Analytics - HackTheBox
Scan
{: width=“600”}
Nmap Command Parameters Explained
| Parameter | Description |
|---|---|
-p- | Scans all ports (1-65535). |
--open | Displays only open ports. |
-sS | Performs a SYN scan (half-open), faster and stealthier. |
--min-rate 5000 | Forces Nmap to send at least 5000 packets per second. |
-vvv | Increases verbosity level, showing more details in the output. |
-n | Skips DNS resolution for faster scanning. |
-Pn | Disables host discovery; assumes the host is up. |
IP | Target IP address to scan. |
-oG ports | Saves the output in Grepable format to a file named ports. |
We add the ip to the /etc/hosts file so we can see it on our machine
Now we will see if we find hidden directories through the gobuster tool, doing different tests, but it didn’t come to anything, so we decided to try a DNS search. I did a wfuzz on it and found data.
We see a subdirectory with the name data. We add it to etc/hosts -> data.analytical.htb
We enter the url and see that an interface with the name metabase does not appear
We proceeded to look for an exploit with metabase, with the wappalyzer I couldn’t even see what the version was in the source code, but searching the internet I found an exploit that turned out to work
a pre-auth exploit, the exploit details that we can get the setup token in this directory /api/session/properties
We filter by token and in fact it gives us the token so it is a very serious error, now with the token the exploit details that we have remote command execution so I will try to connect to the victim machine through a reverse shell
We listen on port 443 and we are done but we still cannot access the user’s flag
We are the metabase user and in the same directory we find a file called .dockerenv so we are going to look at its environment variables to see if we find information that is interesting to us
We see that it gives us a META_USER and META_PASS. Since in the nmap scan port 22 (ssh) is open, we will see if with those credentials we can connect via ssh
Ready we have access as the metalytics user and we see the user flag, now we must raise our privilege to be able to have the root flag. After trying different methods, both for capabilities, suid permissions, whether cron tasks are executed, etc. When we see the version of the machine we search the internet to see if we find an exploit in that version and we find one.
The exploit.sh file executed a line, what I did was first read it and interpret it and then modify it in the part where you passed the command to execute. So what I did was give suid permissions to /bin/bash to be able to connect as root through SUID permissions
The command I executed was the following:
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("chmod u+s /bin/bash")'