In this post, I would like to share a walkthrough of the Stocker Machine from Hack the Box
This room will be considered an Easy machine on Hack the Box
What will you gain from the Stocker machine?
For the user flag, you will need to abuse the JSON exploitation to bypass the login which leads us to access the dashboard. We also are abusing the API application to obtain information on the credentials of the user.
As for the root flag, you need to abuse the node script to obtain root shell
Information Gathering on Stocker Machine
Once we have started the VPN connection which requires a download from Hackthebox, we can start the information gathering on the machine by executing the command nmap -sC -sV -p- <IP Address> -PN
Let’s access the website interface
When we try to access the website by using the IP address of the machine, the page is been redirected to the domain “stocker.htb“
From the website interface, nothing that looks interesting popup. As a result, let’s enumerate more on the directory and the subdomain
No obvious directory that we can analyze further.
However, we managed to retrieve a subdomain of the machine as dev.stocker.htb
The page has been redirected to a login page where we don’t have any credentials to use here.
Therefore, let’s try using the common username and password and try to inspect it via burpsuite
It looks like a dead-end on the credentials
When I change Content-Type to JSON type and i managed to found an potential directory that we can abuse in the future
After a while, I was thinking that the login page might be vulnerable to NoSQL Injection which also exists within the Shoppy machine.
The exploit explanation can be found at HackTricks, ippsec video, and 0xdf walkthrough
If we successfully log in to the Dashboard, we will be directed to the page above.
The request on the page via burpsuite doesn’t show any malicious payload that we can abuse.
Inspecting the website interface using burpsuite
Let’s try to submit any purchase and try to inspect via burpsuite to find anything useful to exploit
The Request and Response for the purchase will look something as shown in the screenshot above.
The page of mentioning the response as “Thank you for your purchase!” will appear as shown above.
It does look like a Purchase Order for the item that we just recently bought from the website.
I have a feeling that we can retrieve some information such as /etc/passwd by executing some Dangling Markup
Finally, it works as shown in the screenshot above.
I might be able to make a wild guess with the directory that we might use to obtain any information.
Inside the index.js file, I notice there are some credentials such as passwords which we might be able to use for access via SSH service.
If the password is not correct, then we should find another credential on the machine itself
We can read the user flag by typing the “cat user.txt” command
Escalate to Root Privileges Access
As usual, we should be getting the SUID Binary by typing the command “sudo -l” and we managed to binary which is a node that can run any javascript
Firstly, we need to check if bash permission doesn’t have any SUID permission
Therefore, let’s create a js file that contains something as i do above.
After that, we should be able to run the command as shown above.
The bash file has been assigned to SUID which we will take advantage of it.
We can get root access by just typing the command “bash -p”
At last, we can read the root flag by typing the “cat root.txt” command
Extra Information
No responses yet