🛒THM Marketplace

The sysadmin of The Marketplace, Michael, has given you access to an internal server of his, so you can pentest the marketplace platform he and his team has been working on. He said it still has a few bugs he and his team need to iron out.

Step 1 – Enumeration

Got 3 open port and 2 of them are web http. Looking towards both web port has same display. Let focus on port 80.

Direct access to admin but we don’t have permission. More digging on directory.

From here, I notice some familiar vulnerable from past exercise. The things is admin, message and reports. Let move forward to register.

From here, just put anythings.

Step 2 – XSS exploitation

We got some form to submit title and description for new item. Then this item will be listing on home page. Other that, we have options to report and contact. Hint here. Report and message. Let proof the concept of XSS.

The payload xss are the basic one. Let check.

Proof that this /new are venerable to xss. We can gain admin cookies without have the credentials. The method is, we gonna upload our xss script. Then report to admin. Once admin read the message, we will grab the token/cookies of that admin.

Step 3 – Admin Access

For this, I’m not familiar with the xss payload. Using favourite github page to find out the suitable payload for grab cookies.

Change payload to image since it crashes when using xss grabber.php.

After a while, we manage to get admin cookies. Let put into cookies and access to admin page.

Step 4 - SQL injection

Moving forward, we noticed that these pages have all user and type of admin. We known 2 admin which Michael and Jake.

When click on any user, it appears to have ?users=[id] which this vulnerable to SQL injection. At first going to do manually, but I’m to lazy. Soorrryy.

Open to sqlmap and dump everything.

sqlmap http://targetmachine/admin?user=1 --cookie=[cookies]' --technique=U --delay=2 -dump

From here we got tone of valuable information and ofc some juicy information.

Step 5 – User Access

Using the credentials, let login in ssh.

Since we have the password, let check user permission. We notice jack can be micheal without password using backup.sh

What is backup.sh??

Notice * which mean wildcard injection. Let check gtfobin and pass exercise.

Create payload or just edit past payload.

Run as Michael.

Don’t forget to open listener with stated port.

Step 6 – Root Access

Checking into id, Michael have docker access.

And this docker are vulnerable which been reported. Synack.

Using gtfobin and establish root shell.

Finally, manage to get root in this machine.

Study

1. XSS in listing form led to Admin access.

2. SQL injection in user.

3. Not patching docker lead to root privilege.