HTB - Cronos
Getting Root
We execute a zone transfer using dig and got a virtual host to the admin page which is vulnerable to SQL injection.
Once logged in, we send the request through Burp and we can get command execution from a tool that performs ping and traceroute. Got reverse shell using python
We notice that root executes a php script every minute, and this script is owned by our user www-data. Replacing the php script with our code, and we get root
Tools used:
nmap, dig, burp
Nmap
Enumeration
DNS
Zone transfer
The interesting part here is admin.cronos.htb
HTTP
On the the admin page, we tried guessing a few usernames and passwords but got nothing. However when we tried a few SQLi I was able to login using the following:
Username: admin' #
Password: admin
Once logged in, we are redirected to this tool which allows us to ping and traceroute
A simple test shows that we can ping our box
On our Kali box, we can see the icmp packets.
Exploit
We send this ping request to Burp and notice we got command execution
Request
Response
Using a python reverse shell as the payload and we get a shell as user www-data
Privilege Escalation
Doing some enumeration on the box with linpeas.sh and the following jumped out.
The file is owned by our user and its executed by root. With that info, we replaced artisan with a reverse php script and we get a shell as root.
Last updated