ERA
Box Info
Linux
Medium
This machine starts with web enumeration. By browsing and analyzing the target website, you discover several interesting parameters and functionalities. One of these parameters is vulnerable to Local File Inclusion (LFI), which allows reading arbitrary local files from the server.
Through deeper enumeration, you identify credentials stored on the system and use them to gain an initial foothold via an SSH2 PHP wrapper exploit. This leads to remote code execution as a low-privileged user.
Once inside, the privilege escalation phase begins. Enumeration reveals a scheduled CRON job running as root, which repeatedly executes /root/initiate_monitoring.sh and interacts with a binary located at /opt/AV/periodic-checks/monitor. The binary’s .text_sig section is extracted and likely used for integrity verification.
The key observation is that the CRON job runs very frequently, spawning multiple concurrent processes. If you can modify the monitored binary (while keeping its .text_sig consistent) or influence a file the script depends on, you could inject commands to escalate privileges to root.
Nmap
┌──(irix㉿irix)-[~/THM/era]
└─$ nmap -T4 -Pn -A 10.10.11.79
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.5
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://era.htb/
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernelthen we try to search on vulnerability in ftp but we can’t found anything
Script Scan
Fuzzing
add domain era.htb to hosts files to allow you discover this site
then we start to fuzzing using dirsearch to get a valid endpoint
but we didn’t find anything interesting. so we start to think little to collect subdomains for era.htb
Subdomain Enumeration
to avoid this noise we target words number
we found a valid subdomain call file.era.htb so let’s add it to hosts file to can access it
it’s have interests function
Directory Enum
we start to register on this site to discover it
we found endpoint allow us to upload files
we will notice after upload file, we have id for our file
in this case we will think little to test IDOR vulnerability
ID Fuzzing
so let’s fuzz in id parameter use our session
we found two ids may have interests things
after download two files and unzip it we found
we found interest file call filedb.sqlite
we start to crack these hashes
we try to use this credentials in ftp and web app but we think we don’t have anything may be interested. then we will back to file call site-backup-30-08-24.zip to investigate in this file
after more time we found something in source code for download.php page
This code checks if the show parameter is "true" and the current session user is admin (erauser equals 1). If the format parameter contains ://, it treats it as a stream wrapper (like php:// or ssh2://) and sets the response as a file download; otherwise, it returns normal HTML.
that’s mean we could have admin account we can take LFI and try to upgrade it to RCE
Security question
return to web App to try to manipulate with security question
back to filedb.sqlite and use admin information
but we get
Incorrect answers. Please try again.
Reset
return to reset function to try reset question for admin user
we success to reset security and we get If the user exists, answers have been updated — redirecting… then try login again with login security question
we will notice this is the first time we are see these files . that’s meaning we are now admin
RCE
then we could to take admin privilege on this web app so let’s try to execute LFI
but nothing it occur
after return to our mind map we found we can replace php with ssh2
ssh2 function
ssh2.shell://user:pass@example.com:22/xterm
ssh2.exec://user:pass@example.com:22/usr/local/bin/somecmd
ssh2.tunnel://user:pass@example.com:22/192.168.0.1:14
ssh2.sftp://user:pass@example.com:22/path/to/filename
we will use penelope framework to listening
you can use netcat but this framework have more features like you can use automated privilege escalation tools if you can download it in pwn machine
now you have user flag
Root
using linpeas you will notice file call monitor run with SUID privilege and we can exploit it
we will notice in machine
CRON -f -P– This is the cron daemon running in the foreground, meaning a scheduled task has been triggered.bash -c echo > /opt/AV/periodic-checks/status.log– The scheduled task clears the contents of thestatus.logfile.objcopy --dump-section .text_sig=... /opt/AV/periodic-checks/monitor– Extracts the.text_sigsection from the/opt/AV/periodic-checks/monitorbinary, probably for integrity verification or signature checking./root/initiate_monitoring.shexecuted multiple times (PID 25204–25213) – This is the key point: the cron job triggers/root/initiate_monitoring.sh, but it runs many times in quick succession.
Last updated