Canape

Canape - 10.10.10.70

Target Enumeration:

OS: Linux

IP: 10.10.10.70

User: bce918696f293e62b2321703bb27288d

Root: 928c3df1a12d7f67d2e8c2937120976d

Vulnerability Exploited:

Pickle Code Injection

Privilege Escalation:

User allowed to run pip install as root user.

Exploiting the host:

Nmap (used sparta as I was being lazy)

There is a .git repo.

Lots of false positives with the application

.git repo gives us an address to download the source code.

Add git.canape.htb to our /etc/hosts file and clone the repo.

Now we have the source code we can see it is vulnerable to pickle code injection.

Researching the issue lead us to https://lincolnloop.com/blog/playing-pickle-security/

Although I had several issues with getting the reverse shell and had to look online for a working python exploit.

https://ironhackers.es/en/writeups/writeup-canape-hackthebox-2/ :)

Execute the code to receive a reverse shell.

Now we have a shell as www-data.

Enumerating the system and looking at the initial git code gave us a potential route

We could see it was listening locally:

Reviewing it gave us a version to check

And searchsploit gave us a potential exploit

This did not work so we kept looking online and found

https://www.exploit-db.com/exploits/44498/

Running the following creates a user for us.

We can now grab the passwords

Upgrade to a full tty to su to the user homer (found via passwd file) or login via ssh

Upgrading current shell:

Grab the user flag

We can run pip install as root as the user homer

Move to /dev/shm/ to stop any other files messing around with your shell.

Create the following basic python reverse shell

Copy to the webserver and rename setup,py to work with pip

Setup a nc listener on port 444

Install the file with sudo pip install .

Now you receive a root shell.

Grab the root flag