Popcorn
Last updated
Last updated
IP: 10.129.101.103 Completed on: February 13, 2021 Time took: 2.2 hrs
Running a version and default script nmap scan, we find port 22 and 80 open. Simple enough:
Running a gobuster to find directories we find the following:
Let’s modify our /etc/hosts to add popcorn.htb hostname to allow virtual hosting:
Routing to http://popcorn.htb/torrent we find a Torrent Hoster web app, following the below article I was able to perform file upload bypass to upload a reverse php shell: https://infinitelogins.com/2020/08/07/file-upload-bypass-techniques/
First we will need to create an account: Email: defendergb@test.com Password: password1$
Now let’s select upload, since we will need a torrent file, I grabbed Kali Linux’s torrent from their website. Uploading it takes a few seconds so do wait:
Now that we have it uploaded, let’s upload a normal image file, click “Edit This Torrent’:
Now select Browse, and upload any image file:
Success message:
Now that we know it uploads successfully, let’s run Burp and use a reverse php shell. I am using Pentest monkey’s reverse php shell:
Now let’s upload the php file:
We get blocked by file upload filters, let’s take a look at the POST request. By modifying the Content-Type we are able to bypass the filter. Some filters also detect the actual file being uploaded, you could then copy the magic bytes of the image file you uploaded before and change the file name to include image type (ex: reverse-shell.php.jpg or reverse-shell.jpg.php) A good box to try this is Magic in HTB.
Refresh the page and click on the Screenshot, it will do an endless load. Make sure to have a listener running on your machine to capture the reverse shell:
Nice we got into www-data. I ran the following command to get some initial information of the box:
Since we found a user george, I ran a find for files within home that I had access to with www-data:
find /home -printf "%f\t%p\t%u\t%g\t%g\t%m\n" 2>/dev/null | column -t
Knowing that 1) Linux 2.6.31 is used and 2) there is a motd.legal-displayed file, we can find the following known exploits:
Dirty COW (vulnerable from 2.6.22 to 3.9)
Linux PAM 1.1.0 MOTD File Tampering Priv Esc exploit https://www.exploit-db.com/exploits/14339
Although I attempted 2, I was not able to get the exploit to create a toor account. I used Dirty COW (Known to break machines, please be cautious before using in production environments), and was easily able to exploit the machine.
Following steps of dirty.c https://github.com/FireFart/dirtycow/blob/master/dirty.c I was able to exploit the machine and get root using created firefart user:
