Instant-htb

#

First of all add the machine IP to your /etc/hosts file.

The nmap scan for the machine IP showed:

I didn’t use any options as it gives quick results but also provides less details.

There is http and ssh in default ports. The HTTP server seems to be a wallet webapp. Only interaction i could get was download and contact us. I downloaded the apk and used apktools.

apktool d instant.apk

This revealed the application’s code and assets, including Smali files that contain the app’s logic.

I checked “/smali/com/instantlabs/instant/adminactivities.smali” and found a JWT token and used it in burp suite. Also, I found another sub domain there “mywalletv1.instant.htb”. Using this as host and adding the JWT token as authorization I ran burpsuite.

Then I looked in xml directory inside res directory. I concated the “network_security_config.xml” file and found another subdomain, “swagger-ui.instant.htb”. Then i used this in burp requesto to views logs.

Then I used LFI exploit

I used LFI to get ssh key

Privilege Escalation

#

After gaining the ssh shell, I used linpeas.sh to scan the machine and found an db(instant.db).

There were some hashed passwords and usernames but i was unable to crack the hash. So, I checked another file i found using linpeash, “sessions-backup.dat” present in /opt/backups folder.

It normally contains passwords for root. It had encrypted password.

I used this github repo to crack it: “https://github.com/ItsWatchMakerr/SolarPuttyCracker”.

Then I switched to root and got the root flag.