Traverxec
Overview
Traverxec box was one of the first HTB boxes I rooted and good one. To get this walkthrough completed, I basically had to redo the entire box as at this point, I wasn't even considering documenting my approaches or not doing them well. A faliures on my part for relying solely on my memory.
Anyway, this box is sort of the typical Linux box, but gets interesting once you gain access. Below, I included some links resources which were part of my research.
Resources:
Initial Enumeration: Footprinting and Scanning
First of, we need to identify how to reach the system. In other words, we need to identify what are the services available from this machine.
Let's start by adding this machine's IP address to the hosts file and create an alias:
In this box, I solely used nmap for discover the open ports and then enumerate further. The initial approach is basically the same I'd used before with masscan.
NMAP
To discover the open ports I used the following:
Then, to further enumerate the services found and get more information from each one using nmap, I used the following:
Let's begin:
After finding SSH and HTTP open, my first thought was to take a look at HTTP on the browser and enumerate pages/directories. Through the browser, there wasn't much to see initially, and the most weird thing was getting connection refused errors with gobuster and even dirb did not finish well.
GOBUSTER and DIRB
Exploitation and Gaining Access
Seeing all this, made me realize I overlooked the fact that nmap pulled information from the webserver that is running on Traverxec. The web server being Nostromo version 1.9.6, which among other things could be setup to publish directories in users' home directories. This web server has a known exploit and a Metasploit module that performs a Directory Traversal RCE.
METASPLOIT
So not only I gained access with no issues, but relied on the information found from Nostromo to grab two important files: nhttpd.conf and .htpasswd. Once I found the path where Nostromo, /var/Nostromo, I went straight to download the files.
On a different terminal window, I inspected the both files and found a few interesting things, including a hash and the Nostromo configuration. This hash lead me nowhere; I attempted to use them through SSH but it didn't work as possibly public/private key authentication is enabled.
JOHN THE RIPPER
On Terminal Window #2:
Through the .htpasswd, not only I found the user david and a hash that belongs to him, but I was also able to crack it; Nowonly4me.
Below, we have the nhttpd.conf file. From what I read, the interesting items here are the serveradmin, the Basic Authentication section, and the HOMEDIRS section. Between the serveradmin and HOMEDIRS, and also from what I read, I could assume there might be a directory inside of david's home directory.
As previously mentioned, Nostromo basically uses the designated public directory from the user's home directory to make it publicly accessible; of course if that is configured. So one way I thought of testing this assumption was to access whatever is accessible from david.
To do this, based on Nostromo documentation, it would have to be attempted as:
As you can see we accessed something (not too revealing though) that confirms this. Let's go back to Metasploit's shell session and keep enumerating and find a way to switch to david's user.
On Terminal Window #1 (Metasploit Shell):
As you can see, not only we found public_www from nhttpd.conf exists within david's home directory, but we also found the listed .htaccess file from the Basic Authentication section and a TGZ file. We don't know the content of it, but it could have important files.
Let's see try and retrieve and then access both.
Back to Terminal Window #2:
And we got david's .ssh directory with its private/public key pairs. Let's try to convert david's private key into JohnTheRipper format and crack it.
As we found the passphrase for david's private key, hunter, we can now attempt to SSH as david with the private key.
Back on Terminal Window #1:
AND we got user! Let's keep going.
Privilege Escalation
Now that I accessed the system with a different account that has more access than www-data, my first thought was trying to find out if I could escalate privileges through a vulnerability.
The spoiler here will be (on purpose) that I was not successful when going through this path, and most probably was my own fault, BUT I will still show it as it is an important step regardless.
LINUX-EXPLOIT-SUGGESTER.SH
The first vulnerability (CVE-2019-13272 - PTRACE_TRACEME) points to a Linux Polkit - pkexec helper PTRACE_TRACEME local root exploit that exists in Metasploit as well based on what we found on Exploit-DB (see the reference). This one is the most logical to start with as the 'Exposure' is highly probable.
METASPLOIT
So that didn't work! Let's try the other one by uploading the exploit onto the box along with socat. This exploit relies on socat and tries to retrieve it if it doesn't exist there, but problem is the box will not be able to reach the internet and retrieve it (by HTB design).
So...back to square one! As I said, at this point I'm sure I'm doing something wrong and possibly I overlooked something. Let's enumerate a little more as david.
If we go back to the user's home directory, we see a bin directory which we DID NOT look at. SMH!
The server-stats.sh script tell us it might be possible to run journalctl as sudo.
Seeing this makes me look at sudo -l but it requires a password, so we can only do this through the script or by using what is in the script.
Using journalctl to escalate privileges sounds like something we could look into in GTFOBins, which tell us we can escape the normal operation by typing !/bin/sh while in journalctl's less behavior. Let's try this!
But, the obvious doesn't work which would be running the script. Let's try and run the journalctl command as shown in the script:
/usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service
AND we are ROOT! Let's get that flag!
AND we got the ROOT FLAG!
NOTES: A couple of thoughts here:
Trying to look for vulnerabilities is never an unnecessary step, but in this case it lead me nowhere as for sure I did something wrong. Better not to fight it as this was the second time I did Traverxec but just to get this walkthrough done. Also, once I figured what I needed to do, it came back to me what I originally did.
From people in the forum, I originally read the journalctl escape required you to have the terminal window in a certain size and that is not true. I got to escape its normal operation by simply typing !/bin/sh while it was still "running" and zero window resizing was needed.
Enumerating the pages was not fruitful here as the connections were getting refused, but I still shared the process. Just like I mentioned with the vulnerabilities, this is also an important step when dealing with webpages.
Last updated
Was this helpful?