Facts : Linux Easy - HackTheBox Walkthrough

 

Machine Link : Facts - HTB

Hey there, I hope you are doing Well....

Today, we will Solve HackTheBox Facts Machine.

So, Let's Go.... Start with Starting Machine and connecting via OpenVPN.

 

Reconnaissance & Enumeration

Let's Start with Reconnaissance and Enumeration. (As every time we do)

 nmap -sV -O -T4 <Machine_IP> 

Here we are doing Nmap Scan with following Parameters:

    -sV : Enable Version Scanning on Services 

    -O : Enable OS Detection

    -T4 : Speed up Scanning Process

 

Interesting.... We found 2 ports open 22 SSH and HTTP

So, lets try accessing HTTP via Browser. As we can see it's redirecting to http://facts.htb/, which means  we need to add an entry in /etc/hosts.

Using  nano /etc/hosts  :

 Nice.... This site looks interesting.

Let's Try Sub-directory Enumeration :

 gobuster dir --url http://facts.htb/ --wordlist=/usr/share/wordlists/dirb/common.txt 

 

Oh no... It is giving 200 Success Code on All Sub Directories (False Positive).

But.. But... through this scan we got Admin Login Panel Location.

 

Let's check this too...

 

Tried Multiple things but no success. 

Let's try creating a new user. (I don't know why admin panel have Create User Link) 

Nice...

  

 From the Footer we can confirm that this Dashboard is using Camaleon CMS - 2.9.0

After some googling we can see that it is vulnerable by :

                - Path Traversal (Exploit DB or SearchSpolit)

 

                - Privilege Escalation + Extract S3 Data (Github Link) 

 

 

Let's Check if Machine Contains some S3 data or not using 2nd Exploit using user and password we created using Admin Panel.

 

Bingo!!! We got S3 Credentials.

Use this command to Configure and connect to AWS Bucket:

 aws configure 

Let's check Available Buckets using:

 aws s3 ls --endpoint-url http://facts.htb:54321 

 

 We got SSH Key.... I just copied it to current folder.

Now, before we connect via SSH, we need two things, first passphase of SSH Key, Second User to Login with.

To get list of users, we will use path traversal vulnerability.

For this we will going to need Auth_Token, so Login to admin Panel and Copy Auth Token from Browser Storage (Inspect > Storage).

 

 

 Bingo!! We got Username...

 

Now we need to find SSH Passphase, for this we use ssh2john then john to bruteforce. I'm using Rockyou.txt.

Now, Let's Connect via SSH using Username "trivia" and SSH File and Passphase.

Give Correct Permissions to SSH Key File:

 chmod 600 id_ed25519 

Connect:

 ssh -i id_ed25519 -p 22 -l trivia <Machine_IP>  

 Now let's get the user flag from  /home/william/user.txt .

 

Let's do some Privilege Escalation for root flag.

Try :  sudo -l 

 

We got a "facter" program, which we can execute using sudo without password.

From GFTOBins we got to know that we can use facter with sudo to execute any .rb file with root priviledges.

 

So let's go. Let's Create a .rb file with 'exec "/bin/bash"' command.

Running the following command will execute first .rb file in path with root privilege.

 sudo /usr/bin/facter --custom-dir=/home/trivia 

 

Bingo! We got Root Flag too.... 

Done!! Everyone we just solved Facts Machine of HackTheBox.

Leave Comment if you have any doubt or suggestion.