{"id":154,"date":"2026-02-01T16:18:54","date_gmt":"2026-02-01T16:18:54","guid":{"rendered":"https:\/\/patatties.nl\/?p=154"},"modified":"2026-02-01T16:18:54","modified_gmt":"2026-02-01T16:18:54","slug":"htb-knife","status":"publish","type":"post","link":"https:\/\/patatties.nl\/?p=154","title":{"rendered":"HTB: Knife"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Host is up! Lets start with a portscan!<\/p>\n\n\n\n

\u250c\u2500\u2500(root\u327fkali)-[~\/.ssh]\n\u2514\u2500# nmap -p- -sC -sV 10.129.14.142\nStarting Nmap 7.98 ( https:\/\/nmap.org ) at 2026-02-01 09:53 -0500\nNmap scan report for 10.129.14.142\nHost is up (0.0067s latency).\nNot shown: 65533 closed tcp ports (reset)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 be:54:9c:a3:67:c3:15:c3:64:71:7f:6a:53:4a:4c:21 (RSA)\n|   256 bf:8a:3f:d4:06:e9:2e:87:4e:c9:7e:ab:22:0e:c0:ee (ECDSA)\n|_  256 1a:de:a1:cc:37:ce:53:bb:1b:fb:2b:0b:ad:b3:f6:84 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))\n|_http-title:  Emergent Medical Idea\n|_http-server-header: Apache\/2.4.41 (Ubuntu)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 16.12 seconds\n<\/code><\/pre>\n\n\n\n
Pretty standard 22,80 portcombo. Lets see what this website contains.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
A pretty website. It seems to be fully static html though. I seem to remember this website from years ago, and seem to rememeber not getting far haha.<\/p>\n\n\n\n
Lets have a look around. Spraying around with a bit of dirb i find that we’re running php. Looking a bit more at the page source, there seems to be a bit of javascript there, pulled from a public repo, so it seems.<\/p>\n\n\n\n
   <script src=\"https:\/\/cpwebassets.codepen.io\/assets\/common\/stopExecutionOnTimeout-157cd5b220a5c80d4ff8e0e70ac069bffd87a61252088146915e8726e5d9f147.js\"><\/script>\n\n  \n      <script id=\"rendered-js\" >\nvar TxtRotate = function (el, toRotate, period) {\n  this.toRotate = toRotate;\n  this.el = el;\n  this.loopNum = 0;\n  this.period = parseInt(period, 10) || 2000;\n  this.txt = '';\n  this.tick();\n  this.isDeleting = false;\n};\n\nTxtRotate.prototype.tick = function () {\n  var i = this.loopNum % this.toRotate.length;\n  var fullTxt = this.toRotate[i];\n\n  if (this.isDeleting) {\n    this.txt = fullTxt.substring(0, this.txt.length - 1);\n  } else {\n    this.txt = fullTxt.substring(0, this.txt.length + 1);\n  }\n\n  this.el.innerHTML = '<span class=\"wrap\">' + this.txt + '<\/span>';\n\n  var that = this;\n  var delta = 300 - Math.random() * 100;\n\n  if (this.isDeleting) {delta \/= 2;}\n\n  if (!this.isDeleting && this.txt === fullTxt) {\n    delta = this.period;\n    this.isDeleting = true;\n  } else if (this.isDeleting && this.txt === '') {\n    this.isDeleting = false;\n    this.loopNum++;\n    delta = 500;\n  }\n\n  setTimeout(function () {\n    that.tick();\n  }, delta);\n};\n\n\nwindow.onload = function () {\n  var elements = document.getElementsByClassName('txt-rotate');\n  for (var i = 0; i < elements.length; i++) {if (window.CP.shouldStopExecution(0)) break;\n    var toRotate = elements[i].getAttribute('data-rotate');\n    var period = elements[i].getAttribute('data-period');\n    if (toRotate) {\n      new TxtRotate(elements[i], JSON.parse(toRotate), period);\n    }\n  }\n  \/\/ INJECT CSS\n  window.CP.exitedLoop(0);var css = document.createElement(\"style\");\n  css.type = \"text\/css\";\n  css.innerHTML = \".txt-rotate > .wrap { border-right: 0.04em solid #666 }\";\n  document.body.appendChild(css);\n};\n\n\nvar path = document.querySelector('path.pather1');\nvar length = path.getTotalLength();\n\n\/\/ Clear any previous transition\npath.style.transition = path.style.WebkitTransition =\n'none';\n\/\/ Set up the starting positions\npath.style.strokeDasharray = length + ' ' + length;\npath.style.strokeDashoffset = -length;\n\/\/ Trigger a layout so styles are calculated & the browser\n\/\/ picks up the starting position before animating\npath.getBoundingClientRect();\n\/\/ Define our transition\npath.style.transition = path.style.WebkitTransition =\n'stroke-dashoffset 4s linear';\n\/\/ Go!\npath.style.strokeDashoffset = '0';\n\/\/# sourceURL=pen.js\n    <\/script><\/code><\/pre>\n\n\n\n
Perhaps this is where the vulnerability exists? This javascript seems broken though in my browser. Its calling a bunch of documents. Is that where i provide some input that i can control?<\/p>\n\n\n\n
Chucking some more version numbers into exploit-db, i find that this specific php version is vulnerable to the php version user agent, and could achieve RCE (Remote Code Execution). https:\/\/www.exploit-db.com\/exploits\/49933<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We’re in! We’re James. We get the user flag! But a very limited shell.<\/p>\n\n\n\n
This shell always runs from the root directory, and doesnt remember what directory we’re in. Lets get a better shell. The most simple way is to echo my ssh key into james’s authorized keys file, and connecting using ssh.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
That worked, we connect using SSH! Back in the day it was normal to have RSA keys.<\/p>\n\n\n\n
Lets see what we can do with sudo.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We can run the knife binary as root. Lets check it out.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
I’m kinda hoping i can just rebind the link to something else. Otherwise we’ll have  a look at the real knife script?<\/p>\n\n\n\n
Whelp, updating the link doesnt seem to work. After some searching online, i find that there exist GTFO bins for knife specifically! :0<\/p>\n\n\n\n
So lets give that a try. I actually nest a ruby gtfobin in the knife gtfobin, and Result!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
That ends this box!<\/p>\n\n\n\n
\n\n\n\n
Conclusion<\/h2>\n\n\n\n
I kinda liked this box! It was very easy though looking back at it. Nothing really special though. I’m not sure why i struggled with it so much back in the day.<\/p>\n\n\n\n
What i learned this time is to check ALL the software stack, cause i didnt think to check PHP version for quite some time!<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Host is up! Lets start with a portscan! Pretty standard 22,80 portcombo. Lets see what this website contains. A pretty website. It seems to be fully static html though. I seem to remember this website from years ago, and seem to rememeber not getting far haha. Lets have a look around. Spraying around with a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-154","post","type-post","status-publish","format-standard","hentry","category-htb"],"_links":{"self":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=154"}],"version-history":[{"count":1,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/154\/revisions"}],"predecessor-version":[{"id":164,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/154\/revisions\/164"}],"wp:attachment":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}