Academy

2 minute read

Port Scanning and general enumeration (Nmap, FFuF)

Reading/Resources
- Nmap manual
- FFuF

Webserver and something to do with mysql on that high port. Let’s enumerate the webserver

Browsing using the url, gives us an error pointing to academy.htb. Adding the url and academy.htb to our hosts file fixes the error.

We have the ability to LOGIN and REGISTER. After registering and logging in we’re greeted with a home.php page that is seemingly the HTB Academy, but nothing works! Well, we know that the site is built on php so let’s toss a FFuF at it fuzzing for .php files

admin page??

Requires credentials that we don’t have.

Access (BurpSuite, metasploit)

Reading/Resources
- BurpSuite
- metasploit

Let’s go back and take a closer look at the registration process by capturing the request in BurpSuite

Interesting parameter. roleid? Let’s change that to 1 and send it off. What happens if we try to use this new account with the roleid of 1 to log into the admin section?

We’re in! Let’s add dev-staging-01.academy.htb to our hosts and navigate to it.

Error page, but lots of information here. Looks like database usernames and passwords. App name is Laravel and even the app key! I couldn’t find a version number for Laravel, but let’s see if metasploit has anything for us

Lookg good. Outside of the ordinary options it requires the APP_KEY (that base64 string we found earlier) and the VHOST which in our case is dev-staging-01.academy.htb

Let’s fire it off and get our shell.

Privesc (linPEAS, Composer)

Reading/Resources
- linPEAS
- Composer GTFObins

Doing some manual enumeration on the box there are a couple things to note. First, there are six users with an interactivce shell.

And the .env file for htb-academy-dev-01, it had much of the same information from the error page we found earlier. But since it’s basically a staging branch of the site, what if the original academy site has an .env file too?