Environment — HTB Writeup | The Hack Sparrow

Executive summary — Environment is a Medium Linux box built on Laravel 11.30.0 that chains two 2024 CVEs. First, a misconfigured PHP directive lets a query parameter (CVE-2024-52301) slip in as if it were a command-line flag, forcing the framework to boot in an alternate environment with login effectively disabled. Inside, the file manager bundled with the dashboard carries its own validation flaw (CVE-2024-21546): renaming the payload shell.php.. (an extra trailing dot) and adding GIF magic bytes gets RCE as www-data. An encrypted GPG backup reveals the real user hish's credentials, and the final escalation abuses sudo preserving BASH_ENV for a binary that internally invokes bash, running arbitrary code as root.

Platform	Hack The Box
Operating system	Linux
Difficulty	Medium
Status	Retired
Target IP	`10.129.232.3`

Attack map

[1] Recon -- SSH (OpenSSH 9.2p1) + nginx serving Laravel 11.30.0
        |
[2] CVE-2024-52301 -- register_argc_argv poisons argv via the query string
      +-> POST /login?--env=preprod -> authentication bypass (Burp)
        |
[3] CVE-2024-21546 (UniSharp Laravel-Filemanager) -- shell.php.. (double extension)
      + GIF89a magic bytes
      +-> backend normalises the name -> executable .php.  ->  RCE as www-data
        |
[4] user.txt in /home/hish (find + cat)
        |
[5] keyvault.gpg exfiltrated -- gpg --import + gpg --decrypt ->
      ENVIRONMENT.HTB -> marineSPm@ster!!  ->  ssh hish@environment.htb
        |
[6] sudo -l -- hish can run /usr/bin/systeminfo as root with BASH_ENV preserved
      (env_keep in sudoers) -- systeminfo internally invokes bash
      +-> BASH_ENV=/tmp/root.sh runs BEFORE the target script, as root
      +-> sudo /usr/bin/systeminfo  ->  root.txt

1. Enumeration

nmap -sV -sC 10.129.232.3

Result: SSH (OpenSSH 9.2p1) and HTTP (nginx serving a Laravel 11.30.0 application). Only two ports open, so the entire attack surface sits in the web app.

The exact framework version matters: Laravel 11.30.0 is vulnerable to a documented authentication bypass (CVE-2024-52301), fixed in 11.31.0 — this instance is exactly one patch release behind the fix.

Laravel resolves routes and configuration per virtual host based on the Host header, so without the right hostname the app may respond with different or incomplete content. We add the hostname to local resolution:

echo "10.129.232.3 environment.htb" | sudo tee -a /etc/hosts

Resumen ejecutivo — Environment es una Medium de Linux construida sobre Laravel 11.30.0 que encadena dos CVEs de 2024. Primero, una directiva de PHP mal configurada permite que un parámetro de query (CVE-2024-52301) se cuele como si fuese un flag de línea de comandos, forzando al framework a arrancar en un entorno alternativo con el login efectivamente deshabilitado. Dentro, el gestor de ficheros integrado en el dashboard arrastra un fallo de validación propio (CVE-2024-21546): renombrando el payload como shell.php.. (un punto extra al final) y añadiendo magic bytes de GIF se consigue RCE como www-data. Un backup GPG cifrado revela credenciales del usuario real hish, y la escalada final abusa de que sudo preserva BASH_ENV para un binario que invoca bash internamente, ejecutando código arbitrario como root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.232.3`

Mapa del ataque

[1] Recon -- SSH (OpenSSH 9.2p1) + nginx sirviendo Laravel 11.30.0
        |
[2] CVE-2024-52301 -- register_argc_argv envenena argv vía query string
      +-> POST /login?--env=preprod -> bypass de autenticacion (Burp)
        |
[3] CVE-2024-21546 (UniSharp Laravel-Filemanager) -- shell.php.. (doble extension)
      + magic bytes GIF89a
      +-> el backend normaliza el nombre -> .php. ejecutable  ->  RCE como www-data
        |
[4] user.txt en /home/hish (find + cat)
        |
[5] keyvault.gpg exfiltrado -- gpg --import + gpg --decrypt ->
      ENVIRONMENT.HTB -> marineSPm@ster!!  ->  ssh hish@environment.htb
        |
[6] sudo -l -- hish puede ejecutar /usr/bin/systeminfo como root con BASH_ENV preservada
      (env_keep en sudoers) -- systeminfo invoca bash internamente
      +-> BASH_ENV=/tmp/root.sh ejecutado ANTES del script objetivo, como root
      +-> sudo /usr/bin/systeminfo  ->  root.txt

1. Enumeración

nmap -sV -sC 10.129.232.3

Resultado: SSH (OpenSSH 9.2p1) y HTTP (nginx sirviendo una aplicación Laravel 11.30.0). Solo dos puertos abiertos, así que la superficie de ataque completa está en la aplicación web.

La versión exacta del framework importa: Laravel 11.30.0 es vulnerable a un bypass de autenticación documentado (CVE-2024-52301), corregido en 11.31.0 — esta instancia está a una versión de parche del fix.

Laravel resuelve rutas y configuración por virtual host según la cabecera Host, así que sin el nombre correcto la app puede responder con contenido distinto o incompleto. Añadimos el hostname al resolver local:

echo "10.129.232.3 environment.htb" | sudo tee -a /etc/hosts

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.