GoodGames
Recon
nmap_scan.log
Open 10.129.73.122:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -sV -sC -Pn" on ip 10.129.73.122
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Werkzeug httpd 2.0.2 (Python 3.9.2)
|_http-server-header: Werkzeug/2.0.2 Python/3.9.2
|_http-title: GoodGames | Community and Store
|_http-favicon: Unknown favicon MD5: 61352127DC66484D3736CACCF50E7BEB
| http-methods:
|_ Supported Methods: GET OPTIONS HEAD POSTHTTP (80)
We can register, but on profile we only see our details and can change password.
There's only 1 blog post which is readable and the author is admin
SQLi is possible in login. Previously I was testing for SSTI that's why you see weird combinations of characters as username.
Creds:
admin:superadministrator
Admin has extra action which goes to administration tool.
http://internal-administration.goodgames.htb/login
We can login with same credentials, the only functionality available on this application is editing Settings. Since the application is running on Flask let's test SSTI, and it's a success.
Reverse Shell
There's only single host and it's probably main server, curl shows that it's website on main domain.
There's home directory, but this user doesn't exist this container.
User.txt
Privilege Escalation
SSH is not open from outside, but we can SSH from container
Get processes
Enumerate ports and applications
Nothing interesting.
The contains seems to be connected and on .2 we are root, but on .1 we are normal user. We can copy files to this directory and using linux permissions nature we can make SUID binaries from .2 and use them on .1
Let's do it in reverse
Root.txt
Last updated