HTB:Busqueda(Linux)

After the nmap scan we try to visit the website for the IP on port 80 but we need to make an entry in the /etc/hosts file first for searcher.htb. How do I know that? Well simply go to your browser and type the IP you would get an error and the IP address would simply change to https://searcher.htb so it redirected to the target website when we typed the IP.

Anyways, after editing the file /etc/hosts, we would be able to access the url.

The website shows the version information of searchor we are using.

Now a simple search for an exploit on searchor 2.4.0 gives us exploits related to arbitrary command injection and we have POCs available for the same. You will find exploits by m1kar0, nikn0laty, etc.

I found the m1kar0 POC simple and easy to use: https://github.com/m1kar0/POC-Searchor-2.4.2

So I got the listener running on my attacking machine at port 4444, then I run the command given in the POC with my IP and port and I get a shell instantly.

Now this being the user shell would give us the user.txt . To further elevate the privileges, we search for files in the directory:

Now this .git directory seemed interesting and further going inside it we see a config file which has credentials of cody user on a subdomain of searcher.

Now the obvious thing to do is go to the subdomain and search for any details available, so we first add the subdomain in /etc/hosts file like we earlier did with the domain. Then we go to the subdomain and login there.

We see nothing important but some commits made by cody and there is another user called administrator. Now since we get nothing out of here, we need to take a step back and see what else we can do. I tried to switch profile to cody user in the shell but that doesn't exist.

The password we found works for the svc user as well. So if we do sudo -l we find a script that we can run with sudo permissions.

When we run this script with an agrument we get 3 different options to choose:

When we run these three options we get different outputs:

Now we need to go with the second option and we need to explore it further. We have the container name from docker-ps command. After researching about docker-inspect format container_name , I found a few commands we could use to get some useful information.

Now these credentials actually work for administrator, but if we want we can login to mysql and query the user table to get hash for administrator.

I just used the credentials to login as administrator on gitea.searcher.htb and i found the system-checkup.py , in which i found one interesting thing that we use full-checkup.sh in the full-checkup option and earlier there was no such file found hence it did not run.

Now that we know a file is required we can create one to elevate our privileges.

We create a temporary copy of the standard terminal shell into a folder and then set the SUID giving read, write and execute permissions. Then we run the full-checkup and after it executes , we run our copy with elevated privileges and hence gain access as root.

Now we can simply get the root text file.