> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-help.md).
# HTB - Help
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.18
3000/tcp open http Node.js Express framework
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
add domain to hosts file for accessing the website.
also port 3000 displays the below message
ferox found some interesting directories accessing any of it keeps buffering but nothing interesting.
the only thing that sounds interesting is the username revealed on port 3000 called shiv.
Looking at the data on port 3000 i guess there is an hidden api endpoint.
accessing a graphql endpoint it responds with below message
That confirms it `/graphql` exists and is expecting a GET request with a `query` parameter. This matches the earlier hint about "credentials with given query."
### Enumerating Qraphql
{% embed url="" %}
The above blog post can be helpful in enumerating the graphql.
Introspection is enabled and confirmed there's a `Query` type and a `User` type.
user field takes two arguments username and password lets pull that data.
Found the above credentials, crackstation cracked the password
the password doesnt work for both helpme and shiv user.
That said i need to find something where i can use the credentials.
the earlier directory enumeration on port 80 revealed a hidden directory called /support
it did not load earlier but now it does.
i can use the credentials here to login.
got successful authentication.
i dont know the exact version of the helpdesk being used but poking around google i found there is a sql injection vulnerability in version 1.0.2 which i can try here.
the flaw is in the ticket viewing and attachment. so i will try to create a ticket see whats going around.
{% embed url="" %}
poc explains the vulnerability and exploitation steps.
i will upload a junk file as attachment and submit the ticket.
this is the vulnerable request the exploit is talking about.
the vulnerability is in the `param[]` parameter that said i will use sqlmap to test it.
## Shell as Help
**4.4.0-116-generic** is vulnerable to the classic **eBPF local privilege escalation, CVE-2017-16995**
### **eBPF local privilege escalation**
transfer the file to the victim
compile and run
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-help.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
