So, I haven’t been playing HTB for quite sometime, and I finally had some motivation (or mood) to try out some boxes. So here is my writeup for the HTB seasonal machine: PermX.
So, starting off, lets run nmap to look for the open ports.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(w0rmhol3㉿QuackMachine2)-[~/Documents/CTF/HTB/Permx] └─$ nmap -sC -sV -Pn 10.10.11.23 -o nmap-scan.nmap Starting Nmap 7.94 ( https://nmap.org ) at 2024-07-11 09:24 EDT Nmap scan report for 10.10.11.23 Host is up (0.28s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 e2:5c:5d:8c:47:3e:d8:72:f7:b4:80:03:49:86:6d:ef (ECDSA) |_ 256 1f:41:02:8e:6b:17:18:9c:a0:ac:54:23:e9:71:30:17 (ED25519) 80/tcp open http Apache httpd 2.4.52 |_http-server-header: Apache/2.4.52 (Ubuntu) |_http-title: Did not follow redirect to http://permx.htb Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Directly we can see only 2 ports open (SSH and HTTP), so lets start going through the web to see what we can find.
in short, this is some sort of an e-learning platform, nothing special from here, but this web took me quite some time to look around, fuzzing everything i can. and in the end, i decided maybe subdomain is worth to have a look as i don’t think there’s anything worth looking into from here.
Using ffuf to enumerate it, i was able to found an interesting subdomain.
the ‘-fw 18’ is use to filter out the response size 18, as they are the ones that are invalid.
As shown, the subdomain“lms.permx.htb” was found.
When i saw this page, instantly i went to google and look for existing CVE, in which i had found CVE-2023-4220: Chamilo LMS Unauthenticated Big Upload File Remote Code Execution. This vulnerability allows an unauthenticated attacker to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
I found an exploit script from github that can automate this attack to gain reverse shell directly.
So, using the script and running netcat, i was able to gain a reverse shell.
1 2 3 4 5 6 7
┌──(w0rmhol3㉿QuackMachine2)-[~/Documents/CTF/HTB/Permx] └─$ nc -lvnp 4444 listening on [any] 4444 ... connect to [10.10.14.48] from (UNKNOWN) [10.10.11.23] 34572 bash: cannot set terminal process group (1169): Inappropriate ioctl for device bash: no job control in this shell www-data@permx:/var/www/chamilo/main/inc/lib/javascript/bigupload/files$
And this is another part where I am stuck at, as this initial foothold does not comes with the user flag, I wrap my head around trying to figure out how to get to the user. So, what was needed to be done is to find a way to get mtz user account to get user.txt, then privilege escalate to root. It took me some time to figure out next is to find the config file.
After taking my time enumerating the server, i found the configuration file that had led me to a credential.
So, I believe that the intentional method was to go through the sql database, and exploit from there, but when I found this credential, I instantly went and try to ssh into mtz account.
1 2 3 4 5 6 7 8 9 10 11
┌──(w0rmhol3㉿QuackMachine2)-[~/Documents/CTF/HTB/Permx] └─$ ssh mtz@10.10.11.23 The authenticity of host '10.10.11.23 (10.10.11.23)' can't be established. ED25519 key fingerprint is SHA256:u9/wL+62dkDBqxAG3NyMhz/2FTBJlmVC1Y1bwaNLqGA. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.23' (ED25519) to the list of known hosts. mtz@10.10.11.23's password:
Last login: Thu Jul 11 13:32:46 2024 from 10.10.16.50 mtz@permx:~$
WALLA, mtz account. So from here just read the user.txt to get the user flag.
1 2
mtz@permx:~$ cat user.txt [flag]
So user✅ all left is the privilege escalation.
1 2 3 4 5 6 7 8 9
mtz@permx:~$ sudo -l Matching Defaults entries for mtz on permx: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User mtz may run the following commands on permx: (ALL : ALL) NOPASSWD: /opt/acl.sh
when trying to see what mtz is able of executing i found this /opt/acl.sh file.
This file is not writeable, and can only be executed, so from the looks of it, executing this file is the only way to get root. So from my own understanding, I can see that it can mess with the file’s ACL, but I did utilized chatgpt to help me correctly use this function
The explanation of this code is that, the acl.sh file will be able to change the file permission, that are within /home/mtz directory.
This brings me the thought of changing the root credentials to mtz credentials by allowing modification on the /etc/shadow file. But to do so, an extra step of creating a symlink of /etc/shadow file in the user directory to change the file permission.
As you can see, i modified the root password hash to be as same as mtz’s hash, hence it replaces the password to get the root access in the system. All i need to do now, is become root.
