HTB:Sau(Linux)

The port 55555 hosts a website which is running request-baskets version 1.2.1 . Now the usual approach would be to find any exploits for this particular finding. The initial research provides information about SSRF attack possible in this request-baskets version.

We have different POCs available as well, I found entr0pie github repository which helps in creation of a basket which we can access through our localhost on port 80.

After executing the script we simply try to access the newly created basket and we see a page which is not loading properly and is showing maltrail version 0.53 being used.

I found an exploit that is an RCE for Maltrail v0.53 by spookier. I didn't even change the code and simply ran it over on the request basket we had created and got shell as puma.

If we do a simple sudo -l we get to know that the puma user can run systemctl with sudo privileges:

Now when we simply run this with sudo command and once we do that we see the running status of maltrail:

Now this comes to a standstill and there is an input we can provide, if we input !sh we actually get the root shell.