> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/medium/shared.md).

# Shared

## Gaining Access

Nmap scan:

![](/files/tc0FWgIyonW2dwbXydH8)

I took note of the HTTPS site, and wanted to check it out. Also, added `shared.htb` to the `/etc/hosts` file as required.

### HTTPS Port

The website was a standard shopping page.

![](/files/THClbZyxkVW9erKVQCFG)

I wanted to view the certificate that was used to view any names or information that I could use.

![](/files/TRj06EOVx5agqJYqwspT)

There were wildcards present in the domain, so I knew that we had to check for subdomains that were present.

![](/files/rS6m6l4QDOaarIBZjHkz)

### Custom\_cart SQLI

The checkout page looked vulnerable to me.

![](/files/5MHyo3iNoFAVYs4n4hEE)

All the parameters passed in via POST request were fine, but when proxying traffic, I noticed the weird `custom_cart` cookie that was used when we were adding products and viewing stuff. I tested some SQL injection payloads and found it to be vulnerable.

![](/files/e69CNuNBJKxTNgdOWwNr)

For instance, I was able to enumerate the datbase that was used.

![](/files/923eElbiC99Uy357IEZG)

![](/files/1kBeVmzbAYNNAVjlJYk3)

The output of the injection was printed on screen for us. We can now enumerate the database, which has a **user** table within it. This payload can be used to enumerate whatever we need:

```
custom_cart = {"breached' and 0=1 union select 1, username, 3 from heckout.user -- -": "10"}
```

From there, we can find out the username of the user, which is **james\_mason**.

![](/files/uJi0x1H8OxmIhboJnyrp)

We can also find his hash.

![](/files/xpzYntdlx7lSXzOA2tdQ)

This password can be cracked using crackstation.

![](/files/QpkjrVLLTsuT4HCU0n4K)

Then, we can ssh in as `james_mason`.

![](/files/OTaj4AHXkRjgFCGzmmBP)

## Privilege Escalation

We find that there's another user called `dan_smith`, and we cannot access the user flag he has:

![](/files/mwr2vHpTku6CxCtwOFGG)

### Pspy64

I ran `pspy` to see what processes were running on the server. Found a few interesting ones, the first being that the root user was running `redis-server`.

![](/files/CT8eJAQUuK0IKLT2iPxm)

The second was that `dan_smith` was running `ipython` consistently.

![](/files/Tl47V8Y4nImW8tXv4q5T)

### IPython

We can enumerate the version of `ipython` that was running.

![](/files/0yvrZlKGk3OWMRWy72jp)

This version was vulnerable to an RCE exploit.

{% embed url="<https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x>" %}

Following the PoC, we can grab dan's private key:

![](/files/vFOrG9E4Vqj8qc8lli25)

Then, we can SSH in as dan.

### Redis-Server

We saw earlier that root was running `redis-server`. We first need to search for the password for this server. Firstly, we can check the version and find that it's outdated and vulnerable to the Redis ExecuteCommand Module exploit.

![](/files/hysVTPtXYF7haaBE4FkW)

{% embed url="<https://github.com/n0b0dyCN/RedisModules-ExecuteCommand>" %}

I ran LinPEAS, and found one within the `/usr/local/bin/redis_connector_dev` file.

![](/files/ZUh32k9C15SflzSx9MJR)

We can then sign in using `redis-cli` on the machine and load the exploit.

![](/files/fd6wFlf0ZGFIMNDn66Xo)

![](/files/5RCKiLRWArziRySMYQ51)