text: What's going on YouTube? This is IPSC and today we'll be doing down on Hack the Box. This box did come from Vaughn LLabs. If you didn't hear, Hack the Box acquired Von Labs a couple months ago and we'll be releasing the content on HTB throughout the rest of the year.

title: HackTheBox - Down


text: This box is pretty simple. It starts off with a is it down type of site which if you put your IP address in, you can see it uses curl to check if a page is there. We can inject arguments but are unable to drop a shell because we don't have right permissions to the web route.

title: HackTheBox - Down


text: it does allow us to perform local file disclosure because when it does that curl request it outputs the content of that page. So we can um leak the source of index.php which reveals a hidden argument that will switch it from curl to netcat and through argument injection we can get a shell. Looking at the box with the shell we discover there is a Python password manager called PSWM. We can write a quick brute forcer decrypt the data and get a root credential. So with that being said let's just jump in.

title: HackTheBox - Down


text: As always, we're going to start off with an end map. So, - sc for default scripts. SV enumerate versions vv for double verbose. This gives us things like the ttl oa upput all formats print the end mapap directory and call it down. And then the IP address. And uh this is a von lab box. So there are no static IP addresses. So that's why we have this 10129 2343 IP address. The platform gives you this when you spawn the box. Your IP will be different than mine, but end mapap can take some time to run. So I've already ran it. Looking at the results, we have just two ports open. The first one is going to be SSH on port 22 and the banner tells us it's an Ubuntu server. We also have HTTP on port 80. Its banner tells us it's Apache running on Ubuntu. And then looking down, we can see the title of the page

title: HackTheBox - Down


text: is is it down or just me? So, let's just go ahead and take a look at the page.

title: HackTheBox - Down


text: And we get just a simple page. We could enter a URL here, but the first thing I like doing is taking a look at the page source just to see if I can identify like how the page is built. Um, the thing that sticks out to me is we have index.php. So, this is telling me it's a PHP website. The other things I would do is like make 404 error pages because Django, uh, Laravel, all those like frameworks have very distinct error messages on 404s. So, you can normally, um, pin it down that way as well. But, we know this is a PHP website. We could start gob buster up in the background trying to find other PHP scripts on the server, but let's just go ahead and um enter this request, right? I'm going to enter my IP address, which I think maybe my IP has changed. Let's do if config 10 uh 84. Wow, it has changed greatly. So,

title: HackTheBox - Down


text: we'll do 1010484 and I'm going to listen on port 8000.

title: HackTheBox - Down


text: And then we can click is it down and we see how the page is making a request to us. Um, the user agent is curl. So, I know the page is probably doing a system command to like run things, right? So, let's go ahead and send this over to Burpswuite and play with command injection. So, I'm going to go over here. Burp.

title: HackTheBox - Down


text: Uh, that not send it. Click on that.

title: HackTheBox - Down


text: There we go. HTTP. Am I intercepting? I am.

title: HackTheBox - Down


text: Send.

title: HackTheBox - Down


text: Okay. So, I'm going to put this in the repeater.

title: HackTheBox - Down


text: And if we just send this, let's see. We sent the page.

title: HackTheBox - Down


text: And what size do we get back? Um, 1064.

title: HackTheBox - Down


text: So, I always like looking at the size we get back. Um, now let's do a semicolon sleep one. And then I'm going to URL encode that semicolon.

title: HackTheBox - Down


text: And it's taking way longer than a second.

title: HackTheBox - Down


text: Um, did the page just like completely crash? I wonder if this is doing some type of DNS resolution now or something.

title: HackTheBox - Down


text: And it's taking a while. Uh, let's see.

title: HackTheBox - Down


text: While this goes, let me ping this IP address. We have a ping going. Um, open a new pane. Get rid of this.

title: HackTheBox - Down


text: I'm going to do a Python 3-m h before I do that, I'm going to make dur. And what I'm doing here is um I just want to make a request, have it come back to us, verify the server is up. We see it there. So now I'm going to try my sleep again. So when I put that semicolon there, this is when the server stopped responding to me. It still isn't responding. We don't get anything. So, I don't know exactly what is happening here. This is very odd behavior, right?

title: HackTheBox - Down


text: Um, let's see. I'm going to do a plus then sleep. And I'm just putting a space after that semicolon.

title: HackTheBox - Down


text: And that seems to come back, but we're still not getting any results. So, this semicolon is breaking things in a weird weird way. Um, let's see. We can do slash and then I'm going to do like ID like this. And I'm trying for like command injection here. So if we send this, we see we just get ID. So that's not command injection. I was hoping we get the output of that command. We could try something like this. And again, the reason why I'm trying this is because um we know the server is using curl. So it's using a system command. So that doesn't work. Um let's see. Can we even manipulate the arguments? So, what I'm going to do here is we're doing a netcat again on port 8000.

title: HackTheBox - Down


text: And then I'm going to say, uh, let's see. It's doing curl and then the URL here. So, I bet if I do like a -x, uh, let's change this to a post request and we can do pluses for spaces.

title: HackTheBox - Down


text: We don't get anything.

title: HackTheBox - Down


text: We get an error message here that says only protocols HTTP or HTTPS is allowed.

title: HackTheBox - Down


text: So I'm going to move this to the end of my string. So we'll do URL plus and then change it to a post request this way.

title: HackTheBox - Down


text: And let's see that still does not look like it wanted to work. Um is it a - X or a dash capital X? Uh curl. I'll try capital X first. 127001 uh 8000.

title: HackTheBox - Down


text: Uh maybe it's a capital X. It always is handy to test things. Maybe lowerase X is proxy. Yeah. So let's go back and change this to uppercase X. Send the post. And we see we can inject arguments into kernel. So I'm going to go over to GTFO bins. I'm going to turn my burp suite off so I'm not proxying this one. And then we're going to type curl and see what we can do. We have file upload, file download, file write, read, pseudo, and suid. So curl doesn't look like it has a way to um allow us to execute commands, but it is giving us a way to download files.

title: HackTheBox - Down


text: And that will be um the dash O probably.

title: HackTheBox - Down


text: Yeah, it's doing a dash O here. So, let's go ahead and try to write something. So, I'm going to do a - o.

title: HackTheBox - Down


text: And then I'm going to guess this is in ver dubdubdub html. I'll call it shell.php.

title: HackTheBox - Down


text: And let's go ahead and put something on our server. So, v, we'll do index.php.

title: HackTheBox - Down


text: I'll probably call it index uh shell.php. Um, we'll do system request cmd.

title: HackTheBox - Down


text: like this. Just write a quick PHP shell.

title: HackTheBox - Down


text: I'll move index to shell.php.

title: HackTheBox - Down


text: Start up our web server again.

title: HackTheBox - Down


text: And let's see. We're doing that curl.

title: HackTheBox - Down


text: We'll call it shell.php o. I don't know why that disappeared.

title: HackTheBox - Down


text: Um, var dubdubdubdub htmlshell.php.

title: HackTheBox - Down


text: Save it.

title: HackTheBox - Down


text: We have a successful download. So now let's go ahead and see if we can hit it.

title: HackTheBox - Down


text: So I'm going to go over here. I'm going try shell.php. And we get a44 not found.

title: HackTheBox - Down


text: So the user that is running this curl command probably doesn't have permissions to write into the HTML directory. Right. Um what I would normally do here is look at where images are hosted. Um let's see. There is an image here, right? image a new tab logo.png. I was hoping it's in like a images directory because normally you'd have write access there. We could also run go buster, but I don't think we have right access anywhere on this server.

title: HackTheBox - Down


text: So, it doesn't really help us, right?

title: HackTheBox - Down


text: But if I could write into slashim images, then I could drop my shell into images.php and then execute it that way. Um, so we're kind of at the drawing board. Um there is another interesting thing that curl does is if we do curl let's do um ipsseack and then google.com it's going to just attempt to curl this and then move to the next one right and what that's going to enable me to do is we can do like http slash and then put a space then um anything else we want like curl can grab files right so that's what I'm going to try so we have this http then that's colon slash and then I'm going to erase this and I'll just put a plus which is going to be a space and then we're going to see if we can do Etsy pass WD and if we have any type of file disclosure right so if we do this and we get past WD

title: HackTheBox - Down


text: again the reason why I'm doing that is if we just did the file we're going to get an error message because it requires HTTP or HTTPS so what I'm doing here is making sure the string begins with http slash then putting a space and then the URL I want. Um the PHP code on the back end is just making sure this argument begins with http. It's not checking if the URL uh begins with http if that makes sense. So we can get files out of here. So let's go ahead and look at index.php.

title: HackTheBox - Down


text: So I'm going to do a proc self cwd to go in the current working directory.

title: HackTheBox - Down


text: index.php. You could probably just do like file slash um we can try that real quick. This is normally what I do to get to the web directories um route, but I bet if we just did file slashindex.php, maybe we need three. Is it going to be here? Um no. I guess you'd have to guess it. Or you could do like ver dubdubdub html.

title: HackTheBox - Down


text: Right.

title: HackTheBox - Down


text: So we're here. I guess that's what we could do. Um, we want to make sure uh when we wrote the shell, we wrote to ver dubdubdubhtl, but maybe the page is under ver dubdubdubh or something like that. So, right here, I'm just seeing where index.php is, and we get the contents of it, so I know it's in verdubdubh.

title: HackTheBox - Down


text: So, I'm pretty certain the reason why our file download didn't work is because we didn't have permission. But, I'm not positive yet. Right now I'm just going to um decode the page and then we can say v page.html paste this in because we put index.php in that output. So what I'm doing here is um viewing it. So we can do Firefox page html. And the reason why I did that burpuite decode is if we looked at what it had given us um it's in my burpuite repeater. It was all um like HTML entity encoded or whatever this is. So that's why using burpswuite decoder to get into a format that I can read better. Right?

title: HackTheBox - Down


text: So this is going to be where the PHP script is. We have if is set expert mode and expert mode is TCP.

title: HackTheBox - Down


text: Then it's going to uh do escape shell command netcat. So we have a hidden mode if we have expert mode in our parameters. Let's see this is URL. We're going to trim the URL.

title: HackTheBox - Down


text: We're doing a match. So we're making sure it begins with http or https slash and then we're doing a escape shell command curl url. So um we had this begin with http Let's do it. I'll do it here so it's bigger. So it began with that. Then we did a space and then did file slash. So that's why it bypassed this because a string still began with HTTP. So let's see.

title: HackTheBox - Down


text: We want to get over to probably this netcat, right? So let's go expert mode equals TCP.

title: HackTheBox - Down


text: So we can say um question mark expert mode equal TCP.

title: HackTheBox - Down


text: And wants an IP address and a port number. So if we do 10 1048 port 8000, we can do nvmp 8,000 after we stop a web server run this.

title: HackTheBox - Down


text: Uh my IP is actually something weird, right? It was like 84.

title: HackTheBox - Down


text: 84. There we go. Is it refused?

title: HackTheBox - Down


text: I'm not sure that's working. That is odd.

title: HackTheBox - Down


text: It is probably on Intercept.

title: HackTheBox - Down


text: Let's see.

title: HackTheBox - Down


text: That's still the URL.

title: HackTheBox - Down


text: Something weird is going on. Disable.

title: HackTheBox - Down


text: New tab.

title: HackTheBox - Down


text: 10 10 1484 8000. Is it refused?

title: HackTheBox - Down


text: There we go. It did a curl.

title: HackTheBox - Down


text: 10 10 14 84 8,000.

title: HackTheBox - Down


text: Now it's doing a netcat. I think things are just going like slow, but that's definitely a netcat connection because it's not giving us the user agent and other things. So, um, yeah, I think something's just going slow. There we go. It's telling us it is open. So, let's go ahead and intercept this.

title: HackTheBox - Down


text: Do intercept on 10 10 1484 8000.

title: HackTheBox - Down


text: Send this.

title: HackTheBox - Down


text: Send it over to repeater. And then I'm gonna do a space dash e bin bin bash.

title: HackTheBox - Down


text: And then let's see. Stand up the shell.

title: HackTheBox - Down


text: Run it.

title: HackTheBox - Down


text: This is really taking longer than I'd expect.

title: HackTheBox - Down


text: There we go. We got the shell. Um, let's do a Python 3- Z C import pty pty spawn bin bash. Let's get a proper TTY sty raw minus echo foreground enter.

title: HackTheBox - Down


text: And then we can export term is equal to xterm which is going to let us clear the screen. So now that we have a shell, let's just do a ls. And we can see we're invar html root owns all these files.

title: HackTheBox - Down


text: And the only one we could potentially overwrite is this user then some random stuff.txt which is the user flag of this box. So um this is why dropping the shell did not work. Uh we just did not have permission to write into this directory, right? Read execute on group root um and read execute on everyone.

title: HackTheBox - Down


text: And it's the same thing for all the files. So that is why we couldn't use curl to just drop a file. Um, but now we have to figure out a way to get root.

title: HackTheBox - Down


text: Normally I look at like databases when I pop a web server and see if there's any credentials there, but this doesn't have a database. So let's see. I'm going to do find-f.

title: HackTheBox - Down


text: No real interesting files here. We'll do it in home. And let's see. There is this directory. I don't know what Pswm is.

title: HackTheBox - Down


text: Let's go here.

title: HackTheBox - Down


text: Uh, cat PSWM.

title: HackTheBox - Down


text: We get a few B 64 strings. It looks like maybe they're delimited by a um star, right? We see B 64, then star, B 64 star. So, we can do echo-N B 64-d.

title: HackTheBox - Down


text: Uh, let's pipe it to XXD.

title: HackTheBox - Down


text: and it just looks like um random data which is probably going to be encrypted text. So let's Google PSWM.

title: HackTheBox - Down


text: So let's turn my burp suite back off.

title: HackTheBox - Down


text: PSWM.

title: HackTheBox - Down


text: Uh let's go over to Google. My internet is going slow.

title: HackTheBox - Down


text: Uh let's see. PSWM a simple command line passenger manager.

title: HackTheBox - Down


text: Let's see if this is it.

title: HackTheBox - Down


text: Okay, this may be it. Uh let's see if we go over to this I'm guessing is the code.

title: HackTheBox - Down


text: So it's going to be Python.

title: HackTheBox - Down


text: And let's see where's main.

title: HackTheBox - Down


text: So we do manage master password. Then we do pass vault is lines to pass.

title: HackTheBox - Down


text: What is this function doing?

title: HackTheBox - Down


text: Nothing too interesting.

title: HackTheBox - Down


text: Let's go back to Oh, there's a encrypted file to lines.

title: HackTheBox - Down


text: This function opens and decrypts the password vault. Takes the file name and the master password. So, this is probably what we want.

title: HackTheBox - Down


text: I'm going to copy this.

title: HackTheBox - Down


text: And we'll probably have to do this on our local box. So, I'm going to be crack.py.

title: HackTheBox - Down


text: We'll put that in. save it. Um, I'm going to cat PSWM and I'm going to put a echo after it just so it's easier to copy.

title: HackTheBox - Down


text: Go here. BSWM.

title: HackTheBox - Down


text: I did QM. There we go. Paste this.

title: HackTheBox - Down


text: Okay.

title: HackTheBox - Down


text: And now we have to crack this. So, it's using the crypto code library. Okay. So, Python 3-m VM. Let's create a virtual environment.

title: HackTheBox - Down


text: We can do source VM bin activate pip 3 install.

title: HackTheBox - Down


text: Was it crypto?

title: HackTheBox - Down


text: What is it using? Crypto code. Is this just a library? There we go. We have installed it. So, let's see. Um, check.py. We have that. Let's import crypto code.

title: HackTheBox - Down


text: Okay, let's see. It's also using OS.

title: HackTheBox - Down


text: And then I'm going to import CIS. So, I have arg.

title: HackTheBox - Down


text: So, we have this function.

title: HackTheBox - Down


text: And it looks like it will return false if we can't decrypt and that returns the decrypted content if we can. So, let's do um a loop. So, I'm gonna do with open and then we'll just do cis argv one. And this is going to be our word list, right? I'm probably going to put this to like rocku. We can do as word list. And then we can say for oh, I'll call it pw for password and word list. Let's try decrypting it. So we'll do decrypted is equal to um was it encrypted something encrypted file unders like this uh file to lines I want to say yes file name and master password. So the file name was PSWM and the password is going to be just what entry we are on the word list. Then we can say if decrypted decrypted there we go we want to print the PW and then we will also print decrypted and then we can just exit. So I'll do

title: HackTheBox - Down


text: cis.exit. exit as well.

title: HackTheBox - Down


text: That should be fine.

title: HackTheBox - Down


text: We can do Python 3 crack. And then I'm going to give it rocku. So user share word list rocku.ext.

title: HackTheBox - Down


text: And let's see does this go.

title: HackTheBox - Down


text: See, hold on. I'm going to control C this or try to um let's see. PSF What I want to make sure um is we're looping in a safe way. Uh because word list this file is huge. So we can do du-hs like this. It's 134 megs. So, what I'm worried about real quick is um this open like it trying to read the whole thing, assign everything like every line into a giant array before even doing the loop. So, that's why I just want to check here. We can do print and then testing plus pw like this.

title: HackTheBox - Down


text: Does this go ahead and crack right away?

title: HackTheBox - Down


text: Looks like it does.

title: HackTheBox - Down


text: See, let's stop this again.

title: HackTheBox - Down


text: EF grab track. Kill 2469228.

title: HackTheBox - Down


HackTheBox - Down


text: Let's just copy and paste this.

title: HackTheBox - Down


text: Okay. So, I think everything's fine. I'm just going to edit this and then we will delete that.

title: HackTheBox - Down


text: I'm trying to think, should I like strip it? I probably should.

title: HackTheBox - Down


text: So, what I'm worried about is when I'm looping this, the loop actually containing the line break after the word. And if it does that, then it'll never decrypt because we have a special character at the end of everything we're doing. So, that's why I'm just adding the strip here just to be safe.

title: HackTheBox - Down


text: And now, let's go ahead and run this.

title: HackTheBox - Down


text: And I'm going to Oh, it looks like it already cracked. I was about to say I'm going to pause the video, but we have flower. So that's going to be the decrypted key. Then we have PSWM talex flower Alex at down. So this is probably the host.

title: HackTheBox - Down


text: So tab is going to be like tab delineated, right? So I can probably just do a uh print f on this. Let's just copy this.

title: HackTheBox - Down


text: Print f.

title: HackTheBox - Down


text: I don't think I need a spa. Uh that right. There we go. So we have Alex at down Alex and then this which is probably going to be the password. So let's go. We can just try SSH. So sh a l e ks at 10129.

title: HackTheBox - Down


text: Uh let's see. 234143.

title: HackTheBox - Down


text: Yes. Paste.

title: HackTheBox - Down


text: And we're in.

title: HackTheBox - Down


text: So let's see. It says pseudo as admin successful. If we do pseudo-l, put this in, uh, Alex can run anything. So, if I do pseudo su, go into the roots home directory, and we have root.ext. So, that's going to be the box. Hope you guys enjoyed it. Take care and I will see you all next

title: HackTheBox - Down