# Academy ~ Hack The Box

* * *

### Prerequisite

![Academy ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985617039/c655cb07-3533-4142-ad28-59d0f868487f.jpeg)

Just to make life easier I usually add an entry in my hosts file for easier access of the target machine.

    echo "10.10.10.215	academy.htb" >> /etc/hosts

hosts file entry

![Academy ~ Hack The Box](/content/images/2021/02/image-67.png)

Okay now onto the hacking!

* * *

### Reconnaissance

As always, I started off with an NMAP scan against the machine.

     nmap -Pn -sC -sV -A -p- -oN initial academy.htb

    ┌──(root💀kali)-[/home/…/boxes/htb/machines/academy]
    └─# nmap -Pn -sC -sV -A -p- -oN initial academy.htb
    Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
    Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-10 16:54 EST
    Nmap scan report for academy.htb (10.10.10.215)
    Host is up (0.0037s latency).
    Not shown: 65532 closed ports
    PORT      STATE SERVICE VERSION
    22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey: 
    |   3072 c0:90:a3:d8:35:25:6f:fa:33:06:cf:80:13:a0:a5:53 (RSA)
    |   256 2a:d5:4b:d0:46:f0:ed:c9:3c:8d:f6:5d:ab:ae:77:96 (ECDSA)
    |_  256 e1:64:14:c3:cc:51:b2:3b:a6:28:a7:b1:ae:5f:45:35 (ED25519)
    80/tcp    open  http    Apache httpd 2.4.41 ((Ubuntu))
    |_http-server-header: Apache/2.4.41 (Ubuntu)
    |_http-title: Hack The Box Academy
    33060/tcp open  mysqlx?
    | fingerprint-strings: 
    |   DNSStatusRequestTCP, LDAPSearchReq, NotesRPC, SSLSessionReq, TLSSessionReq, X11Probe, afp: 
    |     Invalid message"
    |_    HY000
    

### Scanning & Enumeration

Based on the scan that was run, I realized that port 80 was running a web server. This was the web app that was being served!

![Academy ~ Hack The Box](/content/images/2021/02/image-68.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-69.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-71.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-70.png)

When registering, I realized that I was given a `roleid` which was set to `0` by default.

![Academy ~ Hack The Box](/content/images/2021/02/image-72.png)

Initial enumeration also revealed that there was an `admin.php` page available. Accessing the `admin.php` page just threw me another login page.

![Academy ~ Hack The Box](/content/images/2021/02/image-73.png)

I wasn't able to login to the page with the account which I created using the register page.

### Exploitation

The first step I took was to intercept my account registration request and change my `roleid` to 1. This enabled me to login to the admin page.

![Academy ~ Hack The Box](/content/images/2021/02/image-74.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-75.png)

From this I was able to gather a bunch of information

*   Possible user accounts = `cry0l1t3` & `mrb3n`
*   Possible staging server = `dev-staging-01.academy.htb`

The next thing I did was to add an entry in the hosts file to the newly found domain as I didn't not have a domain name server that pointed that name to the target IP

    echo "10.10.10.215	dev-staging-01.academy.htb" >> /etc/hosts

hosts file entry

![Academy ~ Hack The Box](/content/images/2021/02/image-76.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-77.png)

Heading to the newly found staging domain reveals the app that's driving the solution. I was able to find a POC [exploit](https://github.com/aljavier/exploit_laravel_cve-2018-15133) for this particular app with couple google searches.

    ┌──(root💀kali)-[/home/…/htb/machines/academy/exploit_laravel_cve-2018-15133]
    └─# python3 pwn_laravel.py http://dev-staging-01.academy.htb dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0= --interactive
    

![Academy ~ Hack The Box](/content/images/2021/02/image-78.png)

That got me a reverse shell into the target machine :)

### Lateral Movement

I knew that the target was running Laravel. Therefore, I tried looking for crucial config files that a default Laravel install might have.

> All the environment variables are declared in the .env file which includes the parameters required for initializing the configuration.

I went ahead and used the `find` command to help locate these config files.

    find / -name "*.env"
    

![Academy ~ Hack The Box](/content/images/2021/02/image-79.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-80.png)

Looking into the contents of the file revealed a set of credentials. I poked around and used these credentials on the possible user account I found earlier.

![Academy ~ Hack The Box](/content/images/2021/02/image-82.png)

Successful Lateral Movement

I was able to successfully gain access to one of the two accounts and grab the user flag.

However, I needed to move into the other possible user that I uncovered earlier as this account didn't have any `sudo` privileges.

![Academy ~ Hack The Box](/content/images/2021/02/image-83.png)

At this point I had exhausted all my manual enumeration techniques and I turned to `Linpeas` for assistance.

I quickly spun up a python http server, transferred `Linpeas` over to the target machine and ran it.

![Academy ~ Hack The Box](/content/images/2021/02/image-84.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-85.png)

Thankfully, `Linpeas` was able to dig through the logs for me and point out that the potential user I found earlier was actually valid. It also returned the password for that user~

    mrb3n:mrb3n_Ac@d3my!

![Academy ~ Hack The Box](/content/images/2021/02/image-86.png)

### Privilege Escalation

The privilege escalation on this last user was pretty straight forward. The user was allowed to run composer with root privileges.

![Academy ~ Hack The Box](/content/images/2021/02/image-87.png)

Thankfully, there was an existing [GTFObin](https://gtfobins.github.io/gtfobins/composer/) for it!

![Academy ~ Hack The Box](/content/images/2021/02/image-88.png)

![Academy ~ Hack The Box](/content/images/2021/02/image-89.png)

ROOTY!