Paper

Paper machine from Hackthebox walkthough

Table Of Content

  • Information Gathering

  • Backend-server

  • Disclosed Secrets

  • Bot

  • Privilege Escalation

Information Gathering

Like always start with port scanning to figure out what is the services on target machine

nmap -sC -sV -A 10.10.11.143

We got 3 open ports ( 22, 80, 443 )

Try to visit http://10.10.11.143 i found HTTP Server Test Page running on Apache 2.4.37

So, the First thing that came to my mind was to enumerate any sensitive directories and files

  1. run dirb on http://10.10.11.143/

  2. open burpsuit and see anything interesting ( and it was indeed )

Backend-Server

The target website returns X-Backend-Server Include potential internal / hide IP Header of address or hostname. By exposing these values, An attacker may bypass the security agent and access the host directly

  • Add office.paper to /etc/hosts

10.10.11.143 office.paper

Disclosed Secrets

visit http://office.paper and notice that Wappalyzer was detected that it runs WordPress CMS version5.2.3

Search for exploit and found CVE-2019-17671：Wordpress Unauthorized access vulnerability recurrence

  • So we can use http://office.paper/?static=1

Found a secret registration page on http://chat.office.paper/register/8qozr226AhkCHZdyY

So now navigate on this website but remember to add it in /etc/hosts

Bot

Complete this registration form and login

After a little bit of time, a pop-up will appear with a chat general. Now we can see that this bot use his own command like this:

we can’t talk in this chat because is “read only” so, let’s communicate with the bot privately and try to use this command.

After that we can enumerate the user and we will find the correct password:

Now we can login in ssh!! with this password! and Get User Flag 🎉😄

$ ssh REDACTED@10.10.11.143

Privilege Escalation

Now, we need to scan machine and try to get root access. I use LinPEAS to do internal scan

Found that the machine is vulnerable to CVE-2021-3560-Polkit-Privilege-Esclation. It allows non privileged users to use DBus Call privileged methods.

CVE-2021-3560 POC: https://github.com/Almorabea/Polkit-exploit

  • Upload py Script and run

And .. Boom we are Root

Thanks for reading

PreviousIntro to Cybersecurity Bootcamp CTF AssessmentNextAstronaut

Last updated

Was this helpful?