Cozyhosting
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 3000 10.129.121.30
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-04 13:22 +08
Nmap scan report for 10.129.121.30
Host is up (0.16s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpDid a detailed scan as well:
$ nmap -p 80 -sC -sV --min-rate 4000 10.129.121.30
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-04 13:23 +08
Nmap scan report for 10.129.121.30
Host is up (0.17s latency).
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://cozyhosting.htb
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelWe can add this host to our /etc/hosts file and start proxying traffic through Burpsuite.
Web Enum -> Spring Boot -> Admin
Port 80 shows a basic corporate site:
There is a login function, but weak credentials or basic SQL Injection attacks don't seem to work. I did a gobuster directory scan, which revealed a few directories:
When visiting all of these, the /error endpoint stood out:
Whitelabel Error Page means that the website uses Spring Boot, which requires a different method of enumeration. Using something called Actuators, we can query information about the website through HTTP requests:
Using this, we can try to find some custom endpoints that may not be present in any wordlist. We can use the /actuator/mappings directory for this:
There was one that stood out, which was the /executessh one. However, I was not allowed to interact with this service at all, presumably because I am not given permissions as an administrator or something.
When checking the /actuator/sessions directory, we can find another cookie:
Using this cookie, we can access the administrator dashboard:
Admin Dashboard -> RCE
At the bottom of the dashboard, we can see a few fields that take user input and hint that this is the /executessh service:
When submitting some random values, the browser sends a POST request to /executessh, and the error is sent through a GET request:
Seems that the host resolution happens in the website, so let's replace that with 127.0.0.1. When that happens, the error is Host key verification failed. The username part seems to be passed directly into...somewhere.
I tried some basic Command Injection using ; and `, and found that the latter worked.
Using this, we can try to get a reverse shell as the user. When testing random payloads, I managed to trigger an error on the machine as well by typing {$IFS} wrongly:
The bash reverse shell one-liner didn't work and was quite problematic with all of its special characters, so I used a curl one-liner instead.
Privilege Escalation
CloudHosting Jar -> SQL + User Creds
The app user has access to this .jar file:
Within the machine, there are other services that are active:
Port 5432 for PostGreSQL is on, so let's enumerate that next. First, we need to find the user that is using the database, and pspy64 can do that:
A user with UID 114 is using it, and the /etc/passwd file has that:
postgres is using the database. However, this user still requires a password:
The password might be within the cloudhosting jar file, so I downloaded it to my machine via nc. Instead of unzipping the entire .jar file, we can use zipgrep to extract certain information from it.
The above password works and we can login to the database:
Afterwards, we can enumerate this database. There are a few databases available:
Using the cozyhosting database, we can find a users table:
When we extract all data from it, we get 2 hashes:
We can crack one of these hashes using john:
The user in the machine is called josh:
Using this password, we can ssh in as josh:
Sudo Privileges -> Root
Since we have the user's password, we can check our sudo privileges:
Using the command on GTFOBins, we can spawn a root shell:
Rooted!
Last updated