HacktheBox Walkthrough - Shoppy

🟥Name ➡️ Shoppy

🟥Release Date ➡️ 17 Sep 2022

🟥Retire Date ➡️ 14 Jan 2023

🟥OS  ➡️ Linux

🟥Base Points Easy ➡️ [20]

🟥First Blood User 6 mins, 03 seconds 22sh

🟥First Blood Root 12 mins, 37 seconds 22sh

👉Shoppy was much easier to exploit From there, I’ll need the lighest of reverse enginnering to get a static password from a binary, which gets me to the next user.

👉I’ll start by finding a website and use a NoSQL injection to bypass the admin login page, and another to dump users and hashes.

👉This user is in the docker group, so I’ll load an image mounting the host file system, and get full disk access.

👉Shoppy was one of the easier HackTheBox weekly machines to exploit, though identifying the exploits for the initial foothold could be a bit tricky.

👉With a cracked hash, I’ll log into a Mattermost server where I’ll find creds to the box that work for SSH.

👉In Beyond Root, a video walkthrough of the vulnerable web-server code, showing how the injections worked, and fixing them.

👉I’ll show the ways to get a shell from that.

😝Let's start with Enumeration..

nmap

Finds two open TCP ports, SSH (22) and HTTP (80)

😝Based on the OpenSSH version,host is running Debian 11 bullseye.

By doing a simple curl and looking at the headers we can see the shoppy.htb domain

Subdomain Fuzz

😝Doing a bit of fuzzing we can see a /admin that redirects us to /login

😝I’ll add both shoppy.htb and mattermost.shoppy.htb to my /etc/hosts

😝Now Looking at it from the web we can see an authentication panel

NoSQL Injection

😝We can bypass it with a mongodb nosql injection of query admin'||'1==1

😝When entering the panel we can see a user search engine

😝We can try using the same query of the login admin'||'1==1 in the browser

😝When using the query it gives us an option to export the result

😝We can see a couple of users, and hashes in this file

😝By using john to crack the hashes we can crack one and see a password

😝Taking a look we can see another login, for which we can use the credentials

😝Credentials for Jaeger

Reading the different channels,two channels have interesting information.

Jaeger asks for a machine set up with a username and password

We can see a conversation, which well... gives us ssh credentials

😝We just connect and we can read the first flag

Shell as deploy

Enumeration

😝jaeger can run /home/deploy/password-manager as deploy

😝When executing it asks us for a password, so we do not have access

😝If we cat the file we can see a part that when shaped looks like this

Executing the file and passing the lekeada password we find credentials

Shell as root

😝We can connect by ssh as deploy with the credentials

😝By doing id we can see that it is in the docker group

😝Looking at gtfobins we can see that there is a way to get root shell

Running a container and mounting the root, we can be root in it and read the flag

😝Even though we are root, we are still in a container with a mount, we can modify the sudoers and see the mount changes reflected on the real machine

++++++Rooted++++++

😊 Thanks For Reading 💕💕💕