Busqueda - Hack The Box
Enumeration
Nmap
Initial Nmap scan revealed SSH and HTTP ports open.
Hosts Update
The HTTP requests were forwarded to searcher.htb so I added it to /etc/hosts file.
Exploitation
Searchor Version
The searchor version in use was vulnerable to remote code execution. I used the exploit in this github link.
Got The User
User was compromised.
Privilege Escalation
I tried some privilege escalation methods, tried some known exploits against this version but none of them worked. Then I ran linpeas and checked its output which revealed new subdomain gitea.
Then inside the web root, I found a .git directory and config file inside it. It included clear text password of a user named cody. Cody was not available in the current linux, so I tested the password against the current svc user and got the SSH shell.
sudo -l
Inside the SSH shell I ran sudo -l and found out I can run python3 with a specific script.
The script included 3 options. I used one of the options to check configurations for gitea.
Gitea
The output included gitea user and password. I used this password with administrator user to login to gitea page.
Now, I got access to the administrator repositories. The scripts repo included the file I can run as sudo. At first I tried to update the file but it was disallowed. Then I checked the file and found out the full-checkup option on the script run ./full-checkup.sh, this can be exploited because it is not using full path.
I created a full-checkup.sh script which creates reverse shell.
Then running the full-checkup option as sudo I got the netcat shell.
Pwned
The machine was fully pwned.