https://www.hackthebox.com/machines/Shoppy
Initia Recon:
Ran the scan using the Rust :
Found 3 open ports : 22,80,9093
Added the shoppy.htb to the hosts file.
Move on to the Subdomain enumeration :
Then scanned for the VHOST :
Here I found 1 vhost, i.e. : mattermost.shoppy.htb
Exploitation:
Now I have 2 URL’s to login,
- Mattermost.shoppy.htb/login
- Shoppy.htb/logn
Tried multiple SQLi parameters but failed to login successfully. Used payloads from : https://book.hacktricks.xyz/pentesting-web/nosql-injection
| Then in the page shoppy.htb, tried this parameter : **admin’ | ‘1=1** |
| After using admin’ | ‘1=1, found that we are able to login successfully. |
Found the page :
| Where I tried the same parameter : admin’ | ‘1=1, I got a Download export option. Which contains 2 users name & password hash, i.e : admin & josh |
Cracking hash!
We can use hashcat or the crackstation to crack the gathered hashes of ‘josh’ & ‘Admin’ : Josh : 6ebcea65320589ca4f2f1ce039975995
Cracked the Josh hash & found the password : remembermethisway But not able to crack the Admin hash.
User access:
Now as we have the password of josh we can try the SSH login & the mattermost.shoppy.htb login
- SSH access is denied with user josh, no luck here 😕 
- Login on the domain mattermost.shoppy.htb, and pwn3d! 🙂
- While enumerating the logged in page found that there is a username password shared in the 'Deploy Machine' :
username: jaeger
password: Sh0ppyBest@pp!
And, now after using this credential we now successfully logged into the SSH
Root access
Did some manual recon & executed sudo -l & found this :
Checked the executable file in text format & found this :
By looking at the extracted content found that the file contains josh password manager password, i.e : Sample
By using the gathered credentials logged into the josh password manager :
And, got another credentials :
- username: deploy
- password: Deploying@pp!
Switched user to deploy & checked for the running processed using ‘top’ command but didn’t found any which means we are in a docker container right now:
Now, we are aware that we are in a docker container we can run the docker priv esc command from the gtfo bins :
Now, after running we just spawned the root shell & escaped the docker container.