[Hack The Box] Codify

• OS: Ubuntu Linux
• Web technology: Apache 2.4.52 / Node.js Express framework
• Hostname: codify.htb
• IP: 10.10.11.239

Attack and enumeration notes

3000 (HTTP) Bootstrap[4.3.1] Node.js Express framework
80 (HTTP)
22

Privilege escalation

* Check service
* Check network (everything running under 127.0.0.1)
* Check cronjob (maybe upload pspy)
* Check the versions of package of the services running under 127.0.0.1 (dmesg |grep -i 'mysql' --color=auto)
* getcap -r / 2>/dev/null
    if capabilities for python just 'import os;os.system("/bin/dash")' and RUN ROOT ~#