Conversor — HTB Writeup | The Hack Sparrow

Executive summary — Conversor is a Linux machine that chains an XSLT-based arbitrary file write with a misconfigured cron job and a needrestart escalation. The Flask web app converts XML+XSLT pairs with lxml: it blocks XXE but not the EXSLT extensions, which lets us drop a .py into a folder that a cron runs as www-data every minute (RCE). From there we dump the database, crack MD5 hashes and log in over SSH as fismathack; the final blow is CVE-2024-48990 in needrestart. A Web → RCE (cron) → SSH → Root path.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.238.31`

Attack map

[80/HTTP]  Flask app "Conversor" (Apache 2.4.52 / vhost conversor.htb)
   │  XSLT + EXSLT shell:document → arbitrary file write (CVE-2023-46214 / CVE-2025-6985)
   ▼
[CRON]  .py dropped in /var/www/conversor.htb/scripts/ run as www-data every minute
   │  reverse shell → www-data
   ▼
[DB]  sqlite instance/users.db → unsalted MD5 hashes
   │  hashcat -m 0 + rockyou → Keepmesafeandwarm
   ▼
[SSH]  fismathack@conversor.htb   (user.txt)
   │  sudo -l → NOPASSWD: /usr/sbin/needrestart (v3.7)
   ▼
[ROOT]  needrestart PYTHONPATH injection (CVE-2024-48990) → SUID /bin/bash

1. Reconnaissance

We start by mapping the attack surface with a full-port scan and version detection:

nmap -p- --min-rate 3000 -T4 -Pn 10.129.238.31

Why these flags:

-p- → scans all 65535 TCP ports, not just the top 1000.
--min-rate 3000 → forces at least 3000 packets/s to speed up the sweep.
-T4 → aggressive timing template.
-Pn → assume the host is up, no ping (HTB blocks ICMP).

Result:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.52

Only two ports. The web server redirects to the virtual host conversor.htb. Instead of editing /etc/hosts, we resolve the vhost on the fly with curl's --resolve option:

curl -s --resolve conversor.htb:80:10.129.238.31 http://conversor.htb/

Why --resolve: it maps conversor.htb to the target IP for this request only, without touching any system files. Clean and leaves no trace in the environment.

Resumen ejecutivo — Conversor es una maquina Linux que encadena una escritura de archivo arbitraria via XSLT con un cron mal configurado y una escalada por needrestart. La webapp Flask convierte pares XML+XSLT con lxml: bloquea XXE pero no las extensiones EXSLT, lo que permite dejar un .py en una carpeta que un cron ejecuta como www-data cada minuto (RCE). Desde ahi se vuelca la base de datos, se crackean hashes MD5 y se entra por SSH como fismathack; el remate es CVE-2024-48990 en needrestart. Recorrido Web → RCE (cron) → SSH → Root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.238.31`

Mapa del ataque

[80/HTTP]  App Flask "Conversor" (Apache 2.4.52 / vhost conversor.htb)
   │  XSLT + EXSLT shell:document → escritura de archivo arbitraria (CVE-2023-46214 / CVE-2025-6985)
   ▼
[CRON]  .py dejado en /var/www/conversor.htb/scripts/ ejecutado como www-data cada minuto
   │  reverse shell → www-data
   ▼
[DB]  sqlite instance/users.db → hashes MD5 sin salt
   │  hashcat -m 0 + rockyou → Keepmesafeandwarm
   ▼
[SSH]  fismathack@conversor.htb   (user.txt)
   │  sudo -l → NOPASSWD: /usr/sbin/needrestart (v3.7)
   ▼
[ROOT]  needrestart PYTHONPATH injection (CVE-2024-48990) → /bin/bash SUID

1. Reconocimiento

Empezamos mapeando la superficie de ataque con un escaneo de todos los puertos y deteccion de versiones:

nmap -p- --min-rate 3000 -T4 -Pn 10.129.238.31

Por que estas flags:

-p- → escanea los 65535 puertos TCP, no solo los 1000 mas comunes.
--min-rate 3000 → fuerza al menos 3000 paquetes/s para acelerar el barrido.
-T4 → plantilla de tiempo agresiva.
-Pn → asume el host vivo sin ping previo (HTB bloquea ICMP).

Resultado:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.52

Solo dos puertos. El servidor web redirige al virtual host conversor.htb. En lugar de tocar /etc/hosts, resolvemos el vhost a mano con la opcion --resolve de curl:

curl -s --resolve conversor.htb:80:10.129.238.31 http://conversor.htb/

Por que --resolve: asocia el nombre conversor.htb a la IP objetivo solo para esta peticion, sin modificar ficheros del sistema. Ideal para no dejar rastro ni ensuciar el entorno.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.