Intentions HackTheBox Walkthrough

Hey, fellow Hackers! Today, we’re going to dive into the Intentions HackTheBox Machine. Let’s jump right in and have some fun!

Let’ start with scanning target ip using nmap

Result

We got two open port i.e. 80 and 22

Before doing anything i added intentions.htb inside /etc/hosts file.

After accessing website we got a login and registration form.

I started directory enumeration using dirb

Result:

I tried accessing them one by one, robots.txt is empty and for other we had to login into a account. I register a new user and login into account.

Here we got some section like profile etc. Here i started enumerating .js file for found admin directory using dirb tool

Result:

Here we got some js files i tried accessing admin.js using curl

and at the end of this result i found some text message inside code

i copy below script code and on google i search for online javascript beautifier for formating this code and got a website : https://beautifier.io/

here i added this script code and beautify this code and then we can able to see this in much better format

Messages we found:

Recently we ‘ve had some copyrighted images slip through onto the gallery. This could turn into a big issue for us so we are putting a new process in place that all new images must go through our legal council for approval. Any new images you would like to add to the gallery should be provided to legal with all relevant copyright information.

I’ve assigned Greg to setup a process for legal to transfer approved images directly to the server to avoid any confusion or mishaps.\n This will be the only way to add images to our gallery going forward.

Hey team, I ‘ve deployed the v2 API to production and have started using it in the admin section. Let me know if you spot any bugs.

This will be a major security upgrade for our users, passwords no longer need to be transmitted to the server in clear text!

By hashing the password client side there is no risk to our users as BCrypt is basically uncrackable.

This should take care of the concerns raised by our users regarding our lack of HTTPS connection.

The v2 API also comes with some neat features we are testing that could allow users to apply cool effects to the images. I’ve included some examples on the image editing page, but feel free to browse all of the available effects
for the module and suggest some:

Now we know there is user named as greg a v2 API in production and Password hashing client side with BCrypt.

Then i load my burpsuite for analysing all web page, After going through all page on by one i found there’s a input section in profile section

Here i tried bunch of sql payloads and finally discover a payload that working :

after adding when i go to feed section i get time delay.

I capture both request in burpsuite and store in different file named as req.txt and req2.txt that’s i am going to specify in sqlmap tool :)

I have both user’s password hash but not able to crack them. As we know we found in admin.js that in v2 API password no longer need to be transmitted to the server in clear text so i decide to trasmit hash for authentication as other user

While logging into the web app i send post request to /api/v2/auth/login with a json payload containing user credentials

and boom we able to access steve user

with this account we can access to /admin directory that we found before

We can see there is a new image button:

We can view different images and apply filters too

Intercepting filters with burpsuite we got the following request.

We know that they are using imagick php library for these cool filter effects i tried searching for this exploit and found a version of imagick that suffer from a vulnerability known as “ImageTragick”.

I tried bunch of things including using online available ImageTragick exploit etc. But didn’t work :(

Later i found a POC that we can use to move further: https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/

Steps to get Shell:

Above blog POC discusses a method for uploading a php web shell by exploiting a vulnerability in MSL “Magick Scripting Language”.

I combine everything in one request and uploaded a web shell named as doge.php :)

Result:

After getting result of our php web shell i open up my netcat listner on port 8000

and i change the request method from get to post for gaining reverse shell

and in response i get www-data shell :)

Then i gain tty shell using python

After little bit enumeration i find a .git directory inside /html/intentions

For downloading this file in our local system i first create a copy of this .git directory inside /tmp

Then i create a .tar archive using tar

and finally i move this file inside public directory so we can download this using wget

For downloading

then i extract this tar file

and using git log i found something interesting

Using git diff option i found greg user password

Then using ssh i access this user shell

in current directory i found user.txt with some other script and .txt file

after reading its content i found out it’s using a binary /opt/scanner/scanner

and this is what scanner binary do

The scanner tool identify copyrighted material by evaluating files or directories against a known blacklist of hashes. It calculates the MD5 hash of the file contents and compares it to those provided in the hash file.

We can use this tool to read the contents of files

In above command we define /root.txt file that we wanna read with -l flag for max bytes of the file to be hashed, with debug and finally we provide something to check against, that can be anything.

If we decrypt the value of output hash we get 9 value that can be first character of that file. We can automate this process by writing a script :)

I write a python script that give me root flag

BOOOMM!! Intention solved successfully :)

Happy Hacking :)

Follow For More: Instagram, LinkedIn