GLITCH
Reconnaissance
Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (-Pn)
Detailed Nmap Scan :
Command Breakdown:
(-sV): Service version
(-sC): Default nmap scripts
(-p): Specifying ports 80
(-oN nmap): Saving it into a file called nmap
Enumeration
Lets visit the site
There is nothing on the page, lets look at the source code
We can see that there is a getAccess() function, but it not called, lets do to developer tools and call the function. (Ctrl + i) Go to console and type this
We have a base64 string, lets decode it.
Looking at the first question, this is a token, lets look at the tokens on the site. (Located in the storage tab).
Lets replace the current value for token with the token we just decoded.
Now refresh the page
We have another page. Lets look at the source code
There is a script.js file in the end , lets check it out
Looking through the page, there is a /api/items page what is being fetched, lets go check it out.
There seems to be nothing interesting. Here I was stuck so I looked at the hint tryhackme gave us.
So now lets catch the request with Burp Suite and send it to repeater.
It looks like it is using a GET method, lets change it to POST
We find something interesting. As this item endpoint accepts a post request too, we can try sending data to the endpoint only if we have a parameter, to do this lets fuzz the API parameter , lets use ffuf to do this.
Looks like cmd is the parameter. Lets send a post request to this endpoint using the cmd parameter.
Looking at the output of the error, we can see eval. I went searching on google and then found this article that gives us a breakdown of how the eval function can be exploited to gain RCE on the machine.
Exploitation
Lets use this, but with our own reverse shell, make sure to start a reverse shell
Once you hit you should get this response and a reverse shell
We can stabilize the shell and read the user.txt file
Privilege Escalation
Looking in the home directory of user, we see this directory .firefox
Lets see the content of the file
Looking on google I found firefox_decrypt. Lets clone it and then lets copy the .firefox directory to our machine
Lets first start a netcat listener
Then lets send the folder using netcat on the victim machine
Now we should get a connection and also we should see the .firefox directory on our machine
Now lets run the python exploit we cloned from GitHub on the directory
We got a username and a password, lets switch users to v0id
Lets now look at the SUIDs that we can exploit
Lets look at what doas is
So we can execute command as other users, lets read the root.txt file with this command
We can also switch users to root
Last updated
