Hack The Box: Shoppy (Write-up)

Information Gathering:

We are going to kick off our box with an nmap scan, looking for open ports.

Looks like we have 22, 80, and a service running on 9093. We also get a redirect on port 80 to http://shoppy.htb. Let’s add this to our /etc/hosts.

The default landing page doesn’t show much as it looks like the site is still under development. I looked inside the page source, but found nothing.

I used dirb to find additional directories to the website. Let’s go check out the admin directory.

After going to /admin we are redirected to /login with an authentication page for the Shoppy Admin.

After messing around with the site, I noticed that the log in button would execute without providing anything in the password field. This is a clue that it might be vulnerable to NoSQL injection, running MongoDB in the backend. NoSQL injection is when the query is not sanitized, allowing an attacker to include malicious input that executes an unwanted command on the database. We can use this vulnerability to login with a username which will return true to the server and allow us to login. We could guess that admin is a valid user, but let’s craft a wfuzz command in order to find usernames. We will include ‘||”===’ after FUZZ in username because this is the bypass method for MongoDB to always return true, therefore a valid login. The “–hh 51” is going to block any response with characters equal to 51.

wfuzz -z file,/home/kali/Wordlists/big.txt -d "username=FUZZ'||''==='&password=test" --hh 51 http://shoppy.htb/login

Great, that worked. We have two users now, admin and josh. Let’s go back to the webpage and try logging in with Josh, utilizing NoSQL injection.

NoSQL login bypass
josh'||''==='
or
admin'||'1==1

https://book.hacktricks.xyz/pentesting-web/nosql-injection

After logging in we can see a list of Products of Shoppy App. We also see “Search for users” at the top right. Let’s search for josh.

After searching josh, we are presented with a “Download export” button.

Cool we have the password for josh now in a MD5 hash.

If you didn’t know this was a MD5 hash just from looking at it, you can use the prebuilt kali tool “hash-identifier”.

Now you can use john and run the hash against a word list, but my first method is to use hashes.com. After searching the hash, we found a match.

Now we can skip this step since we already have the cracked hash password, but this is how you can crack the hash using john. Just make sure you save the hash into a file.

john --format=RAW-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

I tried to SSH into josh, but the password is incorrect. These credentials must be used elsewhere. Let’s try enumerating subdomains.

wfuzz -c -f subdomains.txt -w /usr/share/amass/wordlists/bitquark_subdomains_top100K.txt -u "http://shoppy.htb/" -H "Host: FUZZ.shoppy.htb" --hl 7

After a few minutes we got a hit! Let’s add mattermost to our /etc/hosts and then visit the webpage.

We already have the credentials. Let’s login with josh:remembermethisway

After logging in we didn’t even have to look through the web portal. Jaeger’s credentials were provided to us in clear text.

Foothold:

We can now SSH into jaeger given the provided credentials.

While grabbing the user flag, I noticed another user on the system, deploy. We might want to try moving laterally.

Hmm… we can run the password-manager file as deploy. Let’s check this out.

I used cat to display the contents of the file. At first I didn’t think there was anything readable, but looking closely I found the master password.

We can change directories to /home/deploy and then run sudo -u deploy /home/deploy/password-manager

https://www.computerhope.com/unix/sudo.htm

Switch users to deploy. I decided to upgrade the simple shell to a fully interactive TTY shell.

python3 -c 'import pty; pty.spawn("/bin/bash")'

Privilege Escalation:

I checked sudo -l as well as SUID permissions, but unfortunately nothing. We will have to find another alternative. Let’s try running linpeas.

Start a python3 web server on port 80

Use the wget command to download the linpeas.sh script to your victim’s machine. Use chmod to make the script executable and run the script with ./linpeas.sh

After looking through the linpeas findings, I noticed that our user is part of another group, docker, with a group ID of 998.

I later realized I could’ve just used the id command to show permissions.

I wasn’t too sure where docker was installed, so a quick Google search answered our question. Let’s cd into /var/lib

https://gtfobins.github.io/gtfobins/docker/#sudo

Our friendly neighborhood gtfobins comes in for the rescue.

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Summary

HTB: Shoppy

This box was quite entertaining and overall a well put together machine. This CTF exercised my knowledge of fuzzing usernames as well as subdomains. It was vulnerable to a NoSQL injection via MongoDB and utilized abusing group permissions for the privilege escalation. Check out the rest of my write-ups, and as always, happy hacking!

Learn More