Interpreter machine HTB

OS: Linux || Difficulty: Medium

.بسم الله والصلاة والسلام على أشرف خلق الله سيدنا محمد ﷺ وعلى آله وصحبه أجمعين

Let’s dive in

Let’s jump right in — no time to waste

started with an Nmap scan to identify open ports and services:

nmap -sCV -A <TARGET_IP>

• 22 (SSH)
• 80 (HTTP)
• 443 (HTTPS)

Both HTTP and HTTPS services were running a Jetty web server hosting a Mirth Connect Administrator panel.

Web Enumeration

Let’s click on “Launch Mirth Connect Administrator”. This downloads a webstart.jnlp file, so let’s go ahead and see what happens.

After taking a look at webstart.jnlp file, I noticed something interesting.

Inspecting it revealed the version: Mirth Connect 4.4.0

After searching for this version, I found a related CVE.

Now, it was time to dig deeper and see how this vulnerability could be exploited.

I made several attempts to exploit the vulnerability manually, but none of them were successful.

After that, I kept searching for a suitable PoC that would allow me to use its script to directly exploit the vulnerability.

Finally, I found a working exploit script,let’s jump into the real exploitation.

At first, I spent quite some time setting up the required dependencies to run the script. If you face the same issue, just be patient and use AI to help you out.

And here we go, the shell was successfully obtained.

Since the shell was non-interactive, I upgraded it:

python3 -c 'import pty; pty.spawn("/bin/bash")' 

During enumeration, I found database credentials in a configuration file at /usr/local/mirthconnect/conf/mirth.properties.

The file contained:

database.username = mirthdb
database.password = MirthPass123!

This exposed plaintext credentials for the backend database.

Using the discovered credentials, I accessed the local MariaDB instance:

mysql -u mirthdb -p -h 127.0.0.1 mc_bdd_prod

After logging in, I extracted user credentials using:

SELECT CONCAT(p.USERNAME, ':', pp.PASSWORD)
FROM PERSON p
JOIN PERSON_PASSWORD pp ON p.ID = pp.PERSON_ID;

This returned a username and hashed password.

The retrieved value was a PBKDF2-HMAC-SHA256 hash.

Get Veen0o21’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

After converting it into a format suitable for Hashcat, I cracked it using:

hashcat -m 10900 hash.txt rockyou.txt

The password for the user sedric was:

snowflake1

Now that we have a username and password, the question is: what can we do with them?

Hurray!!! I got the user flag.

Alright, let’s dive into privilege escalation!

Let’s dive into enumerating the system for privilege escalation vectors.

First

Let’s try a different approach.

Since sudo was not available on the system, I proceeded with manual enumeration of running processes to identify potential privilege escalation vectors:

ps aux

While reviewing the output, I focused on processes running as root .

Among the listed processes, a custom Python script caught my attention:

/usr/local/bin/notif.py

This script was running as root, making it a prime target for further analysis.

Let’s take a look at it.

After analyzing it and understanding how it works, I found something interesting.

What exactly does this script do?

The script (notif.py) is a custom Flask-based service designed to process incoming patient data via an HTTP endpoint.

It listens on a local port and accepts XML-formatted input containing fields such as first name, last name, gender, and birth date. After parsing the XML data, the application inserts the extracted values into a predefined message template.

This template is dynamically rendered using Python f-strings, where placeholders (e.g., {firstname}) are replaced with user-supplied values. The resulting string is then passed to the eval() function, causing it to be executed as Python code.

As a result, the application effectively behaves like a templating engine that executes user-controlled input, leading to a critical security vulnerability.

Because user input is directly embedded into the template, I was able to inject a malicious Python expression inside {}, resulting in code execution with root privileges.

Finally, we got the root flag!

See you in the next machine write-up, Insha’Allah.