CodePartTwo — HTB Writeup | The Hack Sparrow

Executive summary — CodePartTwo is a Flask app for running JavaScript online that exposes its own source code (and, unintentionally, its production SQLite database) through an unauthenticated /download endpoint. The source reveals the use of js2py, vulnerable to CVE-2024-28397 — a sandbox escape that gives direct RCE despite disable_pyimport(). An MD5 hash leaked in the database is cracked with a wordlist and turns out to be reused on the real SSH account. From there, a sudo NOPASSWD on the npbackup backup tool, combined with its configurable pre-execution hooks in an arbitrary YAML file, gives full control as root.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.232.59`

Attack map

[8000] CodePartTwo — /download leaks the source code + SQLite with no authentication
   │  CVE-2024-28397 — js2py sandbox escape at /run_code
   ▼
[RCE]  Command execution as app
   │  MD5 hash in the DB (marco) cracked with rockyou → reused over SSH
   ▼
[SSH]  marco@host
   │  sudo NOPASSWD on npbackup-cli -c <arbitrary config>
   ▼
[ROOT]  pre_exec_commands from the YAML config → root

1. Reconnaissance

nmap -p- --min-rate 5000 -v 10.129.232.59 -oN nmap_ports.txt

PORT     STATE SERVICE
22/tcp   open  ssh
8000/tcp open  http-alt

nmap -p22,8000 -sCV -v 10.129.232.59 -oN nmap_sV.txt

22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
8000/tcp open  http    Gunicorn 20.0.4
|_http-title: Welcome to CodePartTwo

Gunicorn confirms a Python (WSGI) application, most likely Flask or Django.

Resumen ejecutivo — CodePartTwo es una app Flask para ejecutar JavaScript online que expone su propio código fuente (y, sin querer, su base de datos SQLite en producción) a través de un endpoint /download sin autenticación. El código revela el uso de js2py, vulnerable a CVE-2024-28397 — un sandbox escape que da RCE directo a pesar de disable_pyimport(). Un hash MD5 filtrado en la base de datos se crackea con una wordlist y resulta reutilizado en la cuenta SSH real. Desde ahí, un sudo NOPASSWD sobre la herramienta de backup npbackup, combinado con sus «hooks» de pre-ejecución configurables en un fichero YAML arbitrario, da control total como root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.232.59`

Mapa del ataque

[8000] CodePartTwo — /download filtra el código fuente + SQLite sin autenticación
   │  CVE-2024-28397 — sandbox escape de js2py en /run_code
   ▼
[RCE]  Ejecución de comandos como app
   │  Hash MD5 en la BD (marco) crackeado con rockyou → reutilizado por SSH
   ▼
[SSH]  marco@host
   │  sudo NOPASSWD sobre npbackup-cli -c <config arbitrario>
   ▼
[ROOT]  pre_exec_commands del config YAML → root

1. Reconocimiento

nmap -p- --min-rate 5000 -v 10.129.232.59 -oN nmap_ports.txt

PORT     STATE SERVICE
22/tcp   open  ssh
8000/tcp open  http-alt

nmap -p22,8000 -sCV -v 10.129.232.59 -oN nmap_sV.txt

22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
8000/tcp open  http    Gunicorn 20.0.4
|_http-title: Welcome to CodePartTwo

Gunicorn confirma una aplicación Python (WSGI), muy probablemente Flask o Django.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.