Hackthebox: DevArea

DevArea , a medium difficulty HackTheBox machine dealing with Java web services exploitation and Linux privilege escalation. We exploited a SSRF vulnerability in an Apache CXF SOAP service to read sensitive files from the server, which leaked credentials for an internal proxy service. Using those credentials we achieved remote code execution through the proxy’s middleware API, gaining an initial foothold. From there, we escalated to root by abusing an insecure script that called system binaries without full paths, allowing us to hijack execution and obtain a root shell.

as always with start with nmap scan

okay we found a lot of interesting things , the most important one is an ftp server with anonymous login , but first let’s dive in the website and check things

okay it is basically a website for hiring developers, the login and register are dead links

looking more i found some employees

we save them we might use them and going more i saw some users

we save them too

let’s recheck the ftp server , from the nmap scan we knew that the anonymous login is allowed (which means no password is required) , going in i found a .jar file so i grabbed it

while looking at the classes i had to decompile it so i used jadx to review the source code

one of the things that i found is the way the serverstarter actually works , so by looking at it i knew how the server works , this triggered me in a way i can perform ssrf , so i tried to check for security dependencies , i used trivy in this one

looking at trivy i found a cve that is considered critical , CVE-2022–4634 , basically it is a A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type

so i made a curl request with the poc i found and i encoded it in base 64

then i pipe it and decode in onshot , i found the /etc/passwd

here i found an intersting user , dev_ryan

i tried to find a way to find the password , i remember that i found an api so i checked it

the default creds won’t work here , so i tried something else

Get Dhiasaid’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

by going on the employee service and using that cve we found before i was able to find the admin and password

logging in there and i got access to the dashboard

we found the version of hoverfly , and we found a cve

CVE-2024–45388

from here i grabbed a token

and then i added that session token into a reverse shell payload

launching an sh and we got the flag (btw i started it with bash but wasn’t helpful

and then i got an sh shell

this a a previous screenshot i forgot to screenshot the new one

but we managed to grab user flag

now we go to the painful one ,

privilege escalation

basically by typing sudo -l i found out that i can execute systemwatch.sh

as root

the problem is with the shell , i need to overwrite the /bin/bash with sh because /bin/bash is world-writabable

from there i executed the fake shell

i found the fake sh with SUID , now executing it

i got access as root

the user part was easy , chaining some vulns , but the root part, it took me hours to find out that i was using the wrong type of shell

good machine

till the next one