Era

Platform: HackTheBox | Category: Machines | Type: Machine | Difficulty: Medium | OS: Linux | Author: DonutMaster | Date: 2025-11-30 | Status: Solved Techniques: Subdomain Fuzzing, IDOR File Download, Site Backup Extraction, Bcrypt Hash Cracking, Security Question Account Takeover, PHP SSH2 Wrapper RCE, Binary Section Patching (objcopy)

Summary

Walkthrough of the HackTheBox Medium machine Era (Linux). Foothold achieved via IDOR on file download endpoint leaking an old site backup zip containing database credentials and password hashes. Escalation via security question modification/takeover, FTP login, and exploiting PHP SSH2 stream wrapper (ssh2.exec://) for RCE. Privesc via patching monitored binary signature section (objcopy).

Recon

Port Scan

 bash read-only • copy allowed Copy
rustscan -a era.htb -- -A

Foothold

Exploitation Steps

1. Discover subdomain file.era.htb via vhost fuzzing.
2. Register an account and find IDOR vulnerability in download.php?id=X. Enumerate IDs to locate a site backup zip file (site-backup-30-08-24.zip).
3. Extract filedb.sqlite from the backup containing user password hashes and security questions.
4. Update the admin security question via the web panel to take over the admin account, or log in via cracked FTP credentials (yuri).
5. Use FTP to upload/access modules, then leverage PHP SSH2 wrapper (ssh2.exec://) via LFI/show parameter in download.php for RCE (eric).

Privilege Escalation

Root Escalation

1. Inspect pspy logs showing root periodically running objcopy --dump-section .text_sig=... on a monitoring binary.
2. Replace or patch /opt/AV/periodic-checks/monitor with a compiled C reverse shell binary retaining the correct .text_sig section header.
3. Trigger execution loop to obtain a root shell.

Flags

Key Takeaways / Lessons

• Ensure strict access control checks on IDOR file download endpoints.
• Protect configuration backups and database files containing sensitive password hashes or security question answers.