TwoMillion — Easy Level Linux based Machine Writeup
This write-up covers my full exploitation of the 2million HTB machine, starting from basic enumeration and digging through obfuscated JavaScript, to exploiting a flawed API with Burp Suite for admin access. From there, I move into command injection, credential discovery via .env, SSH access, and finally rooting the box using an OverlayFS vulnerability. It’s a quick but detailed walkthrough of the exact steps and thinking that led to the compromise.
Tools Used:
· Nmap
· BurpSuite
I started with a NMAP Scan to detect any open ports:
The page wouldn’t load. A quick DNS resolution solved it:
echo”10.10.11.221 2million.htb” | sudo tee -a /etc/hosts
Once the page opened, I examined the site and found a suspicious link.
2million.htb/invite:
Checking the source code, something interesting popped up inside a JavaScript file:
The script looked obfuscated, one giant unreadable line. So I grabbed it from js/inviteapi.min.js.I copied the code into ChatGPT and asked for a deobfuscated version, which thankfully came back clean enough to understand.
I executed a curl command to get this into my machine:
Then, I decrypted the code using base64 command:
echo ‘UzhKVzAtOEpYWk0tQzlER1QtS1VXUEw=’ | base64 -d
I pasted the decoded part into the invite page, logged in using fake credentials, and landed on the home page. After exploring the site, I eventually found an “Access” page where VPN keys were generated.
Time to bring in Burp Suite!
I intercepted the request responsible for generating the VPN, and after poking around with repeater, I noticed something big:
So, I modified the address to v1 (version 1):
I just need to change “is_admin”: 1 and I can enter as admin.
Get Pradithareddy’s stories in your inbox
Join Medium for free to get updates from this writer.
I’ll try getting in as an admin using the PUT method I got:
“Invalid content type”. Alright, so the issue was not the field but the format.
Before modifying the request, I needed to figure out the correct Content-Type header it expected. In Burp Suite, I right-clicked on the request and selected “Change request method.” Doing this twice switched it over to a POST request, which conveniently revealed the Content-Type header that wasn’t visible earlier.
Now, since the response shows the Content-Type as application/json, I need to match that on the request side as well. After updating the header, switch the request method back to PUT, because the server won’t accept the admin change when using POST.
“missing parameter: email”, So I’ll add the parameter and the ‘is_admin:’ 1 too:
Got the admin id! Now that I had admin privileges, I intercepted another VPN-related request, sent it to repeater, and verified the authentication:
Authenticated as admin! Now let’s check other methods of admin. The one left is generate vpn. Let’s try this:
Let’s change that:
Didn’t return anything useful. So, let’s try command injection. Since we already had an ID parameter, I replaced it with something like:
Yup it worked!
I now had command execution on the machine.
ls shows the list of files here.
Ls -la contained .env file so let’s check that out:
I found a credential sitting there in plain text.
Now we can do ssh and get into the machine as admin:
Ssh admin@2million.htb or ssh admin@10.10.11.221
Password: SuperDuperPass123
LET’S GOOO!!!
I tried running linpeas, but the machine didn’t support it. So let’s try another way:
According to the mail, it got something to do with overlay-cve. A quick search brought me to a GitHub PoC:
copied that and saved it as poc.c
So this was 2million! Thanks for reading.
