Meta
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.204.20
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 14:51 EDT
Nmap scan report for 10.129.204.20
Host is up (0.0076s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpWe have to add artcorp.htb to our /etc/hosts file to view port 80.
ArtCorp -> Subdomain Fuzzing
The webpage was a start-up website:
They had a team with some names I might need to use, along with a hint that this was a PHP based website.
There wasn't much on the website, so we can try gobuster scanning for directories and wfuzz scanning for sub-domains. A gobuster scan reveals nothing, but the wfuzz scan did reveal one sub-domain.
Here's the webpage:
Metadata RCE
The application allows us to upload images to the machine.
Wneh an image is uploaded, the metadata of the image is printed on screen below:
This was the output of exiftool, which has some RCE attacks possible through metadata.
By following the PoC, I was able to confirm that we had RCE on the machine:
For some reason, the above PoC doesn't let me execute reverse shells. So I changed the script used to this:
After changing the exploit.py file to have the correct port and IP address, I got a reverse shell.
Privilege Escalation
We cannot grab the user flag yet.
Morgify
There wasn't much on the machine that www-data could access. So I downloaded pspy64 onto the machone to view processes executed by root and the user thomas.
There was a script run by the user:
Here's the script:
mogrify was used, and it is an image editor that is part of ImageMagick. We can first find the version of ImageMagick used here:
Interesting. There are some RCE exploits pertaining to this:
How the exploit works is thorugh embedding XML code within an SVG file. Here's the SVG file I used:
This uses a base64 encoded bash one-liner reverse shell. After waiting for a little bit, we should get a shell as thomas.
Neofetch
When we check sudo privileges, we see the following:
GTFOBins does have a command for this binary, but it doesn't work:
Then, I noticed the XDG_CONFIG_HOME environment variable. The exploit above relies on changing the configuration files for neofetch. In this case, since we cannot specify any flags, we can just create a malicious configuration file that would give us a root shell.
Last updated