> For the complete documentation index, see [llms.txt](https://akshaydeepakshinde.gitbook.io/hackthebox-linux/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://akshaydeepakshinde.gitbook.io/hackthebox-linux/hackthebox-dab.md). # HackTheBox - Dab ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYocqx0-ezpWFVtJHMX%2F-MYodHNAV6S1aMdHbsS-%2Fimage.png?alt=media\&token=0c8d2013-ccfb-4c68-ae03-ce5d994c0efa) ### Nmap scan results (Basic and all port scan) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYocqx0-ezpWFVtJHMX%2F-MYodPLQbENGwxvgHJIo%2Fimage.png?alt=media\&token=dbab5ec0-6294-4d47-8e02-67ee0e9ce938) ### Using gobuster to scan the webpage on port 80 and 8080 ``` gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://dab.htb/ -o gobuster-80-scan.out # cat gobuster-80-scan.out /login (Status: 200) [Size: 473] /logout (Status: 302) [Size: 209] [--> http://dab.htb/] ``` ``` gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://dab.htb:8080/ -o gobuster-8080-scan.out # cat gobuster-8080-scan.out /socket (Status: 200) [Size: 287] ``` ### Bruteforcing the login page on port 80 ``` hydra -l admin -P /opt/SecLists/Passwords/Common-Credentials/10k-most-common.txt 10.10.10.86 http-post-form "/login:username=^USER^&password=^PASS^&submit=Login:Error: Login failed." ``` ### Testing the webpage on port 8080 The root page shows the following error. `Access denied: password authentication cookie not set` I created a wordlist using the word `password` and `authentication` in it. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYocqx0-ezpWFVtJHMX%2F-MYog7TIiB0DOaAFAAKW%2Fimage.png?alt=media\&token=50e5d4ff-16e3-4e76-baaa-9ce626b5b339) We will use the Burp's Suite Intruder Tab to FUZZ the cookie name. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYocqx0-ezpWFVtJHMX%2F-MYogWuULA-YvvyXtktv%2Fimage.png?alt=media\&token=f12c4c26-f8ca-4db7-ad7c-d515e57782a5) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYocqx0-ezpWFVtJHMX%2F-MYogZ6uPJeUghHEXcOM%2Fimage.png?alt=media\&token=4bb9f903-5c7e-4e72-9998-50bd339638cd) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYocqx0-ezpWFVtJHMX%2F-MYoggdq1weaBHgejtID%2Fimage.png?alt=media\&token=0fd6128e-3ea3-437c-9cf1-fc25c36c0bf4) Now let's fuzz the value for cookie using wfuzz. ``` wfuzz -c -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt --hw 29 -u http://dab.htb:8080/ -b 'password=FUZZ' ``` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYohivRo0266KkR2cxd%2F-MYohtetQ9Zz0uUbzcPR%2Fimage.png?alt=media\&token=8ec1a07b-706e-4a2a-8dcd-282f70a62725) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYohivRo0266KkR2cxd%2F-MYoi1lkW8WdG9xZBQl6%2Fimage.png?alt=media\&token=08b277f6-ebee-4edf-8e03-a96580e7e01e) ### Searching for open ports (SSRF Fuzzing) ``` ffuf -w ports.txt -u "http://dab.htb:8080/socket?port=FUZZ&cmd=localhost" -b 'password=secret' -c ``` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYohivRo0266KkR2cxd%2F-MYoitPmxRgkkBvPMPdM%2Fimage.png?alt=media\&token=57f7b1c2-86c3-4648-962a-34b37a8e283c) ### Pentesting Memcache (Running on port 11211) {% hint style="info" %} **Memcached** is an open-source distributed memory object caching program that allows us to improve and speed up the performance of dynamic web applications by caching data and objects in Memory. **Memcached** is also used to cache entire database tables and queries to improve the performance of the database. {% endhint %} **References**: ```bash #Commands to be used stats version stats slabs stats items stats cachedump 0 get ``` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYok-7Jn2PaEVubgVv3%2Fimage.png?alt=media\&token=e0b9a43d-ea6e-4ceb-8b8e-acfb9c55f70b) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYok2GTDy3UWgSFL66w%2Fimage.png?alt=media\&token=a583a9e8-3162-442a-b4c6-a50dad25e145) **Getting slabs** ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYokIss8LTV_cXx5Jp0%2Fimage.png?alt=media\&token=b413d309-d716-43b3-909c-3c733859815b) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYoke3iZ_iclG0UyAYN%2Fimage.png?alt=media\&token=a347d2ff-362a-4dc4-8a93-b0d2afd7ed3d) **Getting items with info** ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYokn627vPiIQDX1Jx6%2Fimage.png?alt=media\&token=143de2b1-c932-412e-898d-34182674d66b) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYokq-9vK59W3PNDTdP%2Fimage.png?alt=media\&token=eedc4ea3-8ed9-4856-af92-d7c79d50d8b5) **Getting key names ( 0 is for unlimited output)** ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYolEYRVeGryYNVgPsy%2Fimage.png?alt=media\&token=c5ce26f4-20ad-499d-8ceb-627c93d6cd10) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYolH_JOhC--d4ZKLHH%2Fimage.png?alt=media\&token=cfc3dcfc-7921-4fb0-9f80-877a515aba39) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYolLjHXnMraO3YWwEJ%2Fimage.png?alt=media\&token=fd63aa41-79a2-4b78-9479-b16a5c736626) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYolP16LaB-eWkKyymr%2Fimage.png?alt=media\&token=9e90067b-efb3-4657-91d0-9ad5106d70ac) To get the users `ITEM`, we can use the `get users` command. If we use the following command, we won't get any data. This is because of no cache generated recently. Let's logout and login again and then try to get the data. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYommZk4xpb9s11xb0g%2Fimage.png?alt=media\&token=4cfff2d1-3115-4461-ae1c-3d13461b3127) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYompbtrueq2b3dyKCQ%2Fimage.png?alt=media\&token=e48625b4-8338-48a6-af5f-bf5e099be46d) ### Hash cracking using John Let's get this data and apply some BashFu skills to organize the data. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYonENvs0uL5agPQZeV%2Fimage.png?alt=media\&token=6978040d-0470-4344-8178-896d94942377) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYou_-2tREu-TCAz0zq%2Fimage.png?alt=media\&token=58ac5a2b-551d-403c-ab65-42da59adae61) Bash command used: `cat users.json | jq | awk -F\" '{print $2,$4}' | sed -r 's/ /:/g' > userpass.txt` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYouyV5Z8Ym-UUuLuMu%2Fimage.png?alt=media\&token=6a0d2d92-9989-4ac2-bdd6-3e0cfe433c0b) ### Bruteforcing SSH using hydra ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYovdhRI3dMTj5lUvEU%2Fimage.png?alt=media\&token=e833439b-2717-426e-a290-6ee32b3ce0b4) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYovrlBTfifMZA9LRym%2Fimage.png?alt=media\&token=3bc21cdd-60e2-40bd-9da0-662d1f6f4e0d) ### Using find command to search for SUID files ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYowKiNcbIBC6Gvfmd9%2Fimage.png?alt=media\&token=d9ae0cc5-e9fb-4022-ae2e-53adc9c951d2) `/usr/bin/myexec` looks suspicious, we can get that file using netcat. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYowgUXZ3gxufFsMfkE%2Fimage.png?alt=media\&token=fc4c8a2c-5a17-4706-98fd-51a6ea5e2561) ### Analyzing the *myexec* binary in Ghidra **Main Function:** ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYox9KQhSNIE9zk5vGr%2Fimage.png?alt=media\&token=913fbe40-26ad-4334-949d-5c9ab52c407f) To get the password stored, decode the hex value and the string that we get is `s3cur3l0g1n` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYoxmPTJaaTSaSh72lU%2Fimage.png?alt=media\&token=66540306-6bc1-4b85-b13a-465d2760567f) ### Creating a malicious library to hijack seclogin() So the `seclogin()` function isn't created yet, so this looks like a library hijacking binary. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYoyG_Y2_fMFrxrc2Xa%2Fimage.png?alt=media\&token=e4e8ef00-6cc9-418d-85e8-10690080885b) So the seclogin function is present in libcseclogin.so file, one can use `strings` on that binary or `readelf` to check. Let's create a malicious library. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYozZBle8Jl2TGu1x1y%2Fimage.png?alt=media\&token=172931d8-918a-47b1-837b-8db3d9607313) We can run ldconfig file as root, so let's do that. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYozkRNMpF2mf9gXaa-%2Fimage.png?alt=media\&token=22c23f29-d1c8-467b-9ca4-e09117b023d6) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYoj8jznDrmuvocQJ2J%2F-MYoztra2kZmDYGZXOKe%2Fimage.png?alt=media\&token=7890faf8-ce42-4cd8-a4e5-a6f711f31cc7)