[soulmate]

Putting initial nmap scan for cozyhosting

Nmap scan report for 10.129.105.163
Host is up (0.28s latency).
Not shown: 863 closed tcp ports (conn-refused), 135 filtered tcp ports (no-response)
PORT  STATE SERVICE VERSION
22/tcp open  ssh    OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|  256 4356bca7f2ec46ddc10f83304c2caaa8 (ECDSA)
|_  256 6f7a6c3fa68de27595d47b71ac4f7e42 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://cozyhosting.htb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

[itsnotme]

For those who need help.

Foothold: Finding the technology of the site is just looking for the main errors in the configuration.
User: On the single post try to force an error and see the error message.
Root: GTFOBins

[artifice]

For those who need help.

Foothold: Finding the technology of the site is just looking for the main errors in the configuration.
User: On the single post try to force an error and see the error message.
Root: GTFOBins

So I have access to the admin panel and a shell from the user 'app' But I can't figure out any path for lateral movement...
The shell I got sucks too tbvh

try a shell upgrade

[holyspirit]

any one tell me how to get user shell

You can begin by exploring the web and discovering a strange error: Whitelabel Error Page. By searching for this type of error, you will find that it is related to Spring Boot. This will lead you to discover additional endpoints that cannot be found through simple enumeration.

[c4berh4x]

I got a shell as "app", but cannot find a way to become josh. Can somebody give me a hint?

[th3strik3r]

I found the session token for kanderson user on the web app but when i try to get a shell using the admin feature on my ip it just says connection refused by my host although I am listening on port 22 from my end. Cant get beyond this tried everything.

[c4berh4x]

I got a shell as "app", but cannot find a way to become josh. Can somebody give me a hint?

What did you find after foothold? You need to breakout from the container. You need to find a file that once extracted you can find some credentials, that's how you lateral move to the user.

I found the db credentials and can connect - is that the right path? I dound some user credentials but no luck in cracking. RCE did not work on.

---

I found the session token for kanderson user on the web app but when i try to get a shell using the admin feature on my ip it just says connection refused by my host although I am listening on port 22 from my end. Cant get beyond this tried everything.

You need to point it to localhost and inject a command in the username field.

---

---

I got a shell as postgres now, let's see...

[damnberoo]

Some hints
Foothold
You're missing the right wordlist, now able to login?, there is a parameter vulnerable, burp and google is plenty enough.
User
Monitor what is running and there is a obvious file that can give you access.
Root
Piece of cake, use gtfobins

[ProcessX]

any one tell me how to get user shell

You can begin by exploring the web and discovering a strange error: Whitelabel Error Page. By searching for this type of error, you will find that it is related to Spring Boot. This will lead you to discover additional endpoints that cannot be found through simple enumeration.

Thank you very much, I'm ashamed of myself, I was stuck for an impossible time on something so stupid...

[c4berh4x]

You need to point it to localhost and inject a command in the username field.

hi 
why point to localhost?
and how do you know to point the localhost and add ";" after user to seperate it. what did you test ?

thankyou

Most likely it works with every valid hostname. You need to embedd your command in the username value. There are more options than ;
The right way is one of the described option here: https://portswigger.net/web-security/os-...rabilities (Ways of injecting OS commands)