HTB Writeup — conversor (10.10.11.92) Scope & notes: Target: Linux box (Hack The Box lab).

HTB Writeup — conversor (10.10.11.92) Scope & notes: Target: 10.10.11.92 — Linux box (Hack The Box lab). TL;DR Initial foothold: XSLT injection / upload leads to writing a Python script under the webroot. The script revealed credentials (users.db) or directly enabled command execution. Using credentials found ( fismathack:Keepmesafeandwarm ) allowed SSH access. Privilege escalation: needrestart was configured to be runnable as root via sudo and accepts an arbitrary config file. Crafting a config file allowed command execution as root (interactive shell), leading to reading root.txt . Highlights (quick) Open ports: 22/tcp (ssh) , 80/tcp (http) Web app vulnerable to XSLT processing which can read/write server files (reference: XSLT Injection payloads). user.db found; fismathack password cracked to Keepmesafeandwarm . sudo /usr/sbin/needrestart -c <file> abused to get a root shell. 1) Recon / Port scan nmap -p- -T4 10.10.11.92 # open: 22/tcp ssh (OpenSSH 8.9p1) # 80/tcp http (Apache/2.4.52) Notes: The HTTP server responds and uses a virtual host conversor.htb (the host entry was added to /etc/hosts in various writeups). 2) Web app & XSLT discovery The web application processes user-supplied XSLT files. Community writeups and the PDF screenshots show the following: An uploaded XSLT file was executed by the server; the attacker used payloads similar to those in the PayloadsAllTheThings XSLT Injection collection to probe and then to write files. The XSLT payload used extension elements ( ptswarm:document or similar) to write Python files into /var/www/conversor.htb/scripts/   .