HTB Writeup - FriendZone

First Step: Nmap Scan of the Machine

nmap -n -v -Pn -p- -A --reason -oN fz.txt 10.10.10.123 

Ubuntu, with a few things worth looking at

Primary areas of opportunity: FTP/21, HTTP/80, SMB/445

Interesting port: TCP/53

21/tcp  open  ftp         syn-ack ttl 63 vsftpd 3.0.3
22/tcp  open  ssh         syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
53/tcp  open  domain      syn-ack ttl 63
80/tcp  open  http        syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
139/tcp open  netbios-ssn syn-ack ttl 63 Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
443/tcp open  ssl/http    syn-ack ttl 63 Apache httpd 2.4.29
445/tcp open  netbios-ssn syn-ack ttl 63 Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)

I added a static entry to my /etc/hosts file

 DNS zone transfer shows nothing

Time to checkout something else.
Check the web browser first:





 Nothing on the page worth mentioning, nothing in the source either.

Time to Check HTTPS :
 I accept the certificate, but the page doesn't load




 Added a new entry into /etc/hosts

Nslookup still didnt give me anything good, but I was able to use the DNS Zone Transfer to find multiple hostnames used by this box.

Added 3 new entries into my /etc/hosts file

10.10.10.123  administrator1.friendzone.red
10.10.10.123  hr.friendzone.red
10.10.10.123  uploads.friendzone.red 
10.10.10.123  friendzone.red

DNS Entry 1) https://friendzone.red, was just a gif of a dude trying desperately to escape the friendzone.
    
 I was able to enumerate and find /admin

but was empty. So I think this is a dead end...
DNS Entry 2) https://administrator1.friendzone.red, an admin portal for something. Sweet!

So it says successful, and provides what looks like an epoch timestamp.

No matter what I did here was I able to determine where these were ending up. So, perhaps useful, but I'll just keep it in mind for later.

 DNS Entry 4) hr.friendzone.red does nothing, definition of a dead end.

# Create a Directory for mapping the shares
mkdir sambas
# Access the folder
cd sambas
# Create 3 folders for their Network Mappings
mkdir Files
mkdir general
mkdir Development

#Attempt to Mount all 3 folders at the same time using the guest credentials
mount //10.10.10.123/Files ~/sambas/Files -o username=guest,password=''
mount //10.10.10.123/general ~/sambas/general -o username=guest,password=''
mount //10.10.10.123/Development ~/sambas/Development -o username=guest,password=''

So I think we've discovered some good information here based on the other folks using the Development folder. There is some kind of LFI at play for sure.

/Development folder
GUI:

CLI:

Now we set the Kali box to listen on port 9595




We check the user folder and find the user flag

After hunting around for a LONG time i found a database username and password

Which thankfully let me in via SSH:


I was grepping "ps aux" to see what I could find for services.


I realize that because I spotted this I skipped a HUGE part the process here, but I did work my way back, after I got the root flag. That information will be at the bottom of this, and was a great to learn!

I found multiple os.py files which is worth noting


I looked into the os.py file the user was and found the following command at the end of the file:
So it seems that he's piggybacking on a python script which is running at a regular interval. Likely a cron, or maybe something triggered through the web interface.

I wasn't sure where the root flag was specifically, so I grabbed 3 locations I thought it might be (knowing full well the Desktop and Root werent even likely to exist)
About 5 minutes later I checked my /home folder, and the only file with anything in it was moo3.txt, which held the root flag.


 Ok, so back to the piece I skipped... remember i spotted this guy editing the python file directly...
 To the google! I found an application that lets me see all processes running, even without root. Ironically, you can see in the screenshot above someone was running .pspy, so this is likely the exact same way he figured it out too.

 I cloned the repo from github

Started up my super basic web server

 Downloaded the .py file into the friendzone.htb /home/friend/test folder

Ran into some permission issues

Fixed permissions, and it started checking for all running processes





 The output screamed for a few seconds before calming down, but within 2-3 minutes i saw the following

 Checked the reporter.py file and found nothing of consequence other than the 'import os' pieces which refer back to the os.py file in the python2.7 library folder.

 What I can't figure out how they determined they needed to edit the 2.7 file opposed to the any of the 3 python3 folders...

Dead Ends and Rabbit Holes

• https://friendzone.red, 
• was just a gif of a dude trying desperately to escape the friendzone.
• /admin went nowhere
• FTP
• Never got in, and spent a while trying to identify any vulnerabilities to no avail.
• Wfuzz
• I love wfuzz... but ince this used to much SSL I wasnt able to use it, but blew a lot of time trying to figure out a way fuzz even if it was HTTPS. 
• https://uploads.friendzone.red
• I assumed it was a broken script on the front end so I wasted a lot of time trying to fix the input object names. In the end the script on the backend (upload.php) literally doesn't do anything with the file. It just checks if there is one, then tells you it was successful.
• https://administrator1.friendzone.red/dashboard.php
• Finding the right folder to abuse LFI. In the end the answer was simple... and if I spent time looking for clues too it would have been faster.