# Mentor!
## @Author : M3tr1c_r00t

### Enumeration...
#### Nmap

# Nmap 7.92 scan initiated Sun Dec 11 21:39:49 2022 as: nmap -sC -sV -A -p 22,80 -oN nmapports.txt 10.129.84.239
Nmap scan report for mentorquotes.htb (10.129.84.239)
Host is up (0.23s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 c7:3b:fc:3c:f9:ce:ee:8b:48:18:d5:d1:af:8e:c2:bb (ECDSA)
|_  256 44:40:08:4c:0e:cb:d4:f1:8e:7e:ed:a8:5c:68:a4:f7 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-title: MentorQuotes
| http-server-header: 
|   Apache/2.4.52 (Ubuntu)
|_  Werkzeug/2.0.3 Python/3.6.9
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.6 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.3 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 - 5.4 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT       ADDRESS
1   326.20 ms 10.10.14.1
2   326.45 ms mentorquotes.htb (10.129.84.239)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Dec 11 21:40:13 2022 -- 1 IP address (1 host up) scanned in 24.05 seconds

#### Gobusterscan...
Wierdly enough, the gobuster plus other tools like dirsearch and ffuf didnt find any files/directories so next up we can do a sub-domain scan.

/server-status        (Status: 403) [Size: 281]


#### Vhost/Sub-Domain Bruteforce

add the ```api.mentorquotes.htb``` to your /etc/hosts file then we can continue with our enumeration.

#### directory bruteforce on the discovered sub-domain
we can fuzz for the api endpoints and we found some interesting onces.

We can try and check the docs part since it may have interesting pointers.

At least we've found a way to interact with the api application. We can try to interact with the system by creating a user.

After creating a user, we need to login so that we can get our api-token to enable us to be able to interact with the api effectively.

We can now add the api to our request headers whenever we are making a request and we can now further interact with the api.

Authorization: YOUR_API_TOKEN

On checking out the /quotes/ endpoint, we find the same quotes that were being served on the static site.
We can try to interact with the /users/ endpoint but we seem not to be authorized.

If you noticed in the docs endpoint, there was a username ...
So james is a possible username.
We can try to bypass the authentication by creating a new user with his same name and see if this works...
lets now get our api-token...

and try to get to the /users endpoint
Nice! it worked.

Let's try and see if we can access the /admin endpoint...
noice.
We find that there are other endpoints which didn't turn up in the bruteforce results but we can now interact with them.

On visiting the first one, it seems not to have any valuable data.

If we check the next...

The api needs 2 entries, body and data... With this info, we can try to get an rce using backticks and were in!

https://www.wallarm.com/what/how-to-hack-api-in-60-minutes-with-open-source

### Lateral Movement
After getting a reverse shell, we find ourselves in a docker container.
Luckily enough, we can get the user flag.

After looking around in the file system of the server, I found some database credentials for the postgress server...
I decided to check the open ports on the docker container and i found only one internal service.
I assumed this to be the postgres service running since the normal port for postgres is ``` 5432```

I then used the chisel binary to do a port forwarding so that we could access the service.
After port forwarding, login to the postgres service using psql and we find some hashed creds which seem to be md5
I then cracked the svc password as james' password wasnt crackable.

and we could login as the svc user via ssh.
### Svc to James
After a bit of dead ends with further enumeration, i decided to try and look for a password in any possible file using the grep command.
And wierdly enough, I found the password in ```/etc/snmp/snmpd.conf```

### James to Root
Just check the sudo permissions and turns out we can run the /bin/sh as root.
Basically giving us access to root directly.

And Done!

## My socials:
<br>@ twitter: https://twitter.com/M3tr1c_root
<br>@ instagram: https://instagram.com/m3tr1c_r00t/