netcat<\/code> expects and we get a reverse shell going! Nice.<\/p>\ncd<\/code> commands now work, so we start poking through the pc to see what we can see. The source code for the site seems to be a good place to start, as sqlmap<\/code> was able to log in as the postgresql<\/code> there may be a hash of the password somewhere we can leverage.<\/p>\nThis turns out to be very close to the case. In fact, the password was stored in plaintext<\/em> at the top of the dashboard.php<\/code> file for the site:<\/p>\n\nsession_start(); \n if($_SESSION['login'] !== \"true\") { \n header(\"Location: index.php\"); \n die(); \n } \n try { \n $conn = pg_connect(\"host=localhost port=5432 dbname=carsdb user=postgres password=P@s5w0rd!\"); \n }\n<\/code><\/pre>\nRunning sudo -l<\/code> points us to one app we can use to get to root: vi<\/code>, but there is a catch: we can only run it as root on a specified file:<\/p>\nUser postgres may run the following commands on vaccine:\n(ALL) \/bin\/vi \/etc\/postgresql\/11\/main\/pg_hba.conf\n<\/code><\/pre>\nSo we run the following command: sudo vi \/etc\/postgresql\/11\/main\/pg_hba.conf<\/code> and it opens vi<\/code> as root in that file. There is a very well-known trick (actually a built in feature) to getting a shell in vi<\/code>. If we type :<\/code>, it will open up a prompt from which we can run a shell simply by calling \/bin\/bash<\/code>. This works and we are now in a shell as root!<\/p>\nThe only task remaining is to find the flags. navigating to \/root<\/code>, we find the root.txt<\/code> file for the root flag. But there’s one more user flag we need to find. I think we were supposed to find it already, but we must have missed it. No worries, we’ll run a quick command to find it: \"user.txt\" | grep \"user.txt\"<\/code>
\nAnd we see we missed the flag in the directory for the postgres<\/code> user:
\n\/var\/lib\/postgresql\/user.txt<\/code><\/p>\n
\nClosing Thoughts<\/h2>\n
I had a lot of trouble with sqlmap<\/code> in this box. I spent a lot of time looking through webpages and the man<\/code> page of the command trying to figure out why my --os-shell<\/code> command wasn’t working. At first I logged all the switches and things I tried, but I had to cut it down because it was just way too long<\/strong>, and I already feel like these writeups are a bit wordy. On that note, I’ll end this one!
\n~Mike ‘kefka’ Babineau<\/p>\n","protected":false},"excerpt":{"rendered":"This is my writeup for the ‘Vaccine’ machine in HackTheBox’s starting point. As usual, I will include everything I tried, whether it turned out to be fruitful or not. Enumeration & Starting out Let’s start with some port enumeration. We also want to save the output for future reference and […]<\/p>\n","protected":false},"author":2,"featured_media":95,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[9],"tags":[10,7,6,12],"class_list":["post-94","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-htb-writeups","tag-cyber","tag-fun","tag-hackthebox-2","tag-writeup"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/mikebabineau.me\/wp-content\/uploads\/2022\/08\/vaccinepwned.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/posts\/94","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/comments?post=94"}],"version-history":[{"count":7,"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/posts\/94\/revisions"}],"predecessor-version":[{"id":118,"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/posts\/94\/revisions\/118"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/media\/95"}],"wp:attachment":[{"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/media?parent=94"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/categories?post=94"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mikebabineau.me\/index.php\/wp-json\/wp\/v2\/tags?post=94"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}