> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-shoppy.md). # HTB - Shoppy ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) 80/tcp open http nginx 1.23.1 9093/tcp open http Golang net/http server ``` ## Enumeration and Foothold ### shoppy.htb

Browsing to http port gives nothing but a shoppy beta version release date timeline. But enumerating the hidden directories and hosts revealed that there is `/login` page and also additional subdomain called `matttermost.shoppy.htb`. ```bash ──(ajay㉿kali)-[~/Downloads] └─$ dirsearch -u http://shoppy.htb/ /home/ajay/.local/share/pipx/venvs/dirsearch/lib/python3.13/site-packages/dirsearch/dirsearch.py:23: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81. from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3.post1 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /home/ajay/Downloads/reports/http_shoppy.htb/__26-06-09_11-54-02.txt Target: http://shoppy.htb/ [11:54:02] Starting: [11:54:03] 301 - 171B - /js -> /js/ [11:54:10] 302 - 28B - /Admin -> /login [11:54:10] 302 - 28B - /ADMIN -> /login [11:54:10] 302 - 28B - /admin -> /login [11:54:11] 302 - 28B - /Admin/ -> /login [11:54:11] 302 - 28B - /admin/ -> /login [11:54:17] 301 - 179B - /assets -> /assets/ [11:54:22] 301 - 173B - /css -> /css/ [11:54:26] 200 - 208KB - /favicon.ico [11:54:26] 301 - 177B - /fonts -> /fonts/ [11:54:29] 301 - 179B - /images -> /images/ [11:54:32] 200 - 1KB - /login [11:54:32] 200 - 1KB - /login/ Task Completed ```

Weak credentials like admin:admin do not work. But when examining the login portal for SQL injection vulnerability found that the portal is vulnerable to NOSQL injection attack. ### NoSQL Injection Attack

The 504 Gateway Timeout on `username='` is a strong indicator of **NoSQL Injection** against a MongoDB backend. The single quote caused a query parse error or infinite loop, confirming the app is vulnerable. The login likely constructs a MongoDB query like: `db.users.findOne({ username: INPUT, password: INPUT })` A malformed input (`'`) breaks the query and hangs the backend — classic NoSQL injection signal.

Using the Null Byte `%00` i was able to bypass the login page.

There is a search for users option on the admin panel.

if no match then it returns to : `W/"a01-ISB6B7RD1nACsgg42wliEwlfq2U”` searching for admin reveals there is a user export option.

i can use the download export option to view the file.

it leaks the username of admin and its password. Let me use true conditions to see if we can enumerate any other users as the application is already vulnerable to NoSQL injection.

```bash "username":"josh","password":"6ebcea65320589ca4f2f1ce039975995" ``` got josh username and password. crackstation cracked the password of the user josh. There is a mattermost vhost we have identified earlier, which i can enumerate further. ### mattermost.shoppy.htb

i can try login with josh creds and it works.

there are creds for jeager and i can try logging with the creds through ssh. ## Shell as Jaeger

Back on the Deploy machine channel there is a conversation about deploying a machine through docker also the development channel talks about a password manager which is on the machine.

There is a script called `shoppy_start.sh` It's just the startup script for the Shoppy Node.js web app. It's likely called on boot or by a service to keep the app running. ```bash jaeger@shoppy:~$ cat shoppy_start.sh #!/bin/bash export NVM_DIR="$HOME/.nvm" [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" cd /home/jaeger/ShoppyApp && npm start jaeger@shoppy:~$ ``` When enumerating the privileges of jaeger, he can run the following command as deploy.

There the `password-manager` josh was talking about. there is also creds.txt but cant access.

Accessing it says i need password for josh, but the already available pass of josh do not work. As the password manager is built using c++ which josh talks about i can see if the file leaks the master password by using Ghidra. What i can do it copy the file to my attack machine and use Ghidra to reverse engineer it to see i can get passwords. ### Reverse Engineering With Ghidra.

Found the master password. `Sample` Using the master password i can read the contents of password-manager. which on reading leaked the credentials of deploy.

## Shell as Deploy

deploy is part of docker group which means i can utlize this privilege and escalate to root. ### Exploiting Docker Group List all docker images ```bash $ docker images REPOSITORY TAG IMAGE ID CREATED SIZE alpine latest d7d3d98c851f 3 years ago 5.53MB $ ``` Alpine is available which i can use to escalate to root. ```bash $ docker run -v /:/mnt --rm -it alpine chroot /mnt sh # whoami root # ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-shoppy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.