Hospital — HTB Writeup | The Hack Sparrow

Executive summary — Hospital is a Medium box with two worlds: a Linux container and the Windows host (a Domain Controller). A medical-report upload portal (8080) blocks .php but accepts .phar, giving RCE as www-data inside an Ubuntu 23.04 container. Its 5.19.0-35 kernel is vulnerable to GameOver(lay) (CVE-2023-2640/32629), combining unshare, OverlayFS and misconfigured capabilities to escape the container and reach root, exposing /etc/shadow. We crack drwilliams's password, reused on the Roundcube instance (443), where an email from drbrown asks for .eps files for GhostScript — CVE-2023-36664 lets us embed a PowerShell payload inside the .eps itself via a %pipe% directive, giving a shell as drbrown on Windows. Since Apache/XAMPP runs as SYSTEM and its document root is writable, a webshell there executes with full privileges.

Platform	Hack The Box
Operating system	Windows
Difficulty	Medium
Status	Retired
Target IP	`10.129.229.189`

Attack map

[Recon] 30 open ports -- Kerberos/LDAP/SMB/RDP/WinRM (Domain Controller)
      +-> [8080] Medical-report upload portal -- blocks .php, allows .phar
        |
[www-data]  p0wny-shell.phar -> RCE in a Linux container (Ubuntu 23.04)
      +-> stable reverse shell (named pipe + nc)
      +-> kernel 5.19.0-35 -> GameOver(lay) (CVE-2023-2640 / CVE-2023-32629)
      +-> unshare + overlayfs + setcap -> container escape -> root
        |
[/etc/shadow]  drwilliams hash -- John -> qwe123!@#
        |
[443] Roundcube (webmail) -- login drwilliams:qwe123!@#
      an email from drbrown asks for .eps files for GhostScript
        |
[CVE-2023-36664] GhostScript command injection in .eps
      PowerShell payload (UTF-16LE, base64) via a %pipe% directive
      +-> attached and emailed -> executed by drbrown on Windows
        |
[drbrown @ Windows]  C:\xampp\htdocs is writable -- Apache/XAMPP runs as SYSTEM
      +-> shell.php with shell_exec(powershell reverse shell)
      +-> GET https://<TIP>/shell.php
        |
[SYSTEM]  root.txt

1. Reconnaissance

nmap -p- --min-rate=1000 -T4 -oN nmap_all_ports.txt 10.129.229.189

30 ports come up open. Among the relevant ones: 22 (SSH), 53 (DNS), 88 (Kerberos), 135 (MSRPC), 139 (NetBIOS), 389 (LDAP), 443 (HTTPS), 445 (SMB), 3389 (RDP), 5985 (WinRM), 8080 (HTTP) and 9389 (ADWS).

This combination — Kerberos + LDAP + SMB + ADWS — is the classic fingerprint of an Active Directory Domain Controller. The two web ports (443/8080) are the realistic entry vector: we won't attack AD directly, but through the applications exposed on top of it.

nmap -p22,53,88,135,139,389,443,445,464,593,636,1801,2103,2105,2107,2179,3268,3269,3389,5985,6032,6404,6406,6407,6409,6613,6637,8080,9389 -sC -sV -oN nmap_services.txt 10.129.229.189

Port 443 serves a Roundcube instance — the login page reads "Hospital Webmail :: Welcome to Hospital Webmail". Port 8080 serves a "Hospital" application inviting users to upload medical records ("In order to get more personalized treatment, please upload your medical records") and allows open account registration — that open, unmoderated sign-up is the sign that the entry point is there.

Resumen ejecutivo — Hospital es un Medium con dos mundos: un contenedor Linux y el host Windows (Domain Controller). Un portal de subida de informes médicos (8080) bloquea .php pero acepta .phar, dando RCE como www-data dentro de un contenedor Ubuntu 23.04. Su kernel 5.19.0-35 es vulnerable a GameOver(lay) (CVE-2023-2640/32629), que combina unshare, OverlayFS y capabilities mal configuradas para escapar del contenedor y llegar a root, exponiendo /etc/shadow. Crackeamos la contraseña de drwilliams, reutilizada en el Roundcube (443), donde un correo de drbrown pide ficheros .eps para GhostScript — CVE-2023-36664 permite incrustar un payload de PowerShell en el propio .eps mediante una directiva %pipe%, dando shell como drbrown en Windows. Como Apache/XAMPP corre como SYSTEM y su document root es escribible, una webshell ahí ejecuta con privilegios totales.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.229.189`

Mapa del ataque

[Recon] 30 puertos abiertos -- Kerberos/LDAP/SMB/RDP/WinRM (Domain Controller)
      +-> [8080] Portal de subida de informes -- bloquea .php, permite .phar
        |
[www-data]  p0wny-shell.phar -> RCE en contenedor Linux (Ubuntu 23.04)
      +-> reverse shell estable (named pipe + nc)
      +-> kernel 5.19.0-35 -> GameOver(lay) (CVE-2023-2640 / CVE-2023-32629)
      +-> unshare + overlayfs + setcap -> escape del contenedor -> root
        |
[/etc/shadow]  hash de drwilliams -- John -> qwe123!@#
        |
[443] Roundcube (webmail) -- login drwilliams:qwe123!@#
      correo de drbrown pide ficheros .eps para GhostScript
        |
[CVE-2023-36664] GhostScript command injection en .eps
      payload PowerShell (UTF-16LE, base64) via directiva %pipe%
      +-> adjuntado y enviado por correo -> ejecutado por drbrown en Windows
        |
[drbrown @ Windows]  C:\xampp\htdocs escribible -- Apache/XAMPP corre como SYSTEM
      +-> shell.php con shell_exec(powershell reverse shell)
      +-> GET https://<TIP>/shell.php
        |
[SYSTEM]  root.txt

1. Reconocimiento

nmap -p- --min-rate=1000 -T4 -oN nmap_all_ports.txt 10.129.229.189

Aparecen 30 puertos abiertos. Entre los más relevantes: 22 (SSH), 53 (DNS), 88 (Kerberos), 135 (MSRPC), 139 (NetBIOS), 389 (LDAP), 443 (HTTPS), 445 (SMB), 3389 (RDP), 5985 (WinRM), 8080 (HTTP) y 9389 (ADWS).

Esta combinación — Kerberos + LDAP + SMB + ADWS — es la huella clásica de un Domain Controller de Active Directory. Los dos puertos web (443/8080) son el vector de entrada realista: no vamos a atacar AD directamente, sino a través de las aplicaciones expuestas.

nmap -p22,53,88,135,139,389,443,445,464,593,636,1801,2103,2105,2107,2179,3268,3269,3389,5985,6032,6404,6406,6407,6409,6613,6637,8080,9389 -sC -sV -oN nmap_services.txt 10.129.229.189

El puerto 443 sirve un Roundcube — el login muestra "Hospital Webmail :: Welcome to Hospital Webmail". El puerto 8080 sirve una aplicación "Hospital" que invita a subir historiales médicos ("In order to get more personalized treatment, please upload your medical records") y permite registro libre de cuentas — ese registro abierto, sin invitación ni aprobación, es la señal de que el punto de entrada está ahí.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.