Trickster
Port scan
╰─➤ ../fnn 10.129.224.161
Running initial fast Nmap scan on 10.129.224.161...
Open ports: 22,80
Running detailed Nmap scan on ports: 22,80...
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 09:28 IST
Nmap scan report for 10.129.224.161 (10.129.224.161)
Host is up (0.18s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 8c:01:0e:7b:b4:da:b7:2f:bb:2f:d3:a3:8c:a6:6d:87 (ECDSA)
|_ 256 90:c6:f3:d8:3f:96:99:94:69:fe:d3:72:cb:fe:6c:c5 (ED25519)
80/tcp open http Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://trickster.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: Host: _; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.38 seconds
Scan complete. Results saved in 10.129.224.161.ports.scanSubdomain
Upon looking the website, we find shop.trickster.htb
Directory bruteforce
We will use git-dumper to download all files inside the .git folder
Web exploitation
Enumeration
If we read INSTALL.txt we can see it's using PrestaShop 8
After we visit /admin634ewutrx1jgitlooaj, We can see version: 8.1.5
XSS->RCE
Upon googling Petrashop ecommerce RCE with the version we get
https://github.com/aelmokhtar/CVE-2024-34716
We can further exploit this.
Edits
So there are few things we need to edit inside expoit.htmland exploit.py
HTML edits:
Exploit.py Edits:
Zip file:
unzip the given ps_next_8_theme_malicious.zip file, edit a.php and add your IP to it.
Make a zip after the edit, we'll use this zip to get a reverse shell.
www-data shell
Start python server.
And run exploit.py
User shell (james)
Just for sake of ease, i added reverse_shell into http://trickster.htb/asset so I can pull up more shells if needed. (with little tweak on $port=$_GET['port'];)
Great, it's working.
Running linpeas, found us db creds
We can use mysql cli with -e to run cmds, we will use -e since we dont have a proper tty shell.
And we can crack the password with john or hashcat
DONEEEE!!!
Root
linpeas, netstat, sudo -l, find, and other few techniques I tried didn't worked.
If we see all all interfaces on the system with ip addr we can find docker on 172.17.0.0/16 subnet, although there were no ports seen on netstat that might use docker, we can do pivoting, create a tunnel using ligolo and scan internal network.
However, installing and running ligolo is not in the scope of this writeup, you can refer to the following blog,
OR
We can use static binaries from, https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/
easy and fast way is to ping sweep
We can see 2 hosts alive, we can start nmap on these 2 hosts to see open ports.
Alr, we can port forward 172.17.0.2:5000
The webpage is using, Changedetection 0.45.2 after a google search, we find this exploit.
Th exploit didn't work, let's try manually.
Login form password is the same we used for james (alwaysandforever)
Since it's using jinja, we can jump to,
Payload used:
Click on send notifications and get the shell
Shell
in the history you can see the root password,
DONE!!
__________heapbytes' still pwning
Last updated