Hack the Box Writeup: Help

This was a pretty straightforward machine that required minimal alterations to the exploits - once you found them anyway :)

Nmap scan shows only a few ports open:

22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 e2:1b:88:d3:76:21:d4:1e:38:15:4a:81:11:b7:99:07 (ED25519)
|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxDPln3rCQj04xFAKyecXJaANrW3MBZJmbhtL4SuDYX
80/tcp   open  http    syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|  Supported Methods: POST OPTIONS GET HEAD
|_http-server-header: Apache/2.4.18 (Ubuntu)
|http-title: Apache2 Ubuntu Default Page: It works
3000/tcp open  http    syn-ack ttl 63 Node.js Express framework
| http-methods:
|  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (application/json; charset=utf-8).

I tried port 3000 first and was greeted with this:

I don't know anything about JSON so skipped this.

Port 80 just gave me a default Apache screen so I ran dirb:

START_TIME: Tue Jan 22 11:38:26 2019
URL_BASE: http://10.10.10.121/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

GENERATED WORDS: 4612

---- Scanning URL: http://10.10.10.121/ ----

http://10.10.10.121/index.html (CODE:200|SIZE:11321)
==> DIRECTORY: http://10.10.10.121/javascript/

http://10.10.10.121/server-status (CODE:403|SIZE:300)
==> DIRECTORY: http://10.10.10.121/support/

---- Entering directory: http://10.10.10.121/javascript/ ----
==> DIRECTORY: http://10.10.10.121/javascript/jquery/

---- Entering directory: http://10.10.10.121/support/ ----
==> DIRECTORY: http://10.10.10.121/support/controllers/
==> DIRECTORY: http://10.10.10.121/support/css/

http://10.10.10.121/support/favicon.ico (CODE:200|SIZE:1150)
==> DIRECTORY: http://10.10.10.121/support/images/
==> DIRECTORY: http://10.10.10.121/support/includes/

http://10.10.10.121/support/index.php (CODE:200|SIZE:4453)
==> DIRECTORY: http://10.10.10.121/support/js/
==> DIRECTORY: http://10.10.10.121/support/uploads/
==> DIRECTORY: http://10.10.10.121/support/views/

Going to http://10.10.10.121/support shows a HelpdeskZ application:

Clicking around found a potential entry at a file upload page:

First thing I tried was uploading a PHP reverse shell but got a big fat NO:

Searchsploit shows a couple of exploits but one needs credentials:

Looking at the arbitrary file upload exploit shows this:

Looking at the code for the upload page shows where the upload dir is:

I'm no PHP coder but it seems the potential exploit is correct and that files are uploaded even though you may get an error message:

After some experimentation, I figured out the upload directory by appending 'tickets/' to the 'support/uploads' directory that dirb found. Running the exploit with a PHP reverse shell and that directory yielded a limited shell:

With a netcat listener ready, simply running the exploit yielded the shell since it will hit the PHP page. Otherwise, opening the URL the exploit gives will do it:

User flag:

Searching for SUID files shows s-nail-privesp:

Googling 's-nail-privesp' found an exploit for it. I could not get that initial exploit working but found a wrapper for it that did the trick quite nicely:

A few seconds later:

Root flag: