{"id":214,"date":"2025-07-12T18:50:00","date_gmt":"2025-07-12T18:50:00","guid":{"rendered":"https:\/\/thecyberstaff.com\/?p=214"},"modified":"2025-12-28T19:35:41","modified_gmt":"2025-12-28T19:35:41","slug":"sau-hackthebox-lab","status":"publish","type":"post","link":"https:\/\/thecyberstaff.com\/?p=214","title":{"rendered":"Sau- Hackthebox lab"},"content":{"rendered":"\n<p class=\"has-text-align-center\">I started the assessment with Nmap port scans against all TCP and the top UDP ports.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"714\" height=\"547\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712121720.png\" alt=\"\" class=\"wp-image-441\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712121720.png 714w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712121720-300x230.png 300w\" sizes=\"auto, (max-width: 714px) 100vw, 714px\" \/><\/figure>\n\n\n\n<p>On TCP port 55555, I found this service called request-baskets. I found a public exploit with SSRF (Server side request forgery). I started enumerating the exploit and was able to use the web UI of the service to forward it to port 80 to enumerate the service open. I was not able to access port 80 without this flaw so this was helpful to move forward.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"445\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122038-1024x445.png\" alt=\"\" class=\"wp-image-442\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122038-1024x445.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122038-300x130.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122038-768x334.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122038.png 1254w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"344\" height=\"77\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122215.png\" alt=\"\" class=\"wp-image-443\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122215.png 344w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712122215-300x67.png 300w\" sizes=\"auto, (max-width: 344px) 100vw, 344px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">I created a new basket and removed all security possible fording the request to 127.0.0.1:80 to interact with port 80 on the target box.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"330\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712130005-1024x330.png\" alt=\"\" class=\"wp-image-444\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712130005-1024x330.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712130005-300x97.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712130005-768x248.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712130005.png 1386w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"595\" height=\"380\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712132824.png\" alt=\"\" class=\"wp-image-445\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712132824.png 595w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712132824-300x192.png 300w\" sizes=\"auto, (max-width: 595px) 100vw, 595px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">I was able to load the web page by loading the basket URL successfully accessing port 80.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"664\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712133315-1024x664.png\" alt=\"\" class=\"wp-image-446\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712133315-1024x664.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712133315-300x195.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712133315-768x498.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712133315.png 1375w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">Now that I can see the Maltrail version 0.53, I was able to find a public exploit. <a href=\"https:\/\/github.com\/spookier\/Maltrail-v0.53-Exploit\">https:\/\/github.com\/spookier\/Maltrail-v0.53-Exploit<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"677\" height=\"76\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712134426.png\" alt=\"\" class=\"wp-image-447\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712134426.png 677w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712134426-300x34.png 300w\" sizes=\"auto, (max-width: 677px) 100vw, 677px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">I was able to get a shell as the puma user with this exploit<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"546\" height=\"161\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712134444.png\" alt=\"\" class=\"wp-image-448\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712134444.png 546w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712134444-300x88.png 300w\" sizes=\"auto, (max-width: 546px) 100vw, 546px\" \/><\/figure>\n\n\n\n<p>I ran sudo -l to see if the user has any sudo privileges.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"609\" height=\"86\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712135034.png\" alt=\"\" class=\"wp-image-451\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712135034.png 609w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712135034-300x42.png 300w\" sizes=\"auto, (max-width: 609px) 100vw, 609px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">Enumerating further, I found the version of systemd has a local privilege escalation vulnerability. <a href=\"https:\/\/ubuntu.com\/security\/CVE-2023-26604\">https:\/\/ubuntu.com\/security\/CVE-2023-26604<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"378\" height=\"149\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712135200.png\" alt=\"\" class=\"wp-image-449\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712135200.png 378w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250712135200-300x118.png 300w\" sizes=\"auto, (max-width: 378px) 100vw, 378px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">I found that I was able to run the &#8220;sudo systemctl status trail.service&#8221; command, then while inside the reading interface enter &#8220;!sh&#8221; and get a root shell!<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I started the assessment with Nmap port scans against all TCP and the top UDP ports. On TCP port 55555, I found this service called request-baskets. I found a public exploit with SSRF (Server side request forgery). I started enumerating the exploit and was able to use the web UI [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":215,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-214","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-pentesting"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=214"}],"version-history":[{"count":2,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/214\/revisions"}],"predecessor-version":[{"id":452,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/214\/revisions\/452"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/media\/215"}],"wp:attachment":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}