Soccer
Easy Linux HTB box Machine
Reconnaissance
As always we start off with a port scan using Nmap
We see that TCP Port 22 (SSH) | TCP Port 80 (HTTP) are open, we can also notice that this server is using Virtual Hosting to soccer.htb so we add it to our /etc/hosts file
We also check something interesting: The TCP Port 9091 (?) is open which is curious, it gives us a hint for later on exploitation.
Let's start off by enumerating the Web Server using WhatWeb where we will try to enumerate the services and potential attack vectors for later:
We proceed to manually check the webpage with our browser
As we don't seem to find anything useful here, let's perform a directory brute-forcing using GoBuster
We found a interesting soccer.htb/tiny directory so let's check that out!
We try with the default H3K Tiny File Manager credentials: admin:admin@123 and success! we logon onto the admin dashboard panel
And we also find that the /var/www/html/tiny/uploads directory is writeable and we we can upload files there! so we upload a Reverse Shell on our shell.php file
Exploitation
We set up our listener with netcat... And we got our reverse shell as www-data done!
After further enumeration we don't seem to find any PrivEsc vectors, but we find a interesting file
As we see, there's another site enabled for this web server below the name of soc-player.soccer.htb so we add into our /etc/hosts file as we did earlier and proceed to check whats in there
Seems familiar right? It's almost the same as the soccer.htb dashboard but with some noticeable differences: the Match, Tickets and Logout panels, after enumerating everything and signing up, we realize the server gives us a ticket on the Tickets section
Let's check how this works with BurpSuite
We can see that when we put the correct code it sends "Ticket Exists" to soc-player.soccer.htb:9091
However if we try to perform a basic SQLi using the payload:
Let's try to perform a SQLi attack with SQLMap
We see that we can enumerate some databases, but we're interested on the soccer_db one so let's try and check what's inside
And we found the password for the username player !! Let's try and login using SSH
Privilege Escalation
As we successfully logon with the user player, let's try and find a way to escalate our privileges to root
We found a weird binary with SUID 0: /usr/local/bin/doas so let's check it using man doas
We can see it points to the /usr/local/etc/doas.conf as the configuration file so let's check that also
As we can see this file also points out to another file, in this case /usr/bin/dstat lo let's do man dstat
FILES Paths that may contain external dstat_*.py plugins:
We can see we can create our own plugins in order to escalate our privileges, so let's write a malicious Python plugin on /usr/local/share/dstat
Hope you liked this write-up and see you next time!
Last updated