HTB: SecNotes
SecNotes kicks off with a notes web app on port 80 and a CSRF flaw in its password-change page, which we abuse through the contact form to take over tyler's account. His notes leak SMB creds for a writable share, so we drop a PHP webshell, catch a shell and grab the user flag. For root the real trick is a Windows Linux subsystem (WSL) whose bash history is sitting on administrator credentials, so we psexec in and own the box.
Looking at our nmap we have just a few things running here, some sort of login page on port 80. Let's go check that out first, we create an account and log in.
Seems like some sort of note-viewing app. Let's explore this a bit.
At the top we see someone to contact for support, tyler@secnotes.htb, so let's note this user down. Checking out the change_pass.php page, we find there's no confirmation of the current password, it just changes it. That means we can forge a password-change request and send it through the contact form to get tyler to change their own password for us. We cook up a quick CSRF proof-of-concept.
And serve it up with a simple Python web server.
Now let's ship it through the contact form. It worked, they clicked the link... but when we try to log in we find it did not actually change the password. Let's try sending the request a different way.
Sending the request straight like this actually worked, lol. Very simple, and it seems automated, they just hit it and we were into tyler's account.
Looking at the account we have a bunch of notes to go through, and the new-site note has credentials for tyler!
We also have a domain for a site share. Let's add it to our hosts file and see if we can visit that new site.
Let's run netexec and see what shares we have access to, spidering them with the spider_plus module.
nxc smb 10.129.118.137 -u tyler -p '<tyler password from the note>' -M spider_plus
We have READ,WRITE on new-site! That's a great entry point. We make a tiny PHP webshell locally, just a one-liner that runs whatever command we pass it in a GET parameter, save it as shell.php, and push it up to the writable share with smbclient.
smbclient '//10.129.118.137/new-site' -U 'tyler%<password>' -c 'put shell.php'
Now we hit the webshell through the browser and feed it a one-liner that kicks a reverse shell back to our netcat listener.
We're in! Heading over to tyler's desktop we find the user.txt flag.
Now let's check for privileges. Our shell is a bit flimsy and keeps dropping, but we push on.
Nothing special there, but this box has a Linux subsystem (WSL) running. Checking its .bash_history, we strike gold, admin credentials sitting right there in the history.
We go straight to impacket-psexec and log in as the administrator, then grab the root.txt flag off the admin desktop!
This box was pretty fun, simple but enjoyable. We almost got stuck in an enumeration loop once we had that foothold, but after digging around we came across that Linux subsystem. Good reminder: always enumerate everything you find, even a subsystem you think is nothing can be holding the keys.
