Gobox
Detailed Walkthrough
Initial Access
Upon establishing a connection to the VPN, the tester initiated the assessment by performing a service enumeration. This process revealed the following open ports:
22/tcp open OpenSSH 8.2p1
80/tcp open HTTP
4566/tcp open HTTP
8080/tcp open HTTP
Applications running on Server:
During the enumeration phase, the tester ran feroxbuster to discover directories and identified on http://gobox.htb:8080/forgot/ endpoint a Forget Password functionality implemented.
By testing the functionality within email field, it was discovered that the email address was reflected on the web. this reflection exposes an input-controller sink and opens potential avenues for exploitation.
Additionally, the request was intercepted using Burpsuite revealed that the application was running golang as programming language.
Utilizing the information and recognizing that Golang offers a built-in template engine, the tester proceeded to execute an SSTI payload, successfully obtaining the ippsec password.
Upon authentication with Ippsec credentials, the application revealed its source code, which included a vulnerable function named DebugCmd that permits command execution on the target server.
Testing the function that leads to a Remote command execution.
During the enumeration, the tester enumerated the hostname which was called AWS, isuggesting that it might be storing AWS credentials, however, the typical path ~/.aws/credentials contained a base64 string with an useless message typically of CTF.
Continuing with the enumeration, the tester leveraged the AWS credentials found on the server to list the S3 buckets and discovered a bucket named 'website' that was hosting the application accessible at http://gobox.htb/.
To obtain a reverse shell, the tester uploaded a PHP reverse shell in the bucket and triggered navigating to http://gobox.htb/shell.php.
Lateral Movement
Privilege escalation
After compromising the target server, the tester initiated a deeper enumeration and found some unusual modules enabled for Nginx.
Upon searching for ngx_http_execute_module.so, a GitHub repository named NginxExecute was found, which explains how to utilize it via GET and POST request using system.run parameter and the correct server configuration for the command set as on.
Regrettably, the module installed on the system were altered, but a straightforward search using strings command revealed the correct name parameter for command execution.
Credentials
👤 Users wordlist
🔑 Password wordlist
Subdomains / Hosts
AWS
172.28.0.3
Docker container
gobox
10.10.11.113
Main server
Host Discovered
gobox
10.10.11.113
Scans
Scripts / Automations
Flag Discovered
User
10.10.11.113
/var/www
SSTI on Golang
<SNIF>
Root
10.10.11.113
/root
Nginx module Abuse
<SNIF>
Last updated