HTB - Heal
Enumeration
Nmap Scan
┌─[kali@parrot]─[~/HackTheBox/platform/machines/Heal]
└──╼ $nmap -F -Pn $ip -oN Nmap/fast-scan
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
┌─[kali@parrot]─[~/HackTheBox/platform/machines/Heal]
└──╼ $nmap -p22,80 -sCV $ip -oN Nmap/script-scan
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 68:af:80:86:6e:61:7e:bf:0b:ea:10:52:d7:7a:94:3d (ECDSA)
|_ 256 52:f4:8d:f1:c7:85:b6:6f:c6:5f:b2:db:a6:17:68:ae (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://heal.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)Summary
hosts file
HTTP
http://heal.htb looks like this:
First, I will collect all subdomains from active enumeration (fuzzing)
Next, I fuzz for files and directories under, but don't get anything, So I switch to crawling the app for URLs and endpoints
So, from these endpoints I can see heal.htb that it uses the API at api.heal.htb to do several functions (sign-up, exports, sign-in, resume)
From whatweb, I can know ruby on rails technology being used in api.heal.htb
Now, I will interact with the app to see its functionalities
Create an email to sign in with
After clicking on sign-up, I get to this
At the bottom of the page, there is an export pdf function
Intercepting the request with burp, I see it renders input field and returns the file name of pdf
Then it requests to download the file to a different endpoint
So, I thought about trying to download a local file such as /etc/passwd , and succeeds :))
These are the users having /bin/bash shell
Since, ruby is used in api.heal.htb, it's worth nothing to try to include config.ru as it's commonly used by ruby on rails
It gives us good path to start with: config/ and from this post, we can know the credentials file being used by ruby
In config/database.yml, I get the location of sqlite3 database, since it uses ruby
Looking at it, there are some secrets
Cracking with hashcat
Foothold
Under survey, there is a button that redirects to a new subdomain take-survery
I added this to my file and continued. Going to http://take-survey.heal.htb, I see this page with info that ralph@heal.htb is the administrator
There is an admin panel under /admin that needs credentials, So I will leave it now.
Going to Survey admin panel, I used the credentials to login as ralph from the email we saw before.
After login, I note the app version below 6.6.4
When I searched for this version, I found RCE POC
Download the exploit, modify the reverse shell with my IP and port, and modify and config.yml by adding compatibility version 6 as it's not there by default.
I did exploitation steps manually instead of running exploit.py
Upload the zip file and click install
Activate the module.
Receive a shell as www-data after navigating to http://take-survey.heal.htb/upload/plugins/Y1LD1R1M/php-rev.php
Lateral Movement
On running linpeas.sh, I got interesting credentials from the config file. It's a credential for PostgreSQL instance.
I tried the password for two users, It only worked for ron
User Flag: 6532d7ea0abd75ce47e3exxxxxxxxxxx
Privilege Escalation
From the open ports inside the box, I will map them to my host to be able to attack it using port forwarding over SSH
http://localhost:8500/ui/server1/services
The version in the left corner is Consul v1.19.2. Looking for public exploit to this version, I found this https://www.exploit-db.com/exploits/51117
From this POC, I construct my command to do it manually and receive a shell
Root Flag: 70fa8cc16d180a0981f8xxxxxxxxxx
Last updated