Linux

Active machine — write-up published after retirement.

Active machine — write-up published after retirement.

Active machine — write-up published after retirement.

Active machine — write-up published after retirement.

Active machine — write-up published after retirement.

Overview Chamilo LMS 1.11.24, Ubuntu 22.04. Release: 2024-07-06. Retire: 2024-11-02. IP: 10.10.10.x. Chain: unauthenticated file upload to RCE (CVE-2023-4220), a reused Chamilo database password for the mtz system account, then a symlink-following sudo ACL script for root. Reconnaissance Port scan 1 2 nmap -p- --min-rate 10000 10.10.10.x nmap -p 22,80 -sCV 10.10.10.x Open ports: 22/tcp: OpenSSH 8.9p1 (Ubuntu 22.04 jammy) 80/tcp: Apache 2.4.52, redirects to http://permx.htb Subdomain fuzzing The server routes HTTP requests by the Host header, so fuzz subdomains: ...

Overview Snoopy is a Hard-rated Linux box that chains together a long list of misconfigurations and freshly-disclosed CVEs. The path starts with a ../ filter bypass in a file-download endpoint, which is enough to read the BIND9 configuration and leak the TSIG key protecting the DNS zone. With that key we take control of mail.snoopy.htb, redirect Mattermost password-reset mail to a controlled SMTP sink, and take over an account. Inside Mattermost, a custom /server_provision slash command can be pointed at an attacker-controlled host, so we catch cbrown’s SSH credentials with a honeypot. From cbrown we abuse a regex-restricted sudo git apply rule (CVE-2023-23946) with a symlink patch to write into sbrown’s home. Finally, sbrown can run clamscan --debug as root, and CVE-2023-20052 - an XXE in ClamAV’s DMG parser - leaks root’s SSH private key straight into the debug output. ...

Overview Machine author: Tr1s0n. IP: 10.10.10.x. Chain: forum token, escalation to admin, XXE (file / source read), Redis (session replacement), access to developers., LFI + PHP filter chain (RCE as www-data), PHP-FPM / FastCGI (pivot to victor), prototype pollution in a Node.js API (RCE as root). Reconnaissance 1 nmap -sV -sC -p- 10.10.10.x Open: 22 (SSH), 80 (HTTP). Redis (6379) is local only / password protected. 1 10.10.10.x collect.htb developers.collect.htb The vhost developers.collect.htb is protected by Basic Auth. ...

Overview Ubuntu 20.04. IP: 10.10.10.x. Topics: SSTI (Spring Boot), log poisoning, path traversal, XXE, source code review. Chain: SSTI in the search box, shell as woodenk, credentials in the source, SSH, analysis of a root cron job (a Java jar), a four-vulnerability chain (log poisoning + path traversal + metadata-driven path injection + XXE), the root SSH key, root. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV 10.10.10.x 22/tcp: OpenSSH 8.2p1 (Ubuntu) 8080/tcp: HTTP (http-proxy) HTTP (port 8080): ...

Overview Altered is a Hard-rated Linux machine built for a UHC (Ultimate Hacking Championship) event. Machine author: ghost-2. Operating system: Ubuntu 20.04 Focal. IP: 10.10.10.x. A Laravel staff dashboard leaks valid usernames through its login errors. The password reset issues a four-digit PIN and throttles by client IP, but the app trusts X-Forwarded-For from any client, so pairing every PIN guess with a fresh spoofed IP defeats the limiter and recovers the PIN. An authenticated API endpoint guards its records with an MD5-looking secret compared using PHP’s loose ==, so sending the secret as the boolean true bypasses the check - and because the id field also accepts a string, it opens a UNION-based SQL injection. The database account holds FILE, so INTO OUTFILE writes a PHP webshell into the web root for a shell as www-data. The kernel is 5.16.0 from January 2022, vulnerable to Dirty Pipe (CVE-2022-0847); a SUID binary overwrite (or an /etc/passwd edit past a pam_wordle gimmick) gives root. ...