HackTheBox "Soccer"
April 23rd, 2023
Introduction
Soccer is an easy box released on December 17th, 2022 by sau123.
User Own
Nmap scan:
There is a website being hosted at http://soccer.htb. Subdirectory enumeration reveals a subdirectory called tiny.
http://soccer.htb/tiny is hosting Tiny File Manager. The default admin credentials for Tiny File Manager are the username admin and the password admin@123, which work.
There is a folder called uploads inside tiny that can be accessed at http://soccer.htb/tiny/uploads. A PHP reverse shell can be uploaded and accessed. This gives access to www-data.
Looking inside /etc/hosts:
There is a subdomain at http://soc-player.soccer.htb. This website is the same as the original, but has login functionality. After signing up, there is a function for checking if a ticket exists.
The code for this ticket checking box can be found inside the website.
There is a web socket at ws://soc-player.soccer.htb:9091. We can use sqlmap to find credentials through the web socket. This can be done using Rayhan0x01's middleware server.
There are 5 databases found, but the one that stands out is soccer_db.
There is 1 table found called accounts.
Checking username:
Checking password:
Checking /home:
player can be logged into SSH with the same credentials.
System Own
Checking /usr/local/etc/doas.conf:
dstat can be run as root with doas:
dstat can be used for privilege escalation by using a custom plugin.
The plugin can then be run:
And that's the box!
Last updated