CozyHosting — HTB Writeup | The Hack Sparrow

Executive summary — CozyHosting is an Easy Linux box built around a Java Spring Boot app: an unauthenticated Spring Boot Actuator endpoint (/actuator/sessions) leaks active session tokens, letting us hijack an administrator's cookie and log into the admin panel; the panel's SSH form has a command injection in the username field (RCE as app). The application's .jar yields PostgreSQL credentials, the users table is dumped, the admin's bcrypt hash is cracked with hashcat, and that password is reused over SSH as josh. Root comes from abusing a sudo grant on ssh via ProxyCommand (GTFOBins). An Actuator → session hijacking → RCE → PostgreSQL → hashcat → SSH → sudo ssh → root path.

Platform	Hack The Box
Operating system	Linux (Ubuntu)
Difficulty	Easy
Status	Retired
Target IP	`10.129.16.230`

Attack map

[80] Java Spring Boot app (nginx)
   │  HTTP headers + /error 500 → Spring Boot
   │  unauthenticated /actuator → /actuator/sessions leaks JSESSIONID tokens
   ▼
[hijack]  kanderson's cookie → /admin (Admin Dashboard)
   ▼
[RCE]  /executessh → command injection in «username» (space filter bypass with ${IFS})
   │  shell.sh over HTTP → shell as app
   ▼
[creds]  unzip the .jar → application.properties → PostgreSQL credentials
   │  psql → users table → admin's bcrypt hash → hashcat -m 3200 → cracked
   ▼
[SSH]  josh  (reused password)  →  user.txt
   │  sudo -l → /usr/bin/ssh (ALL)
   ▼
[ROOT]  sudo ssh -o ProxyCommand (GTFOBins)  →  root.txt

1. Reconnaissance

Full TCP port scan:

nmap -p- --min-rate 5000 -sV -sC -oA cozyhosting 10.129.16.230

22/tcp open  ssh    OpenSSH 8.9p1 Ubuntu
80/tcp open  http   nginx/1.18.0 (Ubuntu) — Cozy Hosting - Home

echo '10.129.16.230 cozyhosting.htb' | sudo tee -a /etc/hosts

Only two ports open — no SSH to brute force directly, so the focus is the web app. The HTTP headers already hint strongly at the framework:

whatweb http://cozyhosting.htb
curl -I http://cozyhosting.htb

X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: en-US

That exact header pattern (plus Content-Language) is characteristic of Spring Boot (Java). It points the rest of the recon toward its management endpoints, Actuator.

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://cozyhosting.htb/FUZZ -fc 404 -t 50

/admin  [401]   protected admin panel
/login  [200]   login form
/logout [204]   session logout
/error  [500]   Spring Boot error page

/error returning a 500 with Spring Boot's exact error format confirms the framework.

Resumen ejecutivo — CozyHosting es un Linux Easy sobre una app Java Spring Boot: un Spring Boot Actuator sin autenticación (/actuator/sessions) filtra tokens de sesión activos, con los que se secuestra la cookie de un administrador y se entra en el panel; el panel tiene un formulario SSH con inyección de comandos en el campo username (RCE como app). Del .jar de la aplicación salen las credenciales de PostgreSQL, se vuelca la tabla de usuarios, se craquea el hash bcrypt del admin con hashcat y esa contraseña se reutiliza para entrar por SSH como josh. El root llega abusando de un permiso de sudo sobre ssh vía ProxyCommand (GTFOBins). Recorrido Actuator → session hijacking → RCE → PostgreSQL → hashcat → SSH → sudo ssh → root.

Plataforma	Hack The Box
Sistema operativo	Linux (Ubuntu)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.16.230`

Mapa del ataque

[80] app Java Spring Boot (nginx)
   │  cabeceras HTTP + /error 500 → Spring Boot
   │  /actuator sin auth → /actuator/sessions filtra tokens JSESSIONID
   ▼
[hijack]  cookie de kanderson → /admin (Admin Dashboard)
   ▼
[RCE]  /executessh → command injection en «username» (bypass de espacios con ${IFS})
   │  shell.sh vía HTTP → shell como app
   ▼
[creds]  unzip del .jar → application.properties → credenciales de PostgreSQL
   │  psql → tabla users → hash bcrypt de admin → hashcat -m 3200 → crackeado
   ▼
[SSH]  josh  (contraseña reutilizada)  →  user.txt
   │  sudo -l → /usr/bin/ssh (ALL)
   ▼
[ROOT]  sudo ssh -o ProxyCommand (GTFOBins)  →  root.txt

1. Reconocimiento

Escaneo completo de puertos TCP:

nmap -p- --min-rate 5000 -sV -sC -oA cozyhosting 10.129.16.230

22/tcp open  ssh    OpenSSH 8.9p1 Ubuntu
80/tcp open  http   nginx/1.18.0 (Ubuntu) — Cozy Hosting - Home

echo '10.129.16.230 cozyhosting.htb' | sudo tee -a /etc/hosts

Solo dos puertos abiertos: nada de SSH que atacar directamente, así que el foco es la web. Las cabeceras HTTP ya dan una pista fuerte del framework:

whatweb http://cozyhosting.htb
curl -I http://cozyhosting.htb

X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: en-US

Ese patrón exacto de cabeceras (y el Content-Language) es característico de Spring Boot (Java). Orienta el resto del recon hacia sus endpoints de gestión, Actuator.

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://cozyhosting.htb/FUZZ -fc 404 -t 50

/admin  [401]   panel de administración protegido
/login  [200]   formulario de login
/logout [204]   cierre de sesión
/error  [500]   página de error de Spring Boot

El /error devolviendo un 500 con formato de Spring Boot lo confirma definitivamente.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.