Hack The Box — PopCorn
Hey folks, today we have the first medium retired machine from Hack The Box, and it’s called PopCorn. Before we get started let’s take a look at its info
It’s good one and seems like Real Life challenges.
Nmap Scan
Let’s start our scan with nmap scan to know what’re open ports we have and where we will start our enumeration
nmap -A -T4 -oG popcorn.gnmap 10.10.10.6 | tee -a nmap
Good, we have 2 open ports 80 and 22 so let’s start from the website
Website Enumeration
we don’t have any useful information here so let’s try to brute force the directories by using gobuster
gobuster dir -u 10.10.10.6 -w /path/to/wordlist -l | tee -a gobuster
We have /torrent directory, let’s check it
good we have Torrent Hoster webpage. At the end of this page
It depends on Torrent Hoster and after searching for it
I’ve found that it’s vulnerable by remount upload vulnerability, let’s check its details
we have the vulnerable link, let’s check if it’s valid in our case or not
It’s valid, but it requires us to be authenticated, so I’ve created an account for me, and you can create one also, it’s easy
User flag
After login as a normal user, we have an upload function
I’ve checked it with more than way, but it’s not vulnerable, and it accepts only .torrent files.
After uploading any test torrent file, I’ve found that I can upload an image as a screenshot related to the torrent file.
Let’s try to exploit it
I’ll upload a file with extension .php.png
And I’ll intercept it and change the extension to .php
You can get this reverse_shell file from pentestermonkey github account
and the result is
It works, good
Let’s access the /upload directory
We have our file here, we need to open 4444 port using nc by typing nc -lvp 4444 and then open our shell file
We have a shell now, and we can open the user flag
Root flag
I’ve used linux-exploit-suggester script from GitHub to check for any kernel exploits which may lead us to be root
and the results are
Awesome, we have a bunch of kernel exploits.
You can use anyone of them, and it will work, I’ve select rds and after get it to my box by using wget command and open my kali as web server and also compiling it by using gcc as you can see, it opens a root shell, it works :)
And now we have the root flag ❤
