CozyHosting is a seasonal machine.

• Difficulty: Easy
• OS: Linux
• Creator: commandercool

In this walkthrough, important information such as hashes, passwords, etc. are censored (the length of the censored information cannot correspond to the real length of the information)

Enumeration

Nmap

Nmap scan results are pretty useless, cause the results show that only ports 22 and 80 are opened.

nmap cozyhosting.htb
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-09 02:01 CEST  
Nmap scan report for cozyhosting.htb (10.10.11.230)  
Host is up (0.059s latency).  
Not shown: 998 closed tcp ports (conn-refused)  
PORT STATE SERVICE  
22/tcp open ssh  
80/tcp open http

Website analysis

The first thing you can see is the Login button, when you click it, you will be redirected to a login form.

I opened the dev tools and inspected the cookies, but nothing seemed to be present.

So I tried to log in with random credentials and a cookie will be created.

JSESSIONID... I did some research and found immediately that this website is using Spring.

DirBuster

At this point, I used DirBuster with a wordlist specific to Spring websites. An interesting URL appears in the URLs list: cozyhosting.htb/actuator

Bypass

I did some research on what is actuator, I found this link. While exploring the endpoints, I found what we are searching for: http://cozyhosting.htb/actuator/sessions

As you can see on these endpoints, we can get the cookie value of the user kanderson. So if we replace our cookie value with this and refresh the login page... we are in!

Reverse shell

In the admin panel, there is a form.

So I opened BurpSuite and started making some attempts.

As you can see, if we leave the username blank, an interesting thing happens.

I started making some tries, and after various research, I found a way to bypass spaces (${IFS}) and a payload to get a reverse shell.

So using the payload below, you can get a reverse shell. You have to replace base64Payload with the reverse shell code, you can obtain this code already in base64 format using the Reverse Shell Generator.

Clearly, before submitting the payload above, you have to open a listener on your local host.

If you have a firewall running on your computer, remember to disable/configure it.

Stabilize shell

We get our shell! Now we are user app and we are connected to the remote host. But we want to stabilize our shell to make it easy to use. I found this tutorial.

Python server

First, run the command ls. Did you find something strange?

We see that a jar file is here, We want to inspect it, so using python we can start an HTTP server and download the file on our host.

From our browser now we connect to http://cozyhosting.htb:8086.

Click on the file and it will be downloaded on your PC.

Postgres

If we extract the cloudhosting-0.0.1.jar and inspect it, we encounter a file: application.properties in which we found Postgres credentials.

So from the remote host shell, we can connect to the Postgres database using what we found using the command below.

Inspect the db

You can use a Postgres Cheatsheet to find all the commands you need.

Basically, you have to do \dt; to find tables present in the database and then SELECT * FROM users; to take all the records of the user table.

You will find two hashed passwords, only the admin password is crackable.

Hash Cracking

To crack the hash we use john, we put the admin hash in a file named hash.txt and we use the rockyou.txt wordlist

When john has finished, we use

the password will be printed in our terminal.

SSH

Using the command

we can obtain the list of the users. We see the user josh, we can try to log in using ssh.

User flag

Using ls we see the user.txt file.

Escalation

First, we make the command sudo -l

we can see that user josh can run the ssh command as root. I made research on GTFOBins I found an exploit

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access. Spawn interactive root shell through ProxyCommand option. sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x

Root flag

Now using the command cd /root we go to the folder where root.txt is located.