HackTheBox Academy

Academy from HackTheBox was relatively an easy and straightforward machine, it starts with two open ports SSH on 22 and HTTP on 80 we find an app we abuse the registration system to gain admin access to it then we discover subdomain which is a development server full of information, from there we get a shell on the box, after that we find many users and some credentials around, we try to escalate till we get access to user mrb3n who can use sudo on composer that will give us root access. so let’s start!

Recon #

Nmap #

Nmap full TCP scann shows us 2 open ports.

Nmap targeted scan with default scripts and version enummiration against port 22,80, from apache version we can guess this is ubuntu Fossa.

Adding academy.htb (revealed in the nmap scan) to /etc/hosts

Looking at the source page revealed nothing so let’s check the links on the page.

Gobuster #

Fuzzing directories got few hits admin.php config.php

Alright let’s take a look at the application from a user point of view by creating an account

Hmm, something looks weird i registered with username rekkodo and it looged me with username egre55, time for burpsuite.

Burpsuite #

Looking at registration post request in burpsuite we notice roleid=0 which i can assume it decides if user will be regular or admin account so let’s change that to 1 and see what happens.

We try to login with the created account rek who has roleid=1 but from admin.php page.

We did logging to the backend and we see Academy Launch Planer, we do notice the mention of fixing issue in the subdomain dev-staging-01.academy.htb.

Let’s add dev-staging-01.academy.htb to /etc/hosts.

By navigating to the new discovered subdomain we see tons of information like technology used is laravel, APP_KEY, DB system is MYSQL as we did find username and password of databse called homestead

We took the information found and put them in CherryTree trying to stay organized.

After a little searching in google I found CVE we can use to gain intial foothold on the box.

Cloning the repo to our local machine.

After reading the python script we try it with APP_KEY found earlier to get RCE with command id we get a hit, RCE works!

User shell #

We set up nc listener on port 9000 and execute the python script with reverse shell to us and we get hit back.

As soon as we get a shell we see an interesting file .env and as we suspected it contains credentials.

By checking /home or /etc/passwd we can tell there are several users so we try ssh login with the found credentials against those users.

Looking around in the system we see juicy files in /var/log/audit, in audit.log we get more ceredentials, we use them to login as mrb3n.

Root shell #

We are logged in as mrb3n and we discovered after typing this command sudo -l that this user can use sudo on composer.

From our attacking machine we use our private key to login as root.