SSH

Synopsis: # Cozy hosting is a project hosting service web app hosted on nginx 1.18.0. From directory busting a few endpoints were discovered which disclosed a user’s session cookie via replacing the session cookie the attacker logged in the /admin endpoint. And in that page there was a functionality to check for live hosts using SSH which found out to be vulnerable to OS Command Injection. By exploiting that vulnerability the attacker gained the initial foothold and landed as the user apps. From the /apps directory a java archive was found upon decompiling the archive file the postgres user’s password was found which was later used to login into the database, from the database the admin user’s password hash was captured and got cracked via hashcat later. Using the cracked hash it was possible to login on behalf of the user josh via SSH. After landing on the host as the user josh it was found out that the user could run SSH with sudo privilege which lead to sudo abuse and the host got compromised completely.