> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-updown.md).
# HTB - UpDown
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
if we give a url it will check if the given url is up or down that means i can test for SSRF.
i can ping the localhost also the domain name is found in the response.
Scanning fro internal ports reveal only port 80 is able to give successful response and remaining says site is down so SSRF is not the case here.
that said i will add the domain name to the hosts and scan for subdomains.
and it reveals a new subdomain called dev, add it to the hosts file.
but accessing it says forbidden error.
running feroxbuster reveals a dev directory on the main site.
Accessing dev results in an empty page
dev should be there for a reason so i will again fuzz for hidden directories.
using a different wordlist reveals a hidden git directory.
it holds some interesting files
the checker.php checks for any file uploaded and if any wrappers are used results in a hacking attempt detected. The uploaded files are stored in uploads directory as md5 sum of the time uploaded.
direct access is blocked could be a possible reason why the `dev.siteisup.htb` is blocked.
Also the upload option takes a list of ips and checks if they are down or up.
* `SetEnvIfNoCase Special-Dev "only4dev" Required-Header` this checks incoming requests for a header named `Special-Dev`. If its value matches the string `only4dev` (case-insensitive), Apache sets an internal environment variable called `Required-Header`
* `Deny from All` / `Allow from env=Required-Header` access is denied by default, **unless** that environment variable got set i.e., unless the request included the correct header/value pair
using the header gives access to the site.
i will create a list of ips and upload to see how it reacts.
the files are saved in uploads directory.
since i know how the website filters i will use a polyglot technique to upload a php file and execute it.
for this purpose i will use phar.
the file is saved ion uploads directory
and the execution works
that said i will build a payload that will give me reverse shell.
```
disable_functions: pcntl_*, error_log, system, exec, shell_exec, popen,
passthru, link, symlink, syslog, ld, mail, stream_socket_sendto, dl,
stream_socket_client, fsockopen
```
**`System`, `exec`, `shell_exec`, `passthru`, and `popen` are all explicitly disabled.** So the payload you were about to send (`system($_GET['cmd'])`) will fail PHP will throw a fatal error/warning on that call (suppressed since `display_errors` is Off, so you'd just get blank output.
`proc_open` is NOT blocked.
i can use it to get reverse shell.
### php reverse shell using proc\_open
{% embed url="" %}
the payload can be used to get reverse shell.
## Shell as www-data
i need to get shell access as developer but first upgrade the shell
```bash
$ python -c 'import pty; pty.spawn("/bin/bash")'
www-data@updown:/home/developer$ export TERM=xterm
export TERM=xterm
www-data@updown:/home/developer$
```
takes a url and check up or down.
also the siteisup file has suid bit set so i can use it to spawn a shell as developer.
## Shell as developer
developer can run easy\_install as root without password.
```
developer@updown:/home/developer$ cat /usr/local/bin/easy_install cat /usr/local/bin/easy_install
#!/usr/bin/python
# -*- coding: utf-8 -*-
import re
import sys
from setuptools.command.easy_install import main
if __name__ == '__main__':
sys.argv[0] = re.sub(r'(-script\.pyw|\.exe)?$', '', sys.argv[0])
sys.exit(main())
developer@updown:/home/developer$
```
gtfo bins has a page on how to abuse this
{% embed url="" %}
```bash
mkdir /tmp/priv && cd /tmp/priv
echo 'import os; os.system("exec /bin/sh /dev/tty 2>/dev/tty")' > setup.py
sudo easy_install .
```
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-updown.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
