Help — HTB Writeup | The Hack Sparrow

Executive summary — Help chains an unauthenticated GraphQL endpoint that leaks credentials with a blind SQL injection in HelpDeskZ 1.0.2 to escalate from end user to administrator, re-enable a file upload blocked by a whitelist (EDB-40300) and run code as the system user help — ending in root by exploiting a sign-extension bug in the kernel's eBPF verifier (CVE-2017-16995). The interesting part isn't any single step, but that the public one-click exploit doesn't work as-is: you first have to win application-level admin privilege to re-enable it.

Platform	Hack The Box
Operating system	Linux (Ubuntu 16.04.5 LTS)
Difficulty	Easy
Status	Retired
Target IP	`10.129.230.159`

Attack map

[3000/HTTP] Unauthenticated GraphQL -> leaks credentials
   |  helpme@helpme.com : 5d3c9318... (MD5) -> godhelpmeplz
   v
[80/HTTP] /support -- HelpDeskZ 1.0.2 -- logged in as end user
   |  Blind SQLi (ticket_id / msg_id) -> admin SHA-1 hash -> Welcome1
   v
[staff panel] Settings -> Tickets -- upload whitelist
   |  "php" added by hand
   v
[RCE] EDB-40300 -- PHP webshell -> uid=help (user.txt)
   |
   v
[ROOT] CVE-2017-16995 -- eBPF verifier sign-extension bug -> root.txt

1. Reconnaissance

nmap -p- --min-rate 3000 -Pn -oA scans/all-ports 10.129.230.159
nmap -sCV -p22,80,3000 -Pn -oA scans/services 10.129.230.159

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http     Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
3000/tcp open  http     Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8)

A response TTL of 63 (one hop below 64) confirms a Linux stack, and the OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 banner pins the distro to Ubuntu 16.04 (Xenial) — which already tells us the kernel will be on the 4.4 branch, worth keeping for privilege escalation. Port 80 redirects to the vhost help.htb:

echo '10.129.230.159 help.htb' | sudo tee -a /etc/hosts

Methodology note: run the full -p- scan first. A default 1000-port scan would have found 22 and 80, but port 3000 — the actual way in — would have been missed.

Resumen ejecutivo — Help encadena un endpoint GraphQL sin autenticación que filtra credenciales con una inyección SQL ciega en HelpDeskZ 1.0.2 para escalar de usuario final a administrador, reactivar una subida de fichero que una whitelist bloqueaba (EDB-40300) y ejecutar código como el usuario del sistema help — que termina en root explotando un fallo de extensión de signo en el verificador de eBPF del kernel (CVE-2017-16995). Lo más interesante no es ningún paso aislado, sino que el exploit público de un clic no funciona tal cual: hay que ganar primero privilegio administrativo dentro de la propia aplicación para reactivarlo.

Plataforma	Hack The Box
Sistema operativo	Linux (Ubuntu 16.04.5 LTS)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.230.159`

Mapa del ataque

[3000/HTTP] GraphQL sin auth -> filtra credenciales
   |  helpme@helpme.com : 5d3c9318... (MD5) -> godhelpmeplz
   v
[80/HTTP] /support -- HelpDeskZ 1.0.2 -- login como usuario final
   |  SQLi ciega (ticket_id / msg_id) -> hash SHA-1 de admin -> Welcome1
   v
[panel de staff] Settings -> Tickets -- whitelist de subidas
   |  se añade "php" a mano
   v
[RCE] EDB-40300 -- webshell PHP -> uid=help (user.txt)
   |
   v
[ROOT] CVE-2017-16995 -- sign-extension en el verificador eBPF -> root.txt

1. Reconocimiento

nmap -p- --min-rate 3000 -Pn -oA scans/all-ports 10.129.230.159
nmap -sCV -p22,80,3000 -Pn -oA scans/services 10.129.230.159

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http     Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
3000/tcp open  http     Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8)

El TTL de las respuestas (63, un salto por debajo de 64) confirma pila Linux, y el banner OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 fija la distro en Ubuntu 16.04 (Xenial) — con eso ya sabemos que el kernel será de la rama 4.4, dato que se guarda para la escalada de privilegios. El puerto 80 redirige al vhost help.htb:

echo '10.129.230.159 help.htb' | sudo tee -a /etc/hosts

Detalle de metodología: hacer primero el -p- completo. Un escaneo de los 1000 puertos por defecto habría encontrado el 22 y el 80, pero el 3000 —la puerta de entrada real— se habría perdido.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.