> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/shoppy.md). # Shoppy ### Scanning Firstly, I started off with a full port scan on the target.

Fig 1. Nmap full port scan

From figure 1, it is evident that ports 22,80 and 9093 were open. Next, I ran an aggressive Nmap scan on all those open ports.

Fig 2. Nmap aggressive scan part 1

Fig 3. Nmap aggressive scan part 2

Fig 4. Nmap aggressive scan part 3

### Enumerating HTTP From Fig 2, the target is likely to be a debain machine that runs a Nginx server. From the HTTP title shown in Fig 2, it suggests that we should add an entry for`shoppy.htb` to our `/etc/hosts` file with the corresponding IP address to be able to access this domain in our browser.

Fig 5. Adding domain to /etc/hosts

Afterwards, I opened up `/etc/hosts` file and added in the target IP as well as the domain name `shoppy.htb`.

Fig 6. Landing page

Heading over to `shoppy.htb`, I was greeted by a large countdown timer for the supposed launch of Shoppy Beta. I ran dirsearch in the background to uncover subdirectories and I found the login page at `/login`.

Fig 7. Dirsearch results

Heading over to the `/login` page, I was greeted by a simple login screen asking for my Username and Password.

Fig 8. Admin login page

Upon trying the default "admin:admin" credentials, I was redirected to `/login?error=WrongCredentials`.

Fig 9. Wrong credentials

The following burpsuite request and response depicts the scenario where incorrect credentials were used.

Fig 10. Burpsuite request and response for incorrect credentials

Fig 11 shows a simple test for the presence of SQLi in the login page by appending a single quote after the username string. However, as seen in the Response, the web server does not give us a valid response back.

Fig 11. No response when SQLi

After facing a roadblock when testing for the presence of SQLi, I enumerated further, trying to uncover the underlying framework that built this web app. By going to a non-existent subdirectory, I was greeted by a "Cannot GET /subdirectory\_name*"* message.

Fig 12. Error message when browsing non-existent subdirectories

Searching for the error message online, I was able to find that it most likely belongs to a Node.js web app.

Fig 13. Google Search for error message

Since most node.js web apps are powered by MongoDB, our SQLi needs to be tweaked for the NoSQL syntax. The `Content-Type: x-www-form-urlencoded` can be changed to `Content-Type: application/json` and the post parameters could be passed as a JSON object.

Fig 14. Change Content-Type to application/json

By omitting the `password` field, I obtained the following error message in Fig 15. From the error logs, it is evident that the the user `jaeger` was present on the target.

Fig 15. User named jaeger

Viewing for a Mongo SQLi [here](https://book.hacktricks.xyz/pentesting-web/nosql-injection#sql-mongo), I found the payload `' || 1==1`

Fig 16. Mongodb SQLi

Taking reference to the above payload and contextualizing it, I used the payload `admin'||'1'='1` . From the burpsuite's response, I was able to authenticate into the admin console.

Fig 16. Successful SQLi

Trying out the SQLi on the webpage itself, I managed to login.

Fig 17: Trying out SQLi

Fig 18 shows the admin console of the Shoppy web app. The `search for users` functionality on the top right caught my attention.

Fig 18. Logged in to admin console

Clicking on it and keying in `admin`, I obtained the database entry belonging that of the admin.

Fig 19. Search "admin" and export details

I decided to enumerate the database further in hopes of dumping all the records. I used the command `admin'||'1'=='1 to view all records of the Shoppy App.`

Fig 20. Search for all users

Now, I obtained the password hash of 2 users, namely the admin and the josh user.

Fig 21. Database dump

Using Crackstation, I managed to crack Josh's hash to be `remebermethisway`. Howerver, I was unable to login to the SSH server using`josh:remembermethisway.`

Fig 22. Josh's password cracked

Next, I decided to conduct further enumeration particularly on uncovering the subdomains on `shoppy.htb`. I used the ffuf command `ffuf -u http://shoppy.htb/ -H "Host: FUZZ.shoppy.htb" -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -fw 5`

Fig 23. Enumerating subdomains

From the figure above, I found the subdomain `mattermost`, which is an open-source, self-hostable online chat service that is mainly used internally within an organization.

Fig 24. Add subdomain to /etc/hosts

Using Josh's credentials, I was able to login to his mattermost account. Viewing the `Deploy Machine` channel, I found the following.

Fig 25. Jaeger credentials

After obtaining jaeger's credentials, I then proceeded to login to the SSH server and was able to obtain `user.txt`.

Fig 26. Obtained user flag

### Privilege Escalation Checking the `sudo -l` for jaeger, I can see that he was able to run `/home/deploy/password-manager` as the user `deploy`.

Fig 27. Jaeger able to run password-manager as user deploy

Viewing the permissions inside the directory `/home/deploy`, I was not able to view the `creds.txt` and `password-manager.cpp` files.

Fig 28. Permissions for files in /home/deploy

Let's run the `/home/deploy/password-manager` file as the user `deploy`. It seems that I need the master password in order to view the passwords inside the Josh password manager.

Fig 29. Running password-manager

Using `strings` command and specifying the encoding as little endian, I obtained the string `Sample`.

Fig 30. Strings with little endian format

Keying in `Sample` as the master password, I was able to obtain the credentials for the user `deploy`.

Fig 31. Obtained deploy creds

Switching to user `deploy` , I realised that it is not able to run `sudo` on the target machine.

Fig 32. Unable to run sudo on deploy

Checking the `id` on `deploy`, we can see that it is in the `docker` group.

Fig 33. Deploy part of docker group

I was then able to use docker to obtain root privileges and got `root.txt` file.

Fig 34. Docker privilege Escalation