#rce

This box starts with a site that hosts request-baskets at version 1.2.1 which is vulnerable to CVE-2023-27163 (SSRF). After exploiting the vulnerability I access hidden resources on other ports and find Maltrain at version 0.53 which is vulnerable to CVE-2023-27163 (RCE). I can exploit this vulnerability and become the user. To become root just look at what you can do with sudo and take advantage of systemctl's default pager

This box starts with a website hosting Cacti version 1.2.22 that is vulnerable to CVE-2022-46169. Just follow the automated steps in the exploit on github to get a shell as www-data. The enumeration continues, I'm inside a docker container, thanks to a weakness in the capsh binary I can become root of the container. Docker breakout? Unfourtunally not, I searched a lot but I didn't find anything to break through the docker container. As well as seeing how the system is setup, to continue just look at the /entrypoint.sh script, connect to the MYSQL db in the other container, enumerate it, find the hashed credentials for the user marcus and do the classic bruteforce attack with rockyou.txt. Finally to become root just read the mailbox for user marcus, it is explained by the system administrators what vulnerabilities there are and the exploits are on github.

This box starts with a website that contains a subfolder named "/tiny", in this subfolder there is TinyFileManager version 2.4.3 vulnerable to CVE-2021-45010. It is necessary to have a user in order to exploit the vulnerability so I proceed with a bruteforce attack by setting the username to admin. Once the password is found and the vulnerability exploited, I enumerate the whole system until I find the nginx vhosts thus discovering the "soc-player.soccer.htb" site. The site uses a WebSocket to communicate with the backend and it is vulnerable to a Blind-SQL-Injection which allows me to obtain player's credentials. Finally to get root I enumerate the system again until I find the dstat software which allows the player's group to write plugins in a specific folder. In this way, however, I still don't have root permissions, to get them you have to enumerate the system again and find some binaries not usually installed such as doas which has a configuration that allows you to run dstat as root.

The box starts with a Remote Code Execution on the website, possible for a vulnerability of pdfkit which has an exploitable version 0.8.6. Thanks to this vulnerability we will be able to generate a reverse shell. Once this is done, we just have to read a file in the ruby user's home folder that contains the credentials to access via SSH as henry, so we will get the user's flag. The privesc root takes advantage of deserialization of YAML files to execute arbitrary commands.