Mentor

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.228.102
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-08 10:29 EDT
Nmap scan report for 10.129.228.102
Host is up (0.0061s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

We have to add mentorquotes.htb to the /etc/hosts file to access port 80.

Mentor Quotes API

The website has daily motivational quotes posted:

Doing a subdomain enumeration reveals an api subdomain:

When visited, it reveals nothing:

Doing a feroxbuster scan reveals a LOT of endpoints present:

These are some interesting endpoints, and I think viewing the Documentation is the most important.

This is a token-based API, so when we register a new user, it would return a JWT token to us. We either have to spoof the token to become the administrator to read sensitive information, OR we have to find an injection point for RCE.

One thing to take note of was the Send email to James link, which would send an email to james@mentorquotes.htb, and it is implied he owns the website (and is probably the administrator of this API).

Anyways we can create a user and login to retrieve our token:

Then, to access other parts of the API, we need to use this token as part of the Authorization HTTP Header. However, we aren't allowed to do so:

Now we already know that the user email is james@mentorquotes.htb, so let's try to register a user with the same email or the same username:

Surprisingly, both work. However, this would lead to nowhere as I still cannot access the API using any of these tokens.

I found out later that this method was unintended, and it did work for a while before being patched.

SNMP Brute -> James PW

I was a bit stuck here, so I referred to a writeup. Turns out, SNMP is open on this machine.

The default community string public did return some information, but it was very limited. There should be another community string present, and we had to brute force it.

We can run snmpbrute.py to find the possible community strings:

So internal is another string. When used on snmpwalk, there is a ton of output. snmpbulkwalk is a better tools because it uses threading to get the information and is faster.

Within the output, there's a password, and we can verify that this is for james on the API.

Command Injection

We can finally enumerate the API properly with this token:

Earlier, we found an /admin/backup endpoint, so let's use that.

It appears that the /backup one requires a JSON input. If an empty object is supplied, it complains and asks for a path variable.

I don't really know what they are doing in the backend, but we can try some command injection point just in case.

This was using tar on something, but more importantly our RCE worked. We can easily get a reverse shell using this after specifying some random body parameter:

There's no /bin/bash within this machine.

Privilege Escalation

Database Creds -> SSH

We can find a config.py file within /app/app.

It appears there's a database present on this machine, we probably have to use chisel to tunnel to it.

Afterwards, we can access the database:

We can view the databases present:

We can use \connect mentorquotes_htb to use that database, and then view the tables within it. Then we can enumerate the tables and select everything:

The hash for svc is crackable.

Then we can SSH in as svc and grab the user flag:

Sudo /bin/sh

james is present as a user, and our current user has no privileges or anything.

When the snmpd.conf file is viewed, we can find a password:

We can then su to james using this and check our sudo privileges, finding that getting a root shell is easy:

PreviousMagicNextMeta

Last updated