HTB:Help(Linux)
Started this box with an nmap scan and found three open ports:
Port 80 holds a default apache page, port 3000 holds a page showing json results showing there might be a user Shiv and the page is powered by Express.
So for this we need to query and get the credentials but we can’t possibly query this endpoint. I searched query language for Express js and got graphql. Now i did some directory busting but got nothing then a simple graphql endpoint was found randomly through google searches. When i try to go to this endpoint I get a result saying “GET query missing”.
Get Eagle Hacks’s stories in your inbox
Join Medium for free to get updates from this writer.
Now since my target is credentials, I will try to query for user. When i did I get a result saying a subfields are required, I tried a couple (if you try a simple{user{user}} it tells you did you mean username) and username worked and provided a useful username:
I used the same query to get the password for the user and we have the hash which we can crack using any tool like hashcat.
Now that we have the credentials, we need to see where we can use them. I took a step back to explore subdirectories for the port 80 and found a support sub directory where we can login using these credentials. This directory in itself doesn’t reveal the helpdeskz version or any other information. So i did some google search on how to find the version of helpdeskz and found we can see the README.md, or staff or UPGRADING.txt. I was able to use UPGRADING.txt to find the version of heslpdeskz used to be 1.0.2.
Since we have the version information of helpdeskz we can search for the exploits possible on this version and there are two exploits available.
We will use the first one where a file upload on the heslpdeskz using submit ticket can help in gaining a shell access.First of all, we can get the php reverse shell from pentest monkey. Next we will create a ticket, we don’t even need to login to the portal and we will upload our reverse shell script and we will get an error that File is not allowed.
Now researching in the github repo for this we find that this doesn’t mean anything and the file is uploaded.Now the exploit we have available on searchsploit needs some changes cause simply using didn’t help at all cause there is a sync issue present in the time so we need to ensure our box and server are either in sync or I have ensured that we pick up the server time instead.
The ones in red are the ones i have changed.Now we need to ensure our netcat is listening on the port we specified in the php script and then we simply run this python script:
We got the shell as help user:
Next we simply see that this is an old kernel version and an exploit is available on searchsploit 44298.c which we download on our machine then we need to host that using python:
We can get it using the wget command, and then we use gcc to compile it and after running it we get root:
