Hack the Box - Ai
Posted on January 25, 2020 • 4 minutes • 850 words
Welcome back! Today we are doing the Hack the Box machine - Ai. This is a Linux box with a medium difficulty. Let’s see what’s in store!
As always we kick it off with our
nmap -sC -sV -T4 -p- -oA all_ports 10.10.10.163
Here are our results:
Host is up (0.060s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 6d:16:f4:32:eb:46:ca:37:04:d2:a5:aa:74:ed:ab:fc (RSA) | 256 78:29:78:d9:f5:43:d1:cf:a0:03:55:b1:da:9e:51:b6 (ECDSA) |_ 256 85:2e:7d:66:30:a6:6e:30:04:82:c1:ae:ba:a4:99:bd (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Hello AI! Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 72.04 seconds
Well, it looks like web services are the way in. Let’s see whats being hosted on port 80.
We have a Artificial Intelligence site. The links lead to
php files. We’ll start our enumeration with
gobuster dir -u ai.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 75 -x php
Here are our results:
/uploads (Status: 301) /images (Status: 301) /index.php (Status: 200) /db.php (Status: 200) /contact.php (Status: 200) /about.php (Status: 200) /intelligence.php (Status: 200) /ai.php (Status: 200) /server-status (Status: 403)
Now we’ll start visiting these pages to see if there are any paths forward. We see that the premise of the site is using voice recognition from audio files as a search engine. On the
ai.php page we see there is an upload form requesting a
.wav file. So we’ll upload a sample file and see what happens. We get a response:
Good to know info, we’ll move onto the next page which was
intelligence.php. Here is a list of supported API calls. So my logic here is to create a
.wav with some type of text to speach engine using the provided api to craft my payload.
A quick google search for ’text to speech download’ lead me to a few sites. We need the ability to download our crafted payload as well, simply saying it back isn’t quite good enough.
Now let’s craft an
SQL injection using our documentation. It’s noted at the bottom of the page that they mostly follow Microsoft’s approach. So we dig up a list of recognized commands, here
. Now we can seemingly using things like ‘open parenthesis’ and ‘close parenthesis’ to craft our statement.
Crafted database command:
won open single quote union select database open parenthesis close parenthesis comment database
Is the same as saying:
1'union select database()-- -
So now that we’ve input this text-to-speech in, we save the file. Next we need to convert the file to a
.wav. There are plenty of ways to do this. Two that can be done nativly in Kali are:
ffmpeg -i input.mp3 output.wav or
mpg123 -w output.wav input.mp3.
Now that we have the payload compiled so to speak, let’s upload it.
Look’s like it worked! We have a database name of
alexa. We will continue to craft payloads until we get what we need. It should be noted that sometimes the playback speed at certain parts of the payload needed to be slowed down. In the case of finding the table:
won open single quote union select table underscore schema comma table underscore name comma won from information underscore schema dot tables
This needed to be modified a bit more heavily, speed, emphisis and voice.
After much trial and error, we finally get the user password:
Great, now we have a username and password. Maybe it’ll work for
We are in. We snag our
user.txt flag and start enumerating for root. We sping up a
SimpleHTTPServer and download
Linpeas.sh onto the box. We see that there are few more open ports available to us:
We also see
Tomcat running a cron job:
As well as
Java task running that references
Tomcat running on port 8000:
After doing some research it looks like this is Java Debug Wire Protocol
. THe give away was the jdwp in the process running:
jdwp=transport. The first google seach for this came back with quite a few RCE on the protocol. This one
does a great job of breaking it down. It also has a proof of concept, here
We copy the file to the server and run it.
It seems to execute but we never catch a shell via
netcat. Let’s craft a payload with
msfvenom. We issue
msfpc elf tun0 to generate a Linux payload. We can then copy this payload to the server under
/tmp. Then we will launch our MSF listener and retry our payload. Still doesn’t work. After some furthre digging it was suggested to try a different Java method to hook from. We’ll use a pretty basic one of
java.lang.String.indexOf. This time we run it and get a shell!
root.txt is right as we land in. Box complete! This was quite a unique box for sure, I really enjoyed it.
Hopefully something was learned. If you found this write-up helpful, consider sending some respect my way: Lovecore’s HTB Profile .