Hack The Box - Calamity user flag

Date: 2020‑01‑08
Track: Web exploitation → Auth bypass & command execution
Tools: Nmap, Gobuster, Nikto, Burp Suite, Python http.server, PHP snippets
Goal: Gain user access and retrieve the user flag.

🎯 Objective

• Re‑establish workflow after a break and warm up on a lighter web box.
• Enumerate a minimal surface (HTTP + SSH).
• Identify admin functionality, obtain credentials, and achieve command execution to read the user flag.

🧩 High‑Level TL;DR

1. Fast baseline scan found HTTP and SSH only.
   
2. Gobuster + Nikto enumerated /admin.php with interesting params.
   
3. Viewing the admin page revealed a commented password in source.
   
4. Logged in with a common username plus the leaked password and abused a feature for code execution, then manually browsed to the user flag.
   
5. Reverse shells were unstable (sessions killed), so deferred for root phase.
   

🧭 Environment & Scope

• Target services: HTTP (webapp), SSH (not used for initial access).
• Assumptions: Standard Linux web stack with PHP backend; single‑user CTF environment.
• Out‑of‑scope: Bruteforce on SSH; high‑noise exploits against production‑like services.

🔎 Reconnaissance

1) Network Scan (Quick Baseline)

nmap -sC -sV -T4 -oA initial -Pn <TARGET_IP>

Result: HTTP + SSH exposed. No exotic ports.

2) Web App First Look

Homepage had no obvious entry points or robots.txt.

3) Content Discovery

gobuster dir -u http://<TARGET_IP>/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,bak -t 50

Found /admin.php and other minor resources.

4) Nikto Quick Sweep

Nikto flagged a parameterized admin endpoint:

/admin.php?en_log_id=0&action=users

Landing there presented an input surface.

🧪 Vulnerability Discovery

• Finding: An HTML comment on the admin page contained a plaintext password for the panel.
• Impact: Enables authentication bypass when combined with a common username (admin, administrator, or root).
  

🚪 Initial Access (Auth ➜ Panel)

• Attempted common usernames with the leaked password until authenticated successfully.
• Once inside, inspected admin features/settings for file/command execution primitives.

⚙️ Exploitation — Code Execution

• Spun up a quick server to stage helpers:
  bash Copy

  python3 -m http.server 8000

• Tested low‑risk commands first (e.g., whoami, ls), then navigated the filesystem from the web context to locate the user flag.
• Outcome: User flag retrieved via browser‑side file navigation / minimal command exec.
  

Note: Reverse shells (e.g., msfvenom payloads) were unstable and sessions were immediately killed. Deferred for the root phase.

📦 Artifacts & Evidence

• Credential leak (HTML comment) on admin.php source.
• Admin panel access with common username + leaked password.
• Command execution capability within panel leading to reading the user flag.

🧯 Remediation Ideas (Defender Notes)

1. Remove secrets from source: Never store credentials in HTML comments or client‑side code.
2. Enforce strong auth: Unique, non‑guessable usernames; MFA for admin routes.
3. Least privilege & hardening: Web user should not traverse sensitive paths or read flags/secrets.
4. WAF & RASP hooks: Detect/limit command execution patterns from web context.
5. Monitoring: Alert on access to admin endpoints and anomalous parameter usage.

🛠️ Commands Cheat‑Sheet

# Discovery
nmap -sC -sV -T4 -oA initial -Pn <TARGET_IP>
gobuster dir -u http://<TARGET_IP>/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,bak -t 50
nikto -h http://<TARGET_IP>/

# Stager
python3 -m http.server 8000

# cURL poke (example param path found by Nikto)
curl "http://<TARGET_IP>/admin.php?en_log_id=0&action=users"

✅ Outcome

• User flag: Retrieved.
• Next steps (root):
  • Stabilize a reverse shell (e.g., socat, bash -i via named pipe, web‑safe encodings).
  • Enumerate SUID, cron, timers, services for escalation.

📝 Notes to Self

• Keep checking page source and comments; this time it was the key.
• If shells die instantly, pivot to in‑panel file browsing or single‑shot commands first, then revisit persistence.