> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/glitch.md).

# GLITCH

![](/files/-McBmCdTY93AdwiOxM3V)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.81.21
```

![](/files/-McBmsewS-QmeLCdemhV)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 80 -oN nmap 10.10.81.21
```

![](/files/-McBn1A0_ogY7jDujS9R)

## Enumeration

Lets visit the site

![](/files/-McBn7q71OS6cQFFsRfQ)

There is nothing on the page, lets look at the source code

![](/files/-McBnFBAnZo5RoMvpoJS)

We can see that there is a `getAccess()` function, but it not called, lets do to developer tools and call the function. (`Ctrl + i`) Go to console and type this

```
getAccess()
```

![](/files/-McBnueqkjTYSlZRjrZY)

We have a base64 string, lets decode it.

![](/files/-McBo5UYgci0uavdDumF)

Looking at the first question, this is a token, lets look at the tokens on the site. (Located in the storage tab).

![](/files/-McBoI-iKde45BMetpiU)

Lets replace the current value for token with the token we just decoded.

![](/files/-McBomTcxidhvI_wywi4)

Now refresh the page

![](/files/-McBora4XdPRYqlzvuwV)

We have another page. Lets look at the source code

![](/files/-McBpNHExIvKgJosRw3I)

There is a `script.js` file in the end , lets check it out

![](/files/-McBp_PZWTTkk5nK1vaO)

Looking through the page, there is a `/api/items` page what is being fetched, lets go check it out.

![](/files/-McBqV-tTyuXQb4adErg)

![](/files/-McBqR8QvpWeAPRYSjT3)

There seems to be nothing interesting. Here I was stuck so I looked at the hint tryhackme gave us. 

![](/files/-McBqvoUqbYjaWdsLn8i)

So now lets catch the request with Burp Suite and send it to repeater.

![](/files/-McBs03J6niVJ5S3wRJK)

It looks like it is using a `GET` method, lets change it to `POST`

![](/files/-McBs8fjMN0VmZvwFVPP)

We find something interesting. As this item endpoint accepts a post request too, we can try sending data to the endpoint only if we have a parameter, to do this lets fuzz the API parameter , lets use ffuf to do this.

```
ffuf -w /usr/share/wordlists/dirb/common.txt -X POST -u http://10.10.81.21/api/items?FUZZ=test -fs 45 -mc all
```

![](/files/-McBvRXnEfPo37FJULrZ)

Looks like cmd is the parameter. Lets send a post request to this endpoint using the `cmd` parameter.

![](/files/-McBw-pMokeezFS-V44A)

Looking at the output of the error, we can see `eval`. I went searching on google and then found this [article ](https://medium.com/@sebnemK/node-js-rce-and-a-simple-reverse-shell-ctf-1b2de51c1a44)that gives us a breakdown of how the eval function can be exploited to gain RCE on the machine.

## Exploitation

![](/files/-McBxeYNXcMWC6M7zR4V)

Lets use this, but with our own reverse shell, make sure to start a reverse shell

![](/files/-McC5zDJ5lJ18N9BPSd2)

![](/files/-McC5ck3KRVmGrWoePET)

Once you hit you should get this response and a reverse shell

![](/files/-McC6DlF7DoTUjQRr_fG)

We can stabilize the shell and read the `user.txt` file

![](/files/-McC6x9shTX2lR2JLpZ9)

## Privilege Escalation

Looking in the home directory of user, we see this directory `.firefox`

![](/files/-McC79NVR1w6EioXpd5m)

Lets see the content of the file

![](/files/-McC7HoL6WRkaDXpnZzH)

Looking on google I found [firefox\_decrypt](https://github.com/unode/firefox_decrypt.git). Lets clone it and then lets copy the `.firefox` directory to our machine

Lets first start a netcat listener

![](/files/-McCCHi7pbUdqSNobqdx)

Then lets send the folder using netcat on the victim machine

![](/files/-McCCB8J36aV7RfvRBsY)

Now we should get a connection and also we should see the `.firefox` directory on our machine

![](/files/-McCCRfLmc38VejXO6A2)

Now lets run the python exploit we cloned from GitHub on the directory

![](/files/-McCCl33Uu37-l_HnlNs)

We got a username and a password, lets switch users to v0id

![](/files/-McCD6E4vUWrKs7C3HJH)

Lets now look at the `SUIDs` that we can exploit

![](/files/-McCDPT195p_br7k_C7i)

Lets look at what `doas` is 

![](/files/-McCDf5Wj0zYNLVP11BB)

So we can execute command as other users, lets read the root.txt file with this command

![](/files/-McCE3lxKNdJINMo_ilT)

We can also switch users to root

![](/files/-McCEFBbWVT1p5gRz7A3)