HTB - Teacher

Teacher

Getting Root:

Nmap:

Enumeration:

Dirsearch

Inspecting the source

Clicking on the highlighted links does nothing at all.

Closely looking at the source, we notice something odd about images/5.png

Looking at it from the console, we can see that every time we click on a link, the message "That's an F" shows up.

Checking the image at http://10.10.10.153/imageswe can see it doesn't follow the naming convention as the other images. Let's download it.

Inspecting the image shows its text

it seems we might be able to login somewhere using the username Giovanni as long as we can figure out the last digit of the password and the login page.

From the output of gobuster, we can see it found /moodle so checking out out shows a page where we can possibly login. We can also notice the user Giovanni Chhatta

Guessing the Password with Burp

Got the POST request and sent ti to Intruder

I used the following payload from seclist: /usr/share/seclists/Fuzzing/special-chars.txt and Burp shows a hit using the #

This can also be done using wfuzz

Now we are going to try to login to the web application as:

Username: giovanni Password: Th4C00lTheacha#

Exploit

LogoSonar BlogsSonarSource

We login to moodle and enable editing on to be able to add the Quiz as described in the above exploit POC

Used netcat to get a reverse shell

Got a shell

The following creds were found on /var/www/html/moodle under config.php

Got the password for user giovanni from the database

Cracked the hash

Now we can escalate to use Giovanni

Privilege Escalation

There is a directory called work and there are some files owned by root

Using pspy64 shows that root is creating a backup of the course, changing directory to tmp and then recursively setting rwx to all files

I edited the shadow file and used the same hash as giovanni

PreviousHTB - BlockyNextHTB - Tally

Last updated