Hacking Insights by Max Bautista

Paper writeup

Paper writeup

Box name: Paper

Difficulty: Easy

OS: Linux

Overview: Paper is an easy Linux machine that features an Apache server on ports 80 and 443, which are serving the HTTP and HTTPS versions of a website respectively. The website on port 80 returns a default server webpage but the HTTP response header reveals a hidden domain. This hidden domain is running a WordPress blog, whose version is vulnerable to CVE-2019-17671. This vulnerability allows us to view the confidential information stored in the draft posts of the blog, which reveal another URL leading to an employee chat system. This chat system is based on Rocketchat. Reading through the chats we find that there is a bot running which can be queried for specific information. We can exploit the bot functionality to obtain the password of a user on the system. Further host enumeration reveals that the sudo version is vulnerable to CVE-2021-3560 and can be exploited to elevate to root privileges.

Link: https://app.hackthebox.com/machines/Paper?tab=play_machine

Machine IP: 10.129.136.31

Ran rustscan against the machine.

rustscan -a 10.129.136.31 –ulimit 5000 -b 500 — -A -Pn

Two webservers and ssh. When navigating to the website it’s a basic website.

Ran scan with feroxbuster.

feroxbuster -u http://10.129.136.31 -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400

Nothing was coming back right away. Nothing in source code seemed interested nor any robots.txt. I opened Burp to poke around and interestingly it showed a Backend server office.paper.

When navigating to that site it looks like we get a spin off of Dunder Mifflin site.

After poking around we find out this is a WordPress page and there is an interesting comment on the Feeling Alone! Blog post http://office.paper/index.php/2021/06/19/feeling-alone/#comments.

For some reason I was unable to get to the wordpess admin page but I was able to get the version from Wappalyzer, WordPress 5.2.3. I googled exploits and found this which aligns with that blog comment https://www.exploit-db.com/exploits/47690. I added ?static=1 to the URL and it brought us to the ‘secret content’.

There’s another URL and its likely some sort of chat system. Added that to etc/hosts and navigated to that.

I created a test account test:test. There is a #general chat that we have access to and reading through it apparently there is a bot that we can interact with.

When interacting with the bot it has access to the sales directory. After playing with this, it turns out to be nothing. I tried getting out of the directory it has access to and this gives us more information. 

I couldn’t find a way to get user.txt from here but it shows that this bot is ‘hubot’. This bot has a .env file and we are able to read it through the bot.

I tried a few users to get in with the password and I was able to successfully get into dwight. I grabbed user.txt. dwight:Queenofblad3s!23

Transferred linpeas to the device. I wasn’t able to find anything with the output or manual enumeration. Eventually I peaked at the writeup. Turns out the polkit version is vulnerable.

When searching for exploits it is vulnerable to CVE-2021-3560 https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation. Edited the code to create a user hacked:hacked123 and ran it.

./poc.sh

Switched user successfully.

Then spawned a root shell and grabbed root.txt

GG

Attack Chain

1 – Reconnaissance Ran RustScan and identified ports 22 (SSH), 80 (HTTP), and 443 (HTTPS). Browsed to port 80 and found a default server webpage. Ran feroxbuster with no useful results. Intercepted the HTTP response headers in Burp and found an X-Backend-Server header disclosing office.paper as a hidden domain. Added it to /etc/hosts.

rustscan -a 10.129.136.31 –ulimit 5000 -b 500 — -A -Pn feroxbuster -u http://10.129.136.31 -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion

2 – WordPress draft content disclosure – CVE-2019-17671 Navigated to office.paper and found a WordPress blog. Identified WordPress 5.2.3 via Wappalyzer. Found a comment on a blog post hinting at secret content in drafts. Researched the version and found CVE-2019-17671 which allows unauthenticated viewing of draft posts by appending ?static=1 to the URL. The draft revealed a URL for an internal chat system. Added it to /etc/hosts.

http://office.paper/index.php?static=1

3 – Rocket.Chat bot path traversal and credential extraction Navigated to the chat system and created a test account. Found a #general channel where staff discussed a Hubot assistant with access to the sales directory. Interacted with the bot and discovered it allowed path traversal outside its intended directory. Used the traversal to read the bot’s .env file which contained plaintext credentials.

Credentials recovered: dwight:Queenofblad3s!23

4 – SSH access and user flag Tried the credentials against multiple users and successfully SSH’d in as dwight. Retrieved user.txt.

5 – Privilege Escalation – Polkit CVE-2021-3560 Ran LinPEAS and could not identify an obvious path. Checked the polkit version and found it vulnerable to CVE-2021-3560, a race condition in polkit allowing creation of a privileged user without authentication. Used a public PoC script to create a new sudo user, switched to that user, and spawned a root shell. Retrieved root.txt.

./poc.sh

Key Takeaways

  1. Domain disclosed in HTTP response header – The X-Backend-Server response header revealed the office.paper domain to anyone inspecting HTTP responses, exposing an internal WordPress installation that was not intended to be publicly known. Web servers must never disclose internal hostnames, backend addresses, or infrastructure details in response headers.
  2. WordPress draft content disclosure – CVE-2019-17671 – WordPress 5.2.3 allowed unauthenticated users to view unpublished draft posts by appending a static parameter to any post URL. Draft posts must never contain sensitive information such as internal URLs, credentials, or system details, and WordPress must be kept fully patched.
  3. Rocket.Chat bot path traversal exposing credential file – The Hubot bot processed file path requests without restricting access to its designated directory, allowing traversal to the .env file containing plaintext credentials. Bot integrations must validate and restrict all file access to an explicitly approved directory and must never store credentials in files accessible through the bot’s interface.
  4. Plaintext credentials in a bot environment file – The hubot .env file contained plaintext credentials that were recoverable through the path traversal. Application secrets and credentials must be injected at runtime via a secrets management solution and must never be stored in plaintext files accessible to web-facing processes.
  5. Polkit vulnerable to CVE-2021-3560 enabling unprivileged user creation – CVSS 7.8 High – The polkit version running had a race condition vulnerability allowing creation of a privileged sudo user without any authentication. System packages must be kept fully patched and polkit must be updated immediately when security advisories are released.

Remediation

[Immediate] Remove the X-Backend-Server response header Configure Apache to strip all internal infrastructure headers from HTTP responses. Audit all response headers across both ports 80 and 443 for information disclosure and remove any that reveal internal hostnames, backend addresses, server versions, or framework details.

[Immediate] Patch WordPress to remediate CVE-2019-17671 Update WordPress to the latest supported version immediately. Audit all draft posts for sensitive content and remove any internal URLs, credentials, or system references. Enable automatic security updates for WordPress core and implement a scanning process to detect sensitive content in draft and private posts.

[Immediate] Patch polkit to remediate CVE-2021-3560 (CVSS 7.8 High) Update polkit to the latest patched version immediately. Audit all recently created user accounts for unauthorized additions resulting from potential prior exploitation. Implement monitoring to alert on new sudo group additions and privileged user creation events.

[Immediate] Restrict the Hubot bot file access and rotate credentials Rewrite the bot’s file handling to validate all requested paths against a strict allowlist and reject any path containing traversal sequences. Rotate the dwight password immediately. Migrate bot credentials from the .env file to a secrets management solution and restrict .env file permissions to the owning service account only.

[Short-term] Audit and harden all bot and chat integrations Define a security baseline for all chat bot integrations covering file access restrictions, credential storage requirements, command injection prevention, and authentication requirements. Include chat bot integrations in regular security assessments and test all bot commands for path traversal and injection vulnerabilities.

[Long-term] Implement a web server response header hardening standard Define a policy requiring all web servers to suppress or replace version disclosure, backend server, and infrastructure headers before responses reach clients. Include HTTP response header auditing in the regular penetration testing scope and verify headers are correctly stripped in all environments.

Leave a comment