In this post, I would like to share a walkthrough of the Carpediem Machine from Hack the Box
This room will be considered an Hard machine on Hack The box
What will you gain from the Carpediem machine?
For the user flag, you will need to obtain admin access on the website by using the upload function for webshell but it will direct you into a container. Once we are inside the container, we need to enumerate more on the machine where we will find an instance of trudesk. Need to get the SSH password from the voice call from Zoiper.
As for the root flag, you need to abuse CVE-2022-0492
Information Gathering on Carpediem Machine
Once we have started the VPN connection which requires a download from Hackthebox, we can start information gathering on the machine by executing the command nmap -sC -sV -p- <IP Address> -PN
There are two port open on the machine.
Let’s access the website interface
The same interface is been shown even after we access using the domain “carpediem.htb“
We didn’t managed to find any interesting directory that we can make use for further escalate.
Finally, we managed to see one subdomain that been configured inside the machine
Sadly, we don’t have any valid credentials with us right now. As a result, let’s create a new account by registering
By default, we can register with any username and password for this purpose.
Once we completed registering, we will be directed to the main page such as above.
We can try to inspect the update request by using burpsuite.
As show in the screenshot above, we notice that login_type is number 2 which keeps me thinking that admin might be number 1.
Let’s try modifying the login_type
We have successfully accessed the admin dashboard.
Let’s add some comments on the picture that has been legit on the internet (this idea is been advised by my friends)
At last, we have a command injection on the website itself.
As a result, let’s inject the website with our reverse shell command.
Finally, we have a reverse shell connection back to us as shown above.
However, we are inside a docker environment.
Let’s do a port-forwarding on the machine by using chisel
Enumeration on mongodb database
Let’s enumerate further inside the mongodb database by using mongosh tool
Therefore, we managed to see 4 databases that have been saved on mongodb database.
The screenshot above shows the users that have been configured on the mongodb database.
Let’s enumerate it further with the command db.tickets.find()
From the information that we found inside the mongodb database, there’s a few crucial information on the voice call message.
Gain information from the Zoiper tool
Firstly, we need to download and install the zoiper over here
The details that we need to enter on the zoiper would be something such as
- User id: 9650
- Pin: 2022
- Domain: Carpediem.htb
We can know that we have successfully configured the Zoiper when you see the interface as shown above.
From the video above, we managed to find the password for the user
We can read the user flag by running typing the command “cat user.txt“
Escalate to Root Privileges Access
We cannot see any binary that we can abuse when running the sudo -l command
Let’s transfer the linpeas binary into the victim’s machine
Let’s run the linpeas.sh for further enumeration
I notice there’s a file that look weird to me
It looks like an ssh private key but sadly it’s a different type of key
Let’s dump some traffic on the victim’s machine
We can use the key under TLS to decrypt the traffic of the machine
At last, we have obtained the username and password for backdrop.carpediem.htb
Therefore, let’s do a port-forwarding again with port 8002 as shown on the screenshot above
Finally, we have a backdrop interface and let’s login using the credentials that we found earlier.
We can see the backdrop dashboard
We can upload the reference.tar as module
Finally, we have a command injection working on the website interface.
Let’s start our nc listener
Let’s put our reverse shell command which has been base64 encoded and we can decode it again on the browser so that we can retrieve the reverse shell connection back to us.
As a result, we have successfully obtain the connection back
There are some source codes that show some cron job
We are required to create a basic PHP reverse shell connection on my own attacker’s machine just like above
Let’s start our python proxy server
Aside of that, we also need to start our nc listener too
In order to obtain the reverse shell connection back, we need to use the command shown in the screenshot above.
Finally, we have successfully obtained a root on docker but we still cannot read the root flag yet.
Docker Escape
I got this script with the help of my friends in the internet
We should execute the same command above so that we can received a root shell
As a result, we have successfully got the root shell
We can read the root flag by typing the command “cat root.txt“
Extra Information on Carpediem Machine
No responses yet