root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat boardlight.md
// writeups

BoardLight

25 May 2024 · 20 min read · root access
writeupshacktheboxlinuxEasyretiredvip
BoardLight - maquina de Hack The Box

Executive summary — BoardLight exposes only SSH and an Apache server hosting a static corporate site, but the domain leaked on that page leads to a hidden vhost running Dolibarr ERP/CRM 17.0.0 protected by factory credentials (admin:admin). From there, CVE-2023-30253 — a case-sensitive anti-PHP filter — grants code execution as www-data. A reused database password opens SSH access to the system user, and a SUID binary belonging to a desktop window manager that had no business being on a server (CVE-2022-37706) hands over root. No single link is sophisticated on its own; the chain is, because every step depends on the previous one.

PlatformHack The Box
Operating systemLinux (Ubuntu 20.04 LTS)
DifficultyEasy
StatusRetired
Target IP10.129.231.37

Attack map

[80] board.htb — static corporate site, leaks the internal domain
   │  vhost fuzzing -> crm.board.htb (hidden, same 302 response size)
   ▼
[80] crm.board.htb — Dolibarr ERP/CRM 17.0.0
   │  factory credentials admin:admin -> administrative session
   ▼
[RCE]  CVE-2023-30253 — Website module's anti-PHP filter is
   │  case-sensitive (blocks <?php but not <?PHP)
   ▼
[www-data]
   │  conf.php leaks the DB password, reused as the SSH
   │  password for the system user larissa
   ▼
[SSH]  larissa  (user.txt)
   │  enlightenment_sys (SUID root, v0.23.1) — CVE-2022-37706,
   │  command injection via an unsanitized ";" in the path
   ▼
[ROOT]  SUID copy of bash -> root.txt

1. Reconnaissance

ping -c 2 -W 3 10.129.231.37
64 bytes from 10.129.231.37: icmp_seq=1 ttl=63 time=35.5 ms
64 bytes from 10.129.231.37: icmp_seq=2 ttl=63 time=35.6 ms

A TTL of 63 is a free hint: Linux initializes TTL at 64, Windows at 128. 63 = 64 minus one network hop (the VPN gateway). Before scanning a single port, the target is already known to be Linux and one hop away.

nmap -p- --min-rate 5000 -T4 -Pn -oN nmap-allports.txt 10.129.231.37
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Not shown: 65226 closed tcp ports (reset), 307 filtered tcp ports (no-response)

Only two ports. That narrows the search space immediately: the entry point has to be on port 80, since SSH without prior credentials isn't a realistic way in.

nmap -sCV -p22,80 -Pn -oN nmap-services.txt 10.129.231.37
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Those OpenSSH and Apache versions are exactly what Ubuntu 20.04 LTS ships, and neither has a known practical pre-auth RCE. The vector isn't going to be the service, but whatever application runs on top of it.

curl -s -i -m 15 http://10.129.231.37/ | head -50

The response is a static commercial template, but the internal links use index.php, not .html: there's an active PHP interpreter even though the content looks entirely static. A feroxbuster run over the site only confirms more pages from the same template (about.php, contact.php...), and its contact forms have an empty action="" and inputs with no name attribute: purely decorative, they submit nothing to any backend. A dead end — but the dead end is the finding. Once the served content runs out, what's left to explore isn't more content, it's more hostnames.

grep -oiE '[a-z0-9._-]+\.(htb|com|local|net)' index.html | sort -u
board.htb
info@board.htb

The internal domain board.htb shows up in the page footer, in a contact email. Apache supports name-based virtual hosts: the same IP can host several distinct sites depending on the request's Host: header. Any other hosted site stays invisible until its name is guessed.

ffuf -u http://10.129.231.37/ -H "Host: FUZZ.board.htb" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  -mc all -fs 15949 -t 60

-fs 15949 is the essential option. When Apache gets a Host: it doesn't recognize, it doesn't error out: it serves the default vhost. Twenty thousand unfiltered requests would all return HTTP 200 with the same 15,949-byte page — pure noise. Filtering by that exact size, only genuinely different responses survive.

crm

A single real vhost: crm.board.htb. With no sudo on the attacking box to edit /etc/hosts, it's reached with curl's --resolve, which forces DNS resolution at the request level without touching the system:

curl -s -i --resolve crm.board.htb:80:10.129.231.37 http://crm.board.htb/ | head -30
Set-Cookie: DOLSESSID_3dfbb778014aaf8a61e81abec91717e6f6438f92=...
<meta name="author" content="Dolibarr Development Team">
<title>Login @ 17.0.0</title>

Three independent fingerprints confirm the target: the DOLSESSID_* cookie, the <title> literally publishing the version, and the ?version=17.0.0 parameter on static assets. Confirmed: Dolibarr 17.0.0.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.