Prostore: Proving Grounds Linux Walkthrough

Nmap output

Nmap scan report for 192.168.217.250
Host is up (0.057s latency).
Not shown: 65531 filtered tcp ports (no-response), 2 closed tcp ports (conn-refused)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 1c:19:57:44:ae:0d:f4:06:b1:bc:ee:35:d0:c7:53:31 (ECDSA)
|_  256 cf:a2:3b:50:fd:d0:38:0f:4b:bb:68:2f:b9:a9:02:20 (ED25519)
5000/tcp open  http    Node.js (Express middleware)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: ProStore
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have ecommerce store here

Prostore walkthrough, Got reverse shell as root, screenshot 1 — Prostore, step 1

We registered and loggedin as user & product to cart

Prostore walkthrough, Got reverse shell as root, screenshot 2 — Prostore, step 2

On checkout page we filled random details

Prostore walkthrough, Got reverse shell as root, screenshot 3 — Prostore, step 3

Sent request to burpsuite repeater & added random character to captcha & we see reference error which indicates SSTI

Prostore walkthrough, Got reverse shell as root, screenshot 4 — Prostore, step 4

Passed reverse shell ssti payload

Got reverse shell

Got local.txt (098ad6154efd34999a0cd7de719de09d)

Prostore walkthrough, Got reverse shell as root, screenshot 7 — Prostore, step 7

We have a unknown guid binary

Prostore walkthrough, Got reverse shell as root, screenshot 8 — Prostore, step 8

We can add ; to run different command in the same

Prostore walkthrough, Got reverse shell as root, screenshot 9 — Prostore, step 9

Getting reverse shell using above method

Got reverse shell as root

Got proof.txt (0ed03f8e31b2c71b12a070c8fb5edcb0)

Prostore walkthrough, Got reverse shell as root, screenshot 12 — Prostore, step 12

More walkthroughs

BitForgeLinux

Full walkthrough of the BitForge box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.

CLUELinux

Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

CockpitLinux

Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.