search

Sightless

hashtag
Port scan

Adding sightless.htb in /etc/hosts

hashtag
Subdomain/vHost

Found another subdomain under webpage (ctrl+u : ctrl+f .htb)

http://sqlpad.sightless.htb/sqlpad.sightless.htbchevron-right

hashtag
Web vuln (RCE - Template injection)

After a quick google search, I found:

Logohuntr - The world’s first bug bounty platform for AI/MLhuntr.comchevron-right
After entering the payload, click on Test

Root?

hashtag
User shell

We are in a docker container (ofc)

There's this .sqlite file in current directory sqlpad.sqlite which i tried in few ways to bring in my local machine I failed(if you know any way, please let me know on discord: heapbytes)

So just to see how many users are on system, i looked out in /etc/passwd file and found 3 users with shell (tty)

Since we are root, we can read /etc/shadow

And we found a hash, let's try cracking it with john/hashcat

Great, let's ssh into the box.

hashtag
Root shell

Since we aren't in sudoers' list, we can try with other recon.

I ran linpeas and saw something unusual

There was this google chrome running in headless mode,

Then I looked for ports that are opened internally with netstat -tunlp

There were few ports opened, which I port forwarded. Note: the admin.sightless.htb was running on port 8080 (domain found through linpeas results)

Since this was chrome headless mode, upon googling, you fill find this blog of Google After scrolling a bit we can see a debug feature,

LogoChrome Headless mode  |  Chromium  |  Chrome for DevelopersChrome for Developerschevron-right

Adding all the ports, (e.g 127.0.0.1:34931) in Configure we can see Froxlor, click on inspect .

It will show us details of app running, I tried with cookie hijacking, but the admin cookie usually changes here after each login. If we click on Networks tab, we can see the password in clear text since this is a HTTP website.

Login as admin

There are many features available, the one we are interested is php-fpm

So we can create a new fpm version, so in php-fpm restart command, we can add our own custom command.

Once done, scroll and click save.

Later we can go in settings, and re-enable our php-fpm,

  1. Disable the option.

  2. Click on Save

  3. Enable the option.

  4. Click on save

This will start all the fpm versions, and our custom command will run this time.

Done. We are now root.

________heapbytes' still pwning.

PreviousBoardlightNextHeadless

Last updated