Stocker
Stocker
Stocker 523
Stocker
RETIRED MACHINE

Stocker

Stocker - Linux Linux
Stocker - Easy Easy

4.5

MACHINE RATING

12522

USER OWNS

12222

SYSTEM OWNS

14/01/2023

RELEASED
Created by JoshSH

Machine Synopsis

Stocker is a medium difficulty Linux machine that features a website running on port 80 that advertises various house furniture. Through vHost enumeration the hostname `dev.stocker.htb` is identified and upon accessing it a login page is loaded that seems to be built with `NodeJS`. By sending JSON data and performing a `NoSQL` injection, the login page is bypassed and access to an e-shop is granted. Enumeration of this e-shop reveals that upon submitting a purchase order, a PDF is crafted that contains details about the items purchased. This functionality is vulnerable to HTML injection and can be abused to read system files through the usage of iframes. The `index.js` file is then read to acquire database credentials and owed to password re-use users can log into the system over `SSH`. Privileges can then be escalated by performing a path traversal attack on a command defined in the sudoers file, which contains a wildcard for executing `JavaScript` files.

Machine Matrix

Ready to start your
hacking journey?