HackTheBox "Inject"
April 18th, 2023
Introduction
Inject is an easy box released on March 11th, 2023 by rajHere.
User Own
Nmap:
There is a website at 10.10.11.204:8080.
The file upload only accepts images, so nothing much there. However, GET /show_image?img= is vulnerable to directory traversal.
/etc/passwd shows there are two users named frank and phil. phil's home directory contains the user.txt flag. frank's home directory contains an abnormal directory called .m2. .m2 contains settings.xml which has credentials.
While we have credentials, the credentials don't work for logging into phil through SSH.
Checking /var/www/WebApp/pom.xml, the web app is using Spring Cloud 3.2.2, which is vulnerable to CVE-2022-22963. This Python script can get us a reverse shell as frank.
While the password for phil won't work for SSH, we can still login to phil from frank using su phil and the password from settings.xml.
System Own
Inside /opt is file called automation/tasks/playbook_1.yml.
We can find an interesting line from pspy:
Every .yml file inside of /opt/automation/tasks is being run by ansible-parallel every 2 minutes.
/opt/automation/tasks is only writable by a group called staff.
phil is in staff, so we can put any .yml file we want in /opt/automation/tasks as phil. We can use a custom playbook that gives us a reverse shell as root. According to the Ansible docs, we can run shell code with a playbook. This Gist code will work.
Once the system runs our playbook, we get a reverse shell as root, letting us read the root.txt flag.
And that's the box!
Last updated