# GoBox CTF

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FOUDPhNlwAb63Jjycu8gF%2Fimage.png?alt=media&#x26;token=9b2c13be-2d7a-4ce4-8fb8-7dbb903a039f" alt=""><figcaption></figcaption></figure>

HackTheBox made Gobox to be used in the Hacking Esports UHC competition on Aug 29, 2021. Once the competition is over, HTB put it out for all of us to play. This is neat box, created by IppSec, where I’ll exploit a server-side template injection vulnerability in a Golang webserver to leak creds to the site, and then the full source. I’ll use the source with the SSTI to get execution, but no shell. I’ll write a script to make enumeration easy, and then identify the host is in AWS, and is managing a bucket the hosts another site. I’ll upload a PHP webshell to get a shell on the main host. Finally, I’ll find a backdoor NGINX module which is enabled, reverse it to get execution, and get a shell as root.

Starting with nMap scan

```shell
nmap -sV -sC -A -p- 0-10000 10.129.95.236
```

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2Fv6Y2gPLd5ioHHCxCp0ON%2F1.PNG?alt=media&#x26;token=cb288958-ef90-465f-ba11-efa11bb1032a" alt=""><figcaption></figcaption></figure>

what I was able to find on web for each port

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FLI7TW1XCKq3fdOm4BanH%2F2.PNG?alt=media&#x26;token=2f7eb0c2-e398-412a-9940-42cc482e4091" alt=""><figcaption><p>Port 22</p></figcaption></figure>

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FrgfXriilNoIcP8KJWsX3%2F3.PNG?alt=media&#x26;token=f07e369f-39b7-4943-837e-ba34892dc6d6" alt=""><figcaption><p>Port 80</p></figcaption></figure>

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FBxeZVAy7xO731gGLAilV%2F4.PNG?alt=media&#x26;token=522d777e-84f6-4a6d-b295-9a278e37791a" alt=""><figcaption><p>port 4566</p></figcaption></figure>



<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FceD2VcMLNqqMcMzvEuFd%2F5.PNG?alt=media&#x26;token=2850d230-15f3-441f-8f5f-8c092e53f354" alt=""><figcaption><p>port 8080</p></figcaption></figure>
