Hackthebox - Mango

From nmap, there are ssh, http, and https services opened.

This is the http web page.

This is the https web page.

This is a domain mentioned in nmap’s result.

From the title Mango, I got the idea of MongoDB. I tried the login page with [$ne] to confirm my thought. And the page changed because I create a true statement.

I used an open-source python script to get the username and password.

I successfully login to the server with ssh as mango. I can switch to admin with the other credential. From /etc/ssh/sshd_config, we can see that admin is not allowed to login from ssh.

There is an interesting SUID binary jjs.

From gtfobins, I found a way to write ssh public key to /root/.ssh/authorized_keys. After that, I can ssh to the server as root.