
root        816  0.0  6.8 2339688 67568 ?       Sl   Apr01   4:05 /usr/bin/java -jar /opt/h2/bin/h2-1.4.196.jar
```

This is clearly the next step. As such, we need to use the SSH credentials we have to do port forwarding so we can access this service.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d2b357406e7f106f9e0a682d14da55ccf25c45c2%2Fimage.png?alt=media)

Afterwards, we can access the service by going to `http://127.0.0.1:8082`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d6254e1dca2a11ccb5ca6348eadde1598a2108cd%2Fimage.png?alt=media)

This version of H2 is vulnerable to RCE however, and as such the port forwarding is a bit redundant as we can run the exploit directly as `daniel`.

{% embed url="<https://www.exploit-db.com/exploits/45506>" %}

We can upload the script to the user's account, and run it to gain a shell as root.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ca3bd4233869cec0168098546368cbce84fa34e4%2Fimage.png?alt=media)