HackTheBox Writeup - DevArea

Target IP: 10.129.4.208 Difficulty: Medium OS: Linux

1. Reconnaissance

Nmap Scan

PORT     STATE SERVICE
21/tcp   open  ftp (Anonymous login allowed)
22/tcp   open  ssh
80/tcp   open  http
8080/tcp open  http-proxy (Apache CXF SOAP service)
8500/tcp open  fmtp (Hoverfly Proxy)
8888/tcp open  sun-answerbook (Hoverfly Dashboard)

Foothold Discovery

Downloading employee-service.jar from FTP reveals an Apache CXF SOAP service. Analyzing the WSDL and classes identifies a submitReport operation vulnerable to MTOM SSRF.

2. Initial Access (Foothold)

Exploiting MTOM SSRF

By sending a SOAP request with an xop:Include element, we can read local files. Reading /etc/systemd/system/hoverfly.service reveals the admin credentials for the Hoverfly service: admin:O7IJ27MyyXiU

Hoverfly RCE (CVE-2025-54123)

The Hoverfly API allowed setting a malicious middleware script. By authenticating to /api/token-auth and using the JWT to PUT a malicious script to /api/v2/hoverfly/middleware, we obtained a reverse shell as the dev_ryan user.

User Hash (Flag): 2c4d90ea5c70c6e43786f8446a9d4dc8

3. Privilege Escalation (User: syswatch)

A local Flask application (SysWatch Web GUI) is running on 127.0.0.1:7777 as the syswatch user. Reading /etc/syswatch.env reveals the Flask SECRET_KEY. Using this key, we can forge a session cookie to bypass login. The /service-status endpoint is vulnerable to command injection via the service parameter. Payload: syswatch | echo <hex_payload> | xxd -r -p | bash This gives us a reverse shell as the syswatch user.

4. Privilege Escalation (User: root)

dev_ryan has passwordless sudo for /opt/syswatch/syswatch.sh. The syswatch.sh script appends log messages to /opt/syswatch/logs/system.log as root. The syswatch user has write access to the /opt/syswatch/logs directory.

Exploitation Steps:

1. Symlink Attack: As syswatch, create a symlink: ln -sf /etc/cron.d/pwn /opt/syswatch/logs/system.log.
2. Log Append Injection: As dev_ryan, run the sudo script with a newline-injected argument: sudo /opt/syswatch/syswatch.sh plugin log_monitor.sh " || true\n* * * * * root cp /bin/bash /tmp/pwn_bash; chmod 4777 /tmp/pwn_bash\n#"
3. Trigger: After 1 minute, cron executes the injected job, creating a root SUID bash.

Root Hash (Flag): 9955972eec5754c292dc1c86f5076a6b