#brute-force

This box starts with a website hosting Cacti version 1.2.22 that is vulnerable to CVE-2022-46169. Just follow the automated steps in the exploit on github to get a shell as www-data. The enumeration continues, I'm inside a docker container, thanks to a weakness in the capsh binary I can become root of the container. Docker breakout? Unfourtunally not, I searched a lot but I didn't find anything to break through the docker container. As well as seeing how the system is setup, to continue just look at the /entrypoint.sh script, connect to the MYSQL db in the other container, enumerate it, find the hashed credentials for the user marcus and do the classic bruteforce attack with rockyou.txt. Finally to become root just read the mailbox for user marcus, it is explained by the system administrators what vulnerabilities there are and the exploits are on github.

This box starts with a website that contains a subfolder named "/tiny", in this subfolder there is TinyFileManager version 2.4.3 vulnerable to CVE-2021-45010. It is necessary to have a user in order to exploit the vulnerability so I proceed with a bruteforce attack by setting the username to admin. Once the password is found and the vulnerability exploited, I enumerate the whole system until I find the nginx vhosts thus discovering the "soc-player.soccer.htb" site. The site uses a WebSocket to communicate with the backend and it is vulnerable to a Blind-SQL-Injection which allows me to obtain player's credentials. Finally to get root I enumerate the system again until I find the dstat software which allows the player's group to write plugins in a specific folder. In this way, however, I still don't have root permissions, to get them you have to enumerate the system again and find some binaries not usually installed such as doas which has a configuration that allows you to run dstat as root.