In this post, I would like to share a walkthrough of the Usage Machine from Hack the Box
This room will be considered an Easy machine on Hack the Box
What will you gain from the Usage machine?
For the user flag, you need to abuse blind SQL injection vulnerability in a password reset form, which I exploited to dump the database and locate the admin login credentials. The admin panel, built with Laravel-Admin, has a vulnerability that allows uploading a PHP webshell as a profile picture by altering the file extension after client-side validation.
As for the root flag, you need to explore and discovered a password in a Monit configuration file and exploited a wildcard vulnerability in 7z to read files as the root user.
Information Gathering on Usage Machine
Once we have started the VPN connection which requires a download from Hackthebox, we can start
┌─[darknite@parrot]─[~/Documents/htb/usage]
└──╼ nmap -sV -sC -oA initial 10.10.11.18
# Nmap 7.94SVN scan initiated Fri Aug 9 19:38:38 2024 as: nmap -sV -sC -oA initial 10.10.11.18
Nmap scan report for 10.10.11.18 (10.10.11.18)
Host is up (0.016s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA)
|_ 256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Aug 9 19:38:48 2024 -- 1 IP address (1 host up) scanned in 10.27 seconds
┌─[darknite@parrot]─[~/Documents/htb/usage]
└──╼ $
Let’s access the website interface
However, it have redirected to a login page
Let’s try to access the dashboard by using the default credentials but sadly we cannot access the dashboard at all.
The screenshot above show the request via burpsuite
I managed to found a Reset Password and let’s try to see if anything occurs
The packet will look something as shown above.
Enumerate the MySQL database
When testing with the error syntax, we managed to find Blind SQLi command which it provide us with HTTP 500 Internal Server Error.
Therefore, let’s analyze the SQLinjecetion by using the sqlmap tool which lead to Time-based Attack
We should be able to obtain the database on the system using the sqlmap which it lead to admin’s hash
As a result, we can copy-paste the hashes into our attacker’s machine and crack it.
After a while, we managed to crack the hash as whatever1
However, we didn’t have any potential website to enter the credentials into
Nothing that we can found on the directory too.
Let’s enumerate the subdomain by using gobuster but we didn’t found anything at all.
However, we managed to find the subdomain when we changed using ffuf tool
Therefore, let’s try to access the subdoamin but we did find a new login page
We did notice that there’s version that we can abuse for the next stage
After doing some research, i managed to find a CVE-2023-24249 which can be found here
Therefore, let’s try to exploit on the webite above
We are required to upload the a file that contain a PHP simple one liner
It have successfully uploaded to the website dashboard
Let’s test the PHP code by execute one command injection and it works like charm!
As a result, let’s inject the request with our reverse shell payload
We can read the user flag by typing the “cat user.txt” command
Escalate to Root Privileges Access
We cannot find the binary using the normal way because we don’t have any password for dash’s access
Finally, we found the paassword for one credentials but we didn’t know the password can be use for which username
There’s three user that we can try access by entering the password that we found earlier.
The password can be use for xander’s access
At least, we can find the binary in xander’s access
Sadly, we cannot get a proper code for the binary use
We can use the command above to grab the root’s flag and also root’s SSH key
Let’s execute the binary and see the response of it
After a while, we managed to get the SSH key for root’s shell
We can read the root flag by typing the “cat root.txt” command
No responses yet