chu@antisec:~/htb$ cat spectra.md

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.1 (protocol 2.0)
| ssh-hostkey:
|_  4096 52:47:de:5c:37:4f:29:0e:8e:1d:88:6e:f9:23:4d:5a (RSA)
80/tcp   open  http    nginx 1.17.4
| http-methods:
|_  Supported Methods: GET HEAD
|_http-server-header: nginx/1.17.4
|_http-title: Site doesn't have a title (text/html).
3306/tcp open  mysql   MySQL (unauthorized)
|_ssl-cert: ERROR: Script execution failed (use -d to debug)
|_ssl-date: ERROR: Script execution failed (use -d to debug)
|_sslv2: ERROR: Script execution failed (use -d to debug)
|_tls-alpn: ERROR: Script execution failed (use -d to debug)
|_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=2/27%OT=22%CT=1%CU=35715%PV=Y%DS=2%DC=T%G=Y%TM=603AA18
OS:D%P=x86_64-pc-linux-gnu)SEQ(SP=100%GCD=1%ISR=107%TI=Z%CI=Z%II=I%TS=A)OPS
OS:(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST1
OS:1NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN
OS:(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)

After our nmap scan, we can see an HTTP service running on our target.

Accessing it, we come across this page:

The first link takes us to the /main/ directory, which is running a WordPress 5.4.2 site

On the second link, we get an error saying the database connection failed:

But if we try to list the directory:

One of these files stands out, wp-config.php.save, but if we try to read it:

At this point we use the old trick of viewing the page source:

And there we go, credentials :D~

define( 'DB_NAME', 'dev' );
define( 'DB_USER', 'devtest' );
define( 'DB_PASSWORD', 'devteam01' );
define( 'DB_HOST', 'localhost' );

If we try to use them on the WordPress login page, we notice the credentials don't work...

Digging further into the WordPress site, we can see the username is 'administrator'

So let's try logging in with the credentials administrator:devteam01 aaand b00m, we're in ~

Now let's use metasploit to get a reverse connection to the machine, for that we'll use the exploit:

exploit/unix/webapps/wp_admin_shell_upload

We set the options:

Double-checking before running it:

Then we run our exploit and land our access:

After that, we generate an RSA key on our machine to upgrade our access:

ssh-keygen

In meterpreter, we drop to a shell and write our RSA key to /home/nginx/.ssh/authorized_keys to step up our shell.

After writing it, we connect over SSH.

ssh nginx@spectra.htb -i nginx

Now that we have an interactive shell, we start mapping the system... After a while, a file called autologin.conf.orig in the /opt directory catches our eye...

Inside that file we can see it points to a file called passwd in the /etc/autologin folder, so let's go take a look

That gives us another password... let's test it Tried it with the chronos user, no luck — but with the user katie... :D

Now that we have our first flag, let's move on to privilege escalation

We can run /sbin/initctl as root

We can look at the scripts that are already there and try to reuse one of them

Inside the scripts folder, we have write permission on some files:

Let's look at the contents of test.conf and figure out where we can use it to escalate privileges.

We can see it runs NodeJS, so let's build a Node payload, in my case I used the node reverse shell from Payload All The Things We write it to the /tmp directory as chu.js ( /tmp/chu.js )

Now let's head back to our initctl and try to run the test.conf script

We open our pre-set port on our machine and wait for the connection:

we are r00t

if i helped you, add + respect at my profile :D