User Flag

First, the server returns a weird header named x-backend-server with the value office.paper.

This could’ve been found using Burpsuite or simply the browser’s Devtools, but I noticed it when I used Nikto.

After adding office.paper to my /etc/hosts file, I took a look at the website. From the look and feel of it, I could already tell that it was probably a Wordpress website, but just to be sure, I looked at /wp-login, which confirmed me the website was indeed using Wordpress.

I then started wpscan to look for known vulnerabilities, either in Wordpress itself or in the plugins. For the API token, you can generate one for free at https://wpscan.com/register.

Apparently this WordPress version is vulnerable to CVE-2019-17671 which allows us to see a user’s private posts (https://wpscan.com/vulnerability/3413b879-785f-4c9f-aa8a-5a4a1d5e0ba2).

Indeed, we can see the user’s private posts which include a link to register to a chat for the employees.

After I logged into Rocket Chat, I saw a general conversation, which I took a look at.

the employees were chatting about a bot that reads files and lists directories for you.

So I wrote a private message to the bot and indeed it listed me the content of the current directory.

I tried the most obvious thing I could think of, and checked to see if I could read the content of the user’s ssh keys, but there were none. With no way to execute commands on the server, I couldn’t generate some either.

After looking around for a bit, I discovered the path ../hubot/scripts which contains the bot’s source code.

Looking at the content of the cmd.coffee script, it looks like the bot has a secret functionality that lets us execute code.

And when I tried it with cmd echo hello and the bot returned with hello. (There seemed to be a bug so the bot ran 2 times my commands, but I was too lazy to restart the machine)

I then ran a simple bash reverse shell.

And I caught the reverse shell using metasploit’s multi handler.

Root Flag

While I did have a reverse shell on the machine, I preferred to generate some private and public ssh keys for the user so that I could connect to the machine via ssh instead. That would make the job easier since our reverse shell would be much more stable and easier it would be easier to regain access in case our session terminates.

So first I generated the private and public ssh keys.

ssh-keygen -t rsa -N '' -f /home/dwight/.ssh/id_rsa

I then copied the value of the public key into authorized_keys to allow me to authenticate to the machine using the private ssh key.

cp /home/dwight/.ssh/id_rsa.pub /home/dwight/.ssh/authorized_keys

Finally, I copied the value of the private ssh key.

cat id_rsa

With all of that done, I could authenticate to the server using ssh.

┌─[✗]─[h3dg3h0g@parrotOS]─[~/Desktop/HackTheBox/Machines/EASY/Paper/ssh]
└──╼ $ssh dwight@paper.htb -i id_rsa 
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Tue Feb  1 09:14:33 2022 from 10.10.14.23
[dwight@paper ~]$

For the privesc part, I like to use linpeas.sh for the discovery. I transferred it into the box by creating a python webserver on my machine and then downloading the file on the server using wget.

Right at the beginning of the script, linpeas.sh told me that the machine is probably vulnerable to CVE-2021-3560.

╔══════════╣ CVEs Check
Vulnerable to CVE-2021-3560

Finally, I found an exploit on exploit-db for this CVE (https://www.exploit-db.com/exploits/50011). I had to run it a couple of times for it to work, but I still ended up getting a root shell.

[root@paper hacked]# id
uid=0(root) gid=0(root) groups=0(root)