> For the complete documentation index, see [llms.txt](https://p1yushsecurity.gitbook.io/offsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://p1yushsecurity.gitbook.io/offsec/machines/hack-the-box/late.md). # Late ## Recon ### nmap scan ``` PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 02:5e:29:0e:a3:af:4e:72:9d:a4:fe:0d:cb:5d:83:07 (RSA) | 256 41:e1:fe:03:a5:c7:97:c4:d5:16:77:f3:41:0c:e9:fb (ECDSA) | 256 28:39:46:98:17:1e:46:1a:1e:a1:ab:3b:9a:57:70:48 (ED25519) 80/tcp open http syn-ack ttl 63 nginx 1.14.0 (Ubuntu) |_http-favicon: Unknown favicon MD5: 1575FDF0E164C3DB0739CF05D9315BDF |_http-title: Late - Best online image tools | http-methods: |_ Supported Methods: GET HEAD |_http-server-header: nginx/1.14.0 (Ubuntu) ``` ### Mannual Analysis ``` • email → support@late.htb • added images.late.htb and late.htb to /etc/hosts • designed by “kavi.gihan” • I used Whatweb to identify what services the web application is using and got : root@Offsec:~/Desktop/machine# whatweb http://late.htb http://late.htb [200 OK] Bootstrap[3.0.0], Country[RESERVED][ZZ], Email[#,support@late.htb], Google-API[ajax/libs/jquery/1.10.2/jquery.min.js], HTML5, HTTPServer[Ubuntu Linux][nginx/1.14.0 (Ubuntu)], IP[10.10.11.156], JQuery[1.10.2], Meta-Author[Sergey Pozhilov (GetTemplate.com)], Script, Title[Late - Best online image tools], nginx[1.14.0] root@Offsec:~/Desktop/machine# whatweb http://images.late.htb http://images.late.htb [200 OK] Bootstrap, Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.14.0 (Ubuntu)], IP[10.10.11.156], JQuery[3.4.1], Script[text/javascript], Title[Image Reader], X-UA-Compatible[ie=edge], nginx[1.14.0] ``` #### I visited “images.late.htb” ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FQCKA2pS8Y8mCJ6UCVNXL%2Fwebinterface.png?alt=media\&token=cdf6cfb4-014a-4a40-9a09-9948eb058acf) #### It looks like we can upload images on the site .. I uploaded a simple a simple image First and some malicious also but this is not that vulnerablity which I was thinking of. I reaserched online and got that this type of vulnerability call SSTI (Server Side Template Injection) / from Here I used the this screenshot to upload to the server .
![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2F9rRsgVGki8BMuXTMQV9I%2Fpayload.png?alt=media\&token=4b9bb777-52a1-483b-91c6-ab6c3e322b43) and boom!! magic we got our maths calculated . ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2Fk8UyvMwW33XWjnLV3bDc%2Fresults1.png?alt=media\&token=34f2e0fe-bfb6-4a9f-af46-f6285c6ac6fe) And after turning off the intercept from burp and moving to the webpage we will be awarded with a “results.txt” file. ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FfIXghCG2CZ2jb7FA0ZZa%2Fresults_txt.png?alt=media\&token=47963eab-fa37-487f-822e-9c18b4b9553c) which contains the same data which we get from repeater . ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2F0VN0mu7hgr2UlsZY9Z90%2Fresults.txt.png.png?alt=media\&token=7ee8c660-889a-4e45-8eba-0b31b373b4ea) So, This is the time to move Forward with this attack . Now I used This :thumbsup: ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2F7ZDfUFAG2Vt1Twwy7vh8%2Fpat11.png?alt=media\&token=81ec6ff3-2ea6-49d3-a590-2c75ddd0dd12) to see if we can read the content of passwd file and we succeded. ``` root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin syslog:x:102:106::/home/syslog:/usr/sbin/nologin messagebus:x:103:107::/nonexistent:/usr/sbin/nologin _apt:x:104:65534::/nonexistent:/usr/sbin/nologin lxd:x:105:65534::/var/lib/lxd/:/bin/false uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin pollinate:x:109:1::/var/cache/pollinate:/bin/false sshd:x:110:65534::/run/sshd:/usr/sbin/nologin svc_acc:x:1000:1000:Service Account:/home/svc_acc:/bin/bash rtkit:x:111:114:RealtimeKit,,,:/proc:/usr/sbin/nologin usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin avahi:x:113:116:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin cups-pk-helper:x:114:117:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin saned:x:115:119::/var/lib/saned:/usr/sbin/nologin colord:x:116:120:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin pulse:x:117:121:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin geoclue:x:118:123::/var/lib/geoclue:/usr/sbin/nologin smmta:x:119:124:Mail Transfer Agent,,,:/var/lib/sendmail:/usr/sbin/nologin smmsp:x:120:125:Mail Submission Program,,,:/var/lib/sendmail:/usr/sbin/nologin ``` after this I thought Can we Get Any Private SSH keys to get initial foothold on the machine. and use this :thumbsup::thumbsup: ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FlQRDgoDr6yFRZ9p9v1IO%2Fpat13.png?alt=media\&token=c9763870-4f5b-4d30-8a1c-05aa4ff45f0d) and got : ``` -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAqe5XWFKVqleCyfzPo4HsfRR8uF/P/3Tn+fiAUHhnGvBBAyrM HiP3S/DnqdIH2uqTXdPk4eGdXynzMnFRzbYb+cBa+R8T/nTa3PSuR9tkiqhXTaEO bgjRSynr2NuDWPQhX8OmhAKdJhZfErZUcbxiuncrKnoClZLQ6ZZDaNTtTUwpUaMi -----------------Sorry I can't Show The Whole Key----------------------- -----END RSA PRIVATE KEY----- ``` ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2F8MSGHnctKLmEh7kRGvUw%2Ffoothold.png?alt=media\&token=3a704237-d26a-49a0-941e-bb1b017914f9) ### Now time to Escalate Our Privs: I used Linpeas after hard manual Try and Got ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FzJuWaLaXBv18Pefsk9Sb%2Flinpeas.png?alt=media\&token=21b165b4-863a-4e1d-a0f3-73d34d09b6fe) this is a script which is owned by root . After Looking at the script content I got That this Script runs every time anyone Logins through SSH . ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FpLl9AkoRn6CVx3p2qIxV%2Fpriv1.png?alt=media\&token=0849a80a-afb5-4104-a325-6db0f98e2078) That is Good News For Us So Let's Write Something Malicious to it . I tried to overwrite it but failed But I was able to append data to it Soo........ ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FuNasVTg8zJRjGGng96MX%2Fpriv2.png?alt=media\&token=0987e046-8ead-478c-9408-6d3e1f5ac52a) after this , logging in to the machine from other terminal. and Lets Move to /tmp Directory to see If we got Success or not ?? Ohh Yaahhh !!! BOOoom #------Bling Bling-------- We are success!!! ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FkG5EH6hYSOZF9GTrHjpi%2Fpriv3.png?alt=media\&token=e72eecee-24dd-4f2a-8899-8d13e8d723bb) the dash file is here so It's time to become The All Mighty “ROOT” ![](https://794785868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5HSSdz0o2gP99PtxMWiZ%2Fuploads%2FmVQzi4ENiaawePPsm9Ej%2Fpriv4.png?alt=media\&token=1934ebc8-9e80-49d7-ae53-0a41e0fd2a93) \==========================================================