HackTheBox Writeup - Sightless

Summary: This post is a writeup of the Hack The Box Machine Sightless. Although the difficulty level of this machine is judged to be simple, the content covers a variety of different basic penetration testing techniques, including virtual host enumeration, CVE vulnerability exploitation, password cracking and SSH Tunnel, etc. Those who are familiar with penetration testing should be able to get the user flag easily. The difficulty lies in the final escalation to root, which requires a little bit of thinking out of the penetration test. All in all, Sightless is an informative machine, worth playing.

Reconnaissance

Port scanning

Use Nmap to scan the port information, port 21, port 22, and port 80 are opened.

nmap 10.10.11.32 -A -sC -sV

The virtual host for port 80 is sightless.htb, add it to /etc/host to browse the web normally.

Website Footprint

This site is hosted on PHP + nginx and runs on Ubuntu.

Use Feroxbuster for directory enumeration.

feroxbuster -u http://sightless.htb/ -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php" -v -k -n -e -r -o tcp_80_http_feroxbuster_dirbuster.txt

Subdomain Enumeration

Discover sqlpad.sightless.htb by enumerating virtual hosts with gobuster.

gobuster vhost -k --domain sightless.htb --apend-domain -u http://10.10.11.32 -w /usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt -o tcp80_vhost.txt

Add it to /etc/hosts.

Initial Access

I was googling sqlpad to see if there are any recent RCE vulnerabilities.

PoC code for CVE-2022-0944 was found.

I successfully created a reverse shell, but it is in the container.

Creating Persistence

I am creating persistence via Metasploit.

Elevate Privileges

Docker Escape

Upload the privilege script linpeas and run it.

Found out that there are three users logged into the container that by default get /bin/bash.

Where node is the service account and the hash in /etc/shadow is empty.

Password Crack

The other two users root and michael, use John the Ripper to crack their passwords.

unshadow passwd shadow > unshadow
john --wordlist=/usr/share/wordlists/rockyou.txt unshadow

SSH login to root fails with the cracked password.

However, SSH login to michael succeeded.

Intranet Discovering

Uploaded the authorization script linpeas via scp.

Execute the script.

linpeas lists the nginx profiles for us, where we find two virtual hosts, admin, and web1, besides sqlpad.

Nginx directs admin.sightless.htb to 127.0.0.1:8080, limiting external access. Use SSH tunnel to direct traffic out of port 8080.

ssh -L 8080:127.0.0.1 michael@sightless.htb

It is now accessible from Kali at 127.0.0.1:8080. After searching the web for RCE vulnerabilities in froxlor, the only recent ones are CVE-2023-0315, but successful exploitation requires a valid set of accounts. [Previous](#Password cracking) The root and michael accounts cracked from the sqlpad container cannot log into froxlor.

Exploit the Chrome Devtools Protocol

After that, I tried a lot of things, but I couldn't authorize or find the froxlor account. I went to the official forums to get advice from people who had already gotten root. As expected, the forums were full of woes, and a lot of people were as stuck as I was. I was lucky to find a ray of light amongst the wailing, and Gandalf's tip about getting the froxlor password and the Chrome Devtools Service was a real revelation from a master who has been alive for thousands of years, and who has broken the dreams of the people in his dreams.

I'm sure it's a great master who has lived for thousands of years.

Looking back, I ran linpeas again to look for traces of the Chrome Devtools Service. In the list of processes, I see that one user, John, has automated a pair of chrome-related processes using crontab, which appears to be using chromedrviver to automate a healthcheck on froxlor every 60 seconds.

Since I've written some automated dynamic crawlers through Selenium before, and the related technology can be used for robots to grab tickets and automated filling out final course opinion surveys, etc., I know that driving dynamic crawlers through chromedriver will open a port, but I haven't looked into it deeply. A port, but I haven't studied it in depth.

Let's see what ephemeral ports are open, most likely the Chrome Devtools Service. We can also export this traffic through an SSH tunnel.

Open chrome://inspect/#devices in your chrome browser and set the target for debugging.

Successfully intercepted a target to be debugged is accessing http://admin.sightless.htb:8080.

Click “inspect fallback” to enter the devtools window.

Click on “inspect fallback” to enter the devtools window.

You can see that the healthcheck program is constantly logging into froxlor with the administrator password.

You can see the admin password in the form data in the login packet.

Privilege Escalation to root

Browse the webpage and edit the settings for PHP-FPM.

See the restart command for editing. By default, php-fpm is restarted via the service command, which requires root privileges and can be edited.

This requires root privileges and is editable.

Change the restart command to copy root's SSH private key to the /tmp folder.

cp /root/.ssh/id_rsa /tmp

Turn Enable php-fpm off and on again.

At this point, we still can't read /tmp/id_rsa, so we need to change the file permissions in the same way and restart php-fpm again.

chmod 777 /tmp/id_rsa

Copy root's SSH private key to Kali via scp, and log in to root@sightless.htb via this private key, you can get the root shell.

cp id_rsa ~/.ssh
chmod 600 ~/.ssh/id_rsa
ssh root@sightless.htb