HackTheBox - Machines - Alert

🕒 2025/03/24

image

1. Nmap

First, let's scan all the ports on the machine with nmap.

We discovered that port 80 is open.

2. http://alert.htb

Next, we attempted to access the website.

It seems that the administrator might click the link we submit through the Contact Us form.

3. XSS

Since Markdown supports HTML, let's test whether a JavaScript payload will be executed when rendered by the application.
To verify this, let's first craft a simple test payload.

With the execution flow confirmed, we can now proceed to craft the actual payload. The payload will extract the actual source code of http://alert.htb/index.php?page=alert :

  1. Upload alert.md
    image
  2. Generate the shared link
  3. Start a simple HTTP server to receive incoming requests
    • python3 -m http.server 80
      image
  4. Submit the shared link via the Contact Us form
    image
  5. Wait for the administrator to view the message. Once triggered, the malicious payload sends a request back to our listener
    • python3 -m http.server 80
      image
  6. Decode the base64-encoded string to reveal the actual source code of http://alert.htb/index.php?page=alert
    image

As seen above, we found an hidden URL path: index.php?page=messages.

Let's try to retrieve the content of http://alert.htb/index.php?page=messages .
Using the same XSS technique as above, we modify the URL in the script to http://alert.htb/index.php?page=messages:

4. Local File Inclusion

This time, we modify the URL in the script to /messages.php?file=../../../../etc/passwd to test for a possible Local File Inclusion vulnerability by attempting to retrieve the contents of /etc/passwd.

As seen above, the payload worked as expected. Based on this result, we proceeded to retrieve more sensitive files.
During enumeration, we also discovered that statistics.alert.htb is hosted on the same machine.

So, let's try accessing http://statistics.alert.htb

It requires a username and password.

Continuing the enumeration, we found a sensitive file .htpasswd under /var/www/statistics.alert.htb/

We attempted to crack the hash using Hashcat.

We successfully cracked the hash and recovered the password: manchesterunited.

5. http://statistics.alert.htb

We successfully logged in to http://statistics.alert.htb with albert:manchesterunited, but did not find any sensitive information.

6. SSH

We successfully gained SSH access as albert with the password manchesterunited.

7. Abusing Cron Jobs for Privilege Escalation

Using pspy, we discovered that /opt/website-monitor/monitor.php is being executed as a cron job.

In monitor.php, configuration.php is included

We found that albert has permission to modify configuration.php, so we replaced its contents with a reverse shell script for privilege escalation.

As seen in the screenshot, we successfully escalated to root privileges.