Management is an Easy difficulty HackTheBox machine that hosts a vulnerable web application allowing unauthenticated Remote Code Execution through a deserialization flaw. Initial foothold yields a low-privileged shell, leading to internal database enumeration where an encrypted service password is extracted. Decrypting this secret using a locally discovered key file provides SSH access as the target user. Root access is then achieved by exploiting parameter handling in a restricted backup utility command running with elevated privileges to read arbitrary system files.
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O management.htb -oN nmap_scan to scan the open ports and services.
2. Initial Foothold
Since I was unable to find any useful information, I decided to pivot my enumeration towards the website.
2.1 Application Profiling
Ports 80/443 are running a custom website. The website does not contain any interesting information, and the directory scan failed to find any hidden directories or files.
The website's banner has two buttons, and the "Client Login" button is linked to sso.management.htb. After adding the subdomain to the /etc/hosts file, I decided to enumerate the subdomain.
2.2 Vulnerability Context
With the version number of the application disclosed, I was able to search for known vulnerabilities.
2.3 Exploitation & Foothold
I was able to find a publicly available exploit POC on GitHub for the vulnerability.
3. Internal Enumeration & Lateral Movement
After gaining an initial foothold as a low-privileged openam user, I started local enumeration to find a way to escalate privileges. The target machine had only one user named owen.
3.1 GLPI Credential Harvesting
While looking around the target machine, I was able to find hardcoded database credentials in a configuration file. I was able to log in to the mysql database and harvest user credentials.
3.2 Sodium Decryption
Since the harvested credentials did not help, I decided to enumerate again for any other credentials or other ways to escalate privileges.
3.3 SSH Pivot
With the password decrypted, I tried to log in to the target machine as owen. I was able to SSH into the target machine as owen and retrieve the user flag.
4. Privilege Escalation
Running sudo -l as owen revealed that owen can run one command on the target machine with sudo privileges.
Writeup Pending Retirement
This machine is currently active, so the full walkthrough is temporarily unavailable. The complete writeup will be published once the machine is officially retired.
Enjoying Project Null Byte? If you'd like to support my learning journey and help me create more cybersecurity content, you can buy me a coffee.
