Heal
Port scan
Subdomain scan
/etc/hosts
Add heal.htband api.heal.htbin /etc/hosts file
Web attack - (API: LFI)
After signing up on the platform, we are redirected to /resume, here we can add our data and click on export
You can open Dev toolsand see the api call made in the backend.
It's vulnerable to LFI.
You can copy the command as cURL command from dev tools network tab.
I've played around this a bit, but nothing important files comes with this right now, I moved to another vector.
If we clicked on survey, it's takes us on another sub-domain. take-survey.heal.htb
If we looked into web source of this subdomain, we can clearly see it's using limesurvey for feedback collections.
Upon googl'ing we can find a RCE vulnerability, (version? yes, i've edited writuep a bit, i'll explain later how I found the version)
It requires username and password to work, let's move further.
If we looked into api.heal.htb it index file tells it's a ruby application.
Rails version: 7.1.4
I am new to ruby rails, so google'd the structure of ruby on rails and config file path and found this beatiful blog.
Going through all files, I found config/database.yml to be more intresting,
We have database files at storage directory.
Alright, we have 1 admin user to target, prolly that's gonna get us user shell.
Hash crack
I'll use hashcat to bruteforce the plaintext for this hash. You can visit (https://hashcat.net/wiki/doku.php?id=example_hashes) for exact hash id btw.
www-data shell
We can login as admin (ralph) on take-survey.heal.htb , we can see the limesurvey version here on footer of the webpage.
The exploit we found earlier on google can be used here. Running that pops up a shell for us :)
First thing we should look is config files, that contains password. I came across these files,
Reading the application/config/config.php, it reveals db_user password. Lets connect locally.
And that worked!!
I tried cracking this and it toooook a loonnnnnggg time. I moved on seeing how many users exsit on the system, found ron and ralph. Tried the database password with both the users and it worked for ron! (didn't liked this tbh, guessy as hell)
Root shell
once we login as ron,
we can see the current process with ps -ef --forest and notice that it's running consul (by hashicorp) on port 8500.
Quick googling can get us to following exploit :
Exploit
The acl token is a required argument (as per the script) but is not imp as we dont really use that to register. It's only used in Header.
_________________heabytes' still pwning
Last updated