Sightless
Port scan
Adding sightless.htb in /etc/hosts
Subdomain/vHost
Found another subdomain under webpage (ctrl+u : ctrl+f .htb)
Web vuln (RCE - Template injection)
After a quick google search, I found:
Root?
User shell
We are in a docker container (ofc)
There's this .sqlite file in current directory sqlpad.sqlite which i tried in few ways to bring in my local machine I failed(if you know any way, please let me know on discord: heapbytes)
So just to see how many users are on system, i looked out in /etc/passwd file and found 3 users with shell (tty)
Since we are root, we can read /etc/shadow
And we found a hash, let's try cracking it with john/hashcat
Great, let's ssh into the box.
Root shell
Since we aren't in sudoers' list, we can try with other recon.
I ran linpeas and saw something unusual
There was this google chrome running in headless mode,
Then I looked for ports that are opened internally with netstat -tunlp
There were few ports opened, which I port forwarded.
Note: the admin.sightless.htb was running on port 8080 (domain found through linpeas results)
Since this was chrome headless mode, upon googling, you fill find this blog of Google
After scrolling a bit we can see a debug feature,
Adding all the ports, (e.g 127.0.0.1:34931) in Configure we can see Froxlor, click on inspect .
It will show us details of app running, I tried with cookie hijacking, but the admin cookie usually changes here after each login. If we click on Networks tab, we can see the password in clear text since this is a HTTP website.
Login as admin
There are many features available, the one we are interested is php-fpm
So we can create a new fpm version, so in php-fpm restart command, we can add our own custom command.
Once done, scroll and click save.
Later we can go in settings, and re-enable our php-fpm,
Disable the option.
Click on Save
Enable the option.
Click on save
This will start all the fpm versions, and our custom command will run this time.
Done. We are now root.
________heapbytes' still pwning.
Last updated