root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

Lab: Planning

CTF: Hackthebox

Reconnaissance

The ctf creator provided creds to access the admin account.

Rustscan’s output-:

❯ rustscan -a planning.htb -- -Pn -sC -sV
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com

[~] The config file is expected to be at "/home/sensei/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.10.11.68:22
Open 10.10.11.68:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p  ")

Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-12 13:36 WAT
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:36
Completed NSE at 13:36, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:36
Completed NSE at 13:36, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:36
Completed NSE at 13:36, 0.00s elapsed
Initiating Connect Scan at 13:36
Scanning planning.htb (10.10.11.68) [2 ports]
Discovered open port 22/tcp on 10.10.11.68
Discovered open port 80/tcp on 10.10.11.68
Completed Connect Scan at 13:36, 0.23s elapsed (2 total ports)
Initiating Service scan at 13:36
Scanning 2 services on planning.htb (10.10.11.68)
Completed Service scan at 13:37, 6.55s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.11.68.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:37
Completed NSE at 13:37, 6.44s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:37
Completed NSE at 13:37, 1.04s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:37
Completed NSE at 13:37, 0.00s elapsed
Nmap scan report for planning.htb (10.10.11.68)
Host is up, received user-set (0.23s latency).
Scanned at 2025-05-12 13:36:53 WAT for 15s

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 62:ff:f6:d4:57:88:05:ad:f4:d3:de:5b:9b:f8:50:f1 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMv/TbRhuPIAz+BOq4x+61TDVtlp0CfnTA2y6mk03/g2CffQmx8EL/uYKHNYNdnkO7MO3DXpUbQGq1k2H6mP6Fg=
|   256 4c:ce:7d:5c:fb:2d:a0:9e:9f:bd:f5:5c:5e:61:50:8a (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKpJkWOBF3N5HVlTJhPDWhOeW+p9G7f2E9JnYIhKs6R0
80/tcp open  http    syn-ack nginx 1.24.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-title: Edukate - Online Education Website
|_http-server-header: nginx/1.24.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

I didn’t get any useful information from the main site.I decided to fuzz for subdomains and discovered the grafana sudomain.

I accessed the admin’s account using the credentials provided.

I discovered that the Grafana version is vulnerable to command injection.I checked for the version with endpoint /api/health.

I got an exploit from this github repo

Command injection achieved-:

After spawning a revshell,I discovered that it is a docker container.I ran env to check for environmental variables and discovered creds for user enzo on the main server.

User Enzo accessed via ssh-:

Privesc with node module `crontab-ui`

I noticed a service runnning on port 8000.

I noticed this directory crontab-ui and I decided to look into it.

Crontab-ui is a nodejs web application that allows you manage your crontabs.

I portforwarded the port with ssh to access it on my local machine.

When I tried to access it, I met an obstacle “a nginx login prompt”.After checking the docs,I discovered that crontab-ui can be used with nginx as an intermediary.