🚩 Environment — HTB Writeup
We will root Environment HTB machine step by step.
🔍 Enumeration
First we will scan with nmap the target IP
We can find SSH and normal HTTP open ports.
🌐 Web Exploration
Now let’s see the website
Okay now let’s use dirsearch tool to fuzz directories. As we can see we got some directories:
This is a normal login page, let’s explore the other directories:
As we can see here it tells us upload directory. It shows us error because we used GET and not POST, and it shows us code exposure to this part:
Let’s use this and try to make error so it can reveal something that could help us. Like this is a normal request:
So we tried to generate error page by leaving the remember parameter empty (not true or false) and we got the error page. Now let’s see what we got:
As we can see it tells that if we make a specific parameter=preprod we will login as admin without authentication:
🔎 Research
Now let’s Google this with the Laravel version we have:
As we can see we got something, let’s Google it:
And we can see the --env parameter:
Let’s try it:
✅ Boom — we logged in!
📤 File Upload RCE
We can see we can upload profile img:
So let’s try to upload this malicious file, and we did .php. to bypass and get uploaded:
✅ Boom it worked!
Now let’s set our listener and get reverse shell:
✅ BOOM — we got the shell!
📦 Looting Credentials
We want to try sudo -l but we do not have password. As we can see here we find a backup file that has encoded file.gpg:
And we can see hidden directory .gnup that contains keys to decode the file:
So let’s send them to our attack machine and decode it locally:
✅ Boom we got the password of hish:
🔐 SSH Access
Let’s login with SSH as hish:
Now let’s try sudo -l and we got /usr/bin/systeminfo. We can see Bash_ENV is used like path:
⚡ Privilege Escalation (Bash_ENV Abuse)
So let’s create our malicious file and change the Bash_ENV to our malicious file. Then try to exploit it and run with sudo to run as root:
And let’s see if it worked — ✅ BOOM it worked!
Now let’s do bash -p to drop into root shell and get your root flag hacker:
🏁 Rooted!
We have successfully rooted Environment HTB machine 🎉