So WTF is monitorwaldowaldo about then Notice how when we sshd in, we got a Welcome to Alpine Wiki message.

Home Knowledgebase You are here: Home Penetration Testing HackTheBox: Waldo Walkthough HackTheBox: Waldo Walkthough 2018-09-11 by Neil Leave a Comment Initial Enumeration So we have a linux box with 2 open ports and a filtered port.

Lets check out the ports in turn: 22OpenSSH 7.5p2 Not much use at this stage.

If you click Add List, a list is added and given the next number in the the sequence.

Brute Force Ssh 5720.Py Code For That

Viewing the page source we can see it uses a Javascript function called list.js and we can look at the code for that.

Here is some of it: Im no Javascript expert but I can see some php files being called: fileWrite.php and fileDelete.php etc and a POST request is being used.

Time to fire up Burp Suite to intercept and analyse these requests.

Using FoxyProxy to make switching traffic to Burp easy, turn on Intercept and try the Add List button: As suspected that button sends a POST request using the fileWrite.php which is in the root web folder.

We can specify the listnumber with the listnum parameter and even add data to it using the data parameter If we click on one of the lists on the screen we see another php file called fileRead.php To speed up this discovery process, I just try clicking every possible option, knowing that Burp will store the results in the Site Map: Also worth noting here is that the dirRead.php refers to a directory:.list What do we know about this web app so far: In the root directory 10.10.10.84 we have: list.html list.js dirRead.php fileDelete.php fileRead.php fileWrite.php And there is a directory.list which we dont have permission to access.

We can alter the parameters being sent to via the POST requests.

Using Repeater I use the fileWrite.php function to create list 99 just to see if I can, and add some arbitrary data to it.

Then I see if I can see if I can find it using dirRead.php, which I can.

I can also read the file itself using fileRead.php.

Unfortunately writing php code into the list file doesnt execute so no easy shell there.

This is likely because Im using a php function to read the file rather than GETting it which would trigger the PHP interpreter.

The list files, including my list99 are being stored in 10.10.10.87.list which is not accessible by the browser or other GET request mechanisms.

However all is not lost because whilst I cannot render PHP, that means I can read PHP source code and so lets look at these files, starting with the fileRead.php itself: The php source code is being mangled.

I dont know if there is an elegant way of sorting this out but I used Words find and replace function to replace the escape characters to swap these: n newline t tab and got this far: My PHP isnt great so this could be wrong but its clear there is some filtering going on to stop you from just browsing for files easily.

Straight away we can see that its not going to let you read the user.txt file And then it looks like its deleting.

After messing around with it for a file I hit upon the idea of using.

There are several files in there:.,.,.ashhistory,.ssh,.viminfo,user.txt We know we cannot read user.txt but in.ssh directory there are very interesting files, not least the.monitor file containing an private RSA key: SSH allows authenticating via publicprivate key pairs instead of passwords.

The private key is the one required by the ssh client so we should be able to use this to ssh in.

After running it through that I get: -----BEGIN RSA PRIVATE KEY-----.

So now to paste that into a key file, set the permissions of the file to secure it (ssh requires this) and see if it works: Were in Lets grab the user.txt file to paste into the HTB system and move on.

In the.ssh folder there is an authorizedkeys files containing a reference to a user called monitor: This is confusing.

I would assume that the nobody key is authorised (or how else did it work) and yet this file only has one key and it mentions monitorwaldowalso.

Weird. And why waldowaldo when the machine is called waldo Im going to check that this is the key we just used, just to be sure.

Brute Force Ssh 5720.Py Keygen To Generate

The easiest way is to use the ssh keygen to generate a public key from the private key we have and see if it matches this one in the authorizedkeys file: rootkali:HTBWaldo ssh-keygen -y -e -f key.