HackMDLate - Easy
Late is an Easy linux box, let’s get to enumeration.
Information Gathering
Let’s perform an initial scan to identify the ports and services that are running on the system
Add the $IP to /etc/hosts ie late.htb
Go to late.htb and inspect the webpage.
While going through the webpage, we find a link in one of the questions that leads to the subdomain images.late.htb
Add the subdomain to /etc/hosts file.
Enumeration
On the images.late.htb we have a webpage with an upload feature that converts text on image to plain text.
We can try and manipulate the feature and see whether it’s vulnerable to SSTI since it’s running on flask.
I used the payload {{7*7}} to check for presence of SSTI vulnerability.
Convert the text to image using https://cloudconvert.com/ then upload the payload which in turn gives us a results.txt file.
From this we can see that the site is vulnerable to SSTI as it solved it.
More research can be found in book.hacktricks.xyz
We use a one liner payload as below, convert it the payload to image and upload it to get hold of /etc/passwd file.
Which gives us a results of:
From this, the account svc_acc is of great interest as it’s home folder is home/svc_acc
We can try to get the ssh key and use port 22 to log into the svc_acc account. We can find the SSH key by modifying the payload to get : ~/.ssh/id_rsa and modifying the text to image then uploading it to images.late.htb
This gives us the following key:
Rename this file to id_rsa then do the following:
ssh into the file and you will be able to get into the account svc_acc
We’ve been able to get the user.txt flag, now we can be move on and see if we can get the root.txt flag.
Privilege Escalation
Upload linpeas and run it.
Running linpeas gets us a very interesting flag that we can look at.
The script is executable, therefore we can embed our malicious payload and listen on another terminal to get a reverse shell as root user.
Once we are in we can checkout the root directory for the root flag.
TADAAAAAAAAAAAAAHHHHHHHHHH and we are done!!!
