Mango is a vulnerable machine with Linux operating system among retired machines and it is expected to obtain user and root flags using these vulnerabilities.
We perform a network scan with nmap to recognize the target machine.
Classic Scan

Full port scan

As a result of port scanning, 22/tcp ssh OpenSSH 7.6p1, 80/tcp http Apache httpd, 443/tcp ssl/http Apache ports are open. In the port scan, we encountered commonName=staging-order.mango.htb in the ssl section, so we added both subdomain and domain to the hosts file.

we encountered a forbbine error when we went to pot

We ran a Gobuster scan and got nothing.

We accessed via https which is port 443

We looked at the source code in wepanalayzer in developer mode and couldn’t find anything.
We only saw /analytics.php in the web interface and we could not get any information here.

We ran a scan with Gobuster and still no results

Let’s look at the subdomains we detected in the last nmap scan

We looked at the web interface, we looked at the source code, we looked with webanalayzer, we could not get a result, we did a scan with gobsuter

Sonuç bulamadık

Let’s look at the input values here and see what we can do
We tried defautta passwords in the admin password section, we could not log in successfully, Forgot Password butpno does not work.
Let’s intercept with burp suite and listen to it

Here we saw username=admin&password=admin&login=login where we tried sqlinjection attacks but without success.
We are trying nosql injection attack
Let’s try the attack management given here

After sending it here, it goes to the /home.php page, but here it says that the page is not working.
There is a nosql vulnerability here, we are looking at the hacktrick part to exploit it, we can get the users inside out

We used this tool
First we downloaded this tool and then we looked at the use of this tool.

2 username(s) found:
We have detected credential information
let’s try to make a ssh connection with this information
We logged in using the information mango:h3mXK8RhU~f{]f5H

Here we request the admin user to get the use.txt flag, we change our user authorization by doing this, thanks to the credential information we obtained.

We got our user flag, but we did not have our aroot etimizi, so we provide local enumeration

We came across jss, this thing appeared under the home directory.
Let’s look at it from the gtfobin folder, is there a method of exploding it?

sudo install -m =xs $(which jjs) .
echo “Java.type(‘java.lang.Runtime’).getRuntime().exec(‘/bin/sh -pc \$@|sh\${IFS}-p _ echo sh -p <$(tty) >$(tty) 2>$(tty)’).waitFor()” | ./jjjs
let’s modify this command to suit ourselves
After exec ten
‘cp /bin/bash /tmp/exec’
Copy bash to the tmp directory
Then we made this exec run in the group
We run it with root authorization with -p

In this way we can obtain root privileges