HTBEasyMachine

Valentine

D3v0o0Nu119/2/20264 min read

#machine#htb#easy#cve-2014-0160#ubuntu

Valentine

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Valentine (Ubuntu, attack surface: Apache httpd 2.2.22 ((Ubuntu)) (443), Apache httpd 2.2.22 ((Ubuntu)) (80), OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0) (22), https (443)). Foothold via CVE-2014-0160; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed
nmap -p- -sVC 10.10.10.79 --min-rate 1000

Port	Service	Version
22	ssh	OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
80	http	Apache httpd 2.2.22 ((Ubuntu))
443	ssl/http	Apache httpd 2.2.22 ((Ubuntu))
443	https

Enumeration highlights

Detected OS: Ubuntu.
Open services: http (80), https (443), ssh (22), ssl/http (443).
Scan used: nmap -p- -sVC 10.10.10.79 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ nmap -p- -sVC 10.10.10.79 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-18 07:35 PDT
Nmap scan report for 10.10.10.79
Host is up (0.036s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 964c51423cba2249204d3eec90ccfd0e (DSA)
|   2048 46bf1fcc924f1da042b3d216a8583133 (RSA)
|_  256 e62b2519cb7e54cb0ab9ac1698c67da9 (ECDSA)
80/tcp  open  http     Apache httpd 2.2.22 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.2.22 (Ubuntu)
443/tcp open  ssl/http Apache httpd 2.2.22 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=valentine.htb/organizationName=valentine.htb/stateOrProvinceName=FL/countryName=US
| Not valid before: 2018-02-06T00:45:25
|_Not valid after:  2019-02-06T00:45:25
|_ssl-date: 2023-09-18T14:36:44+00:00; 0s from scanner time.
|_http-server-header: Apache/2.2.22 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 82.79 seconds

Based from the nmap result, the machine runs a web application and it opens ssh login.
After ran dirbuster found several files that could be our interest.

/dev/hypekey

/dev/notes.txt

encode.php

decode.php

I started by decoding the hex value I got from hypekey.

Stuck in a rabbit hole for while. Then I started to move my attention to the heartbleed logo. Well it's obvious that the vuln here could be heartbleed bug, I took time long to search for any files I could use to interpret the RSA key.
Anyway since I know this bug name but dunno how it works. Did a small outsource resulting to this great reference --> https://xkcd.com/1354/.
By the way, to verify our assumptions about heartbleed, we can run ssl-heartbleed nmap scripts.

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ nmap -p 443 --script ssl-heartbleed valentine.htb 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-18 07:53 PDT
Nmap scan report for valentine.htb (10.10.10.79)
Host is up (0.036s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-heartbleed: 
|   VULNERABLE:
|   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
|     State: VULNERABLE
|     Risk factor: High
|       OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug. The bug allows for reading memory of systems protected by the vulnerable OpenSSL versions and could allow for disclosure of otherwise encrypted confidential information as well as the encryption keys themselves.
|           
|     References:
|       http://www.openssl.org/news/secadv_20140407.txt 
|       http://cvedetails.com/cve/2014-0160/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160

Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds

Turns out it is.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

Connected to a root-owned tmux socket session on the host to obtain a root shell.

Root flag: REDACTED

Flags

Flag	Value
user	`REDACTED`
root	`REDACTED`

Lessons Learned

Enumerate everything; version strings map to CVEs.
Confirm each hypothesis with a test before building the exploit.
Chain foothold -> privilege escalation mechanically.