‘Buff’ machine write-up from HackTheBox

Buff Machine Write-up

Machine Information

• Name: Buff
• IP Address: 10.129.2.18
• Difficulty: Easy
• OS: Windows

Enumeration

Initial Scan

We start with ZedScan, which is a custom recon tool I built to run multiple scans in parallel.

ZedScan by Me

Only one port is open: 8080 HTTP. No SMB, no subdomains. ZedScan also surfaces some directories worth investigating, so we follow those.

1.0

Browsing the web application reveals the software behind it: Gym Management System 1.0.

That version has a known Unauthenticated RCE vulnerability. No credentials required here.

Exploitation

• Vulnerability: Unauthenticated RCE in Gym Management System 1.0
• Exploit: Public exploit script, modified to route traffic through Burp Suite

We grab the script, read through it, and add our Burp proxy before running it.

Burp

Requests are now visible in Burp. We notice the parameter is set to $_GET["telepathy"], which won’t handle file uploads. We change it to $_REQUEST["telepathy"] to support POST requests as well.

We are in

Script runs. We have a shell, but it’s a basic webshell. It’s not enough to work comfortably, so we need to upgrade it.

We are in 2.0

We serve Netcat from our attacker machine using a Python HTTP server, pull it down on the victim with curl, and catch a full reverse shell.

user.txt

And with some directory surfing we found User flag in Shaun’s Desktop.

Privilege Escalation

Now, we check which ports are listening locally.

8888?

Interesting Ports:

• 3306/tcp MySQL
• 8888/tcp Unknown

CloudMe

Looking around the filesystem, we find CloudMe version 1.11.2 sitting in the Downloads directory. CloudMe runs on port 8888 by default.

CVE-2020–37070

A quick search confirms it, CVE-2020–37070, a Buffer Overflow vulnerability leading to RCE. Looks like that’s our way up!

chisel me this

CloudMe is only listening on localhost, so we can’t reach it from Kali directly. We use Chisel to forward port 8888 from the victim to our attacker machine.

Exploit

With the port now accessible locally, we take the public exploit script, generate a custom payload using msfvenom, and swap it in.

We run the script.

We are in 3.0

Viola, in less than a second we’re in with Administrator privileges.

root.txt

Root flag obtained.

A service running on localhost isn’t safe just because it’s not internet-facing. Once you’re on the box, internal ports become your attack surface too.

See you on the next one. Peace