Registry HTB Machine Writeup
Writeup is outdated and the attack path presented for user bolt has been patched. Initially from the bolt user to www-data we could run restic as root and abuse the sftp.command parameter to execute any command as root. Portscan root@kali:~# nmap -T4 -sC -sV -p- 10.10.10.159 Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-20 19:05 EDT Nmap scan report for registry.htb (10.10.10.159) Host is up (0.044s latency). Not shown: 65532 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 72:d4:8d:da:ff:9b:94:2a:ee:55:0c:04:30:71:88:93 (RSA) | 256 c7:40:d0:0e:e4:97:4a:4f:f9:fb:b2:0b:33:99:48:6d (ECDSA) |_ 256 78:34:80:14:a1:3d:56:12:b4:0a:98:1f:e6:b4:e8:93 (ED25519) 80/tcp open http nginx 1.14.0 (Ubuntu) |_http-server-header: nginx/1.14.0 (Ubuntu) |_http-title: Welcome to nginx! 443/tcp open ssl/http nginx 1.14.0 (Ubuntu) |_http-server-header: nginx/1.14.0 (Ubuntu) |_http-tit...
