search

HTB | Era

Machine - https://app.hackthebox.com/machines/Eraarrow-up-right

IP - 10.10.11.79

hashtag
NMAP

└─$ nmap -sC -sV -p 21,80 10.10.11.79 -Pn -oA nmap_port_details                                                                 
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-01 18:18 IST
Nmap scan report for 10.10.11.79
Host is up (0.34s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.5
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to <http://era.htb/>
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 31.58 seconds

hashtag
Port 80

Let’s do a directory search

Nothing interesting came up let’s try subdomain enumeration

found file subdomain

hashtag
Foothold/ shell

hashtag
Shell as Eric

hashtag
uploading file

Let’s register ourselves and login

We can upload a file, So let’s try to upload revershell php file

aftr uploading we can see the link for downloading our file

hashtag
Fuzzing id parameter

Let's try to fuzz id

We found signing.zip and site-backup-30-08-24.zip

Let’s unzip them

hashtag
Sqlite db

On analyzing signing.zip Content I found a PEM key and a username yuri

on looking at site-backup-30-08-24.zip content I found filedb.sqlite

We found hashed passwords for users

Let’s analysi the hash

Since it is bcrypt let’s try to decrypt the hashes

found two passwords

hashtag
FTP as yuri

We were able to login as yuri via FTP

Let’s download conf file and analysis

Apache Conf

Looking around we can find the following information:

WebRoot

  • era.htb - /var/www/html

  • file.era.htb - /var/www.file

PHP Conf

Most interestingly we see ssh2 wrapper which if we take a look around we can find has an exec variant. PHP SSH2 WRAPPERarrow-up-right

hashtag
Admin Acess

We can login to the storage website as eric

We can try to change the security question for admin user

Now let's head over to Security Loginarrow-up-right and attempt to login with the updated security questions.

Boom!! We can login as admin now

hashtag
Remote Code execution

Let's attempt to use the ssh2 wrapper which we have identified earlier. First, let's setup a listener.

Next up, let's create a url using the format parameter and ensuring the show parameter is set to true.

On listener we do have a call back

let’s try for revshell

and on listener we get the shell

we can su eric and get the user.txt

hashtag
Privilege Escalation

Looking in /opt/AV we found periodic-checks

Let’s transfer pspy64 to check what is running

Looks like the system is constantly running the binary, but we can't easily replace it since it's signed.

hashtag
Exploit

Let's create a malicious executable file using the following c code.

Now let’s compile it

Next let's use objcopy to dump monitorSignature into a file of our choice.

Next let's use objcopy to add a section to our binary containing the signature data.

Lastly, let's move the binary to replace the monitor binary.

Now if we wait for a while we get a call back on our listener! and we are root

PreviousHTB | OutboundNextHTB | Editor

Last updated