Lightweight — HTB Writeup | The Hack Sparrow

Executive summary — Lightweight is an exercise in plaintext OpenLDAP combined with Linux capabilities as a privilege primitive. Initial access requires guessing no credential at all: the web application itself provisions an SSH account whose username and password are the visitor's IP address. From there, a tcpdump binary carrying cap_net_raw allows sniffing the LDAP bind the web app performs on every page load, leaking a service account's password in the clear; an encrypted backup in its home directory reveals the source code that in turn leaks a second user's credential, and that user owns a copy of openssl with every capability — including cap_setuid — enough to run arbitrary code as root through a malicious engine.

Platform	Hack The Box
Operating system	CentOS 7 (Linux)
Difficulty	Medium
Status	Retired
Target IP	`10.129.95.236`

Attack map

[HTTP] user.php creates an SSH account -- username=password=<YOUR_IP>
   |
   v
[SSH] low-privilege shell -- tcpdump has cap_net_raw without being root
   |  sniffs 389/loopback while status.php performs a bind
   v
[LDAP] plaintext simple bind captured -> ldapuser2 : 8bc8251332abe1d7f105d3e53ad39ac2
   |  su ldapuser2 -> user.txt + backup.7z (7zAES, password "delete" via rockyou)
   v
[backup.7z] status.php source leaks ldapuser1's credential
   |  su ldapuser1
   v
[CAPABILITIES] custom openssl with "=ep" (incl. cap_setuid) -> malicious .so engine
   v
[ROOT] setuid(0) in the engine's constructor -> SUID bash -> root.txt

1. Reconnaissance

The response TTL (63, i.e. 64 minus one hop) points at Linux before touching a single service.

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.95.236

Only three open ports, but one of them is unusual for a Linux box:

Port	Service	Note
22	OpenSSH 7.4	Standard
80	Apache 2.4.6 (CentOS, PHP/5.4.16)	"Lightweight slider evaluation page"
389	OpenLDAP 2.2.X–2.3.X	The directory service, exposed straight to the outside — the pivot point of the whole box

sudo nmap -p22,80,389 -sCV -Pn -oN nmap-services.txt 10.129.95.236

22/tcp  ssh   OpenSSH 7.4
80/tcp  http  Apache 2.4.6 ((CentOS) ... PHP/5.4.16) — title: "Lightweight slider evaluation page - slendr"
389/tcp ldap  OpenLDAP 2.2.X - 2.3.X
| ssl-cert: Subject: commonName=lightweight.htb

Every other port answers host-prohibited — the signature of firewalld on RHEL/CentOS, and, as it turns out shortly, a firewall that does more than just filter ports.

echo "10.129.95.236 lightweight.htb" | sudo tee -a /etc/hosts

Resumen ejecutivo — Lightweight es un ejercicio de OpenLDAP en texto claro combinado con Linux capabilities como primitiva de privilegio. El acceso inicial no requiere adivinar ninguna credencial: la propia aplicación web crea una cuenta SSH cuyo usuario y contraseña son la IP del visitante. Desde ahí, un tcpdump con cap_net_raw permite esnifar el bind LDAP que la web hace en cada carga, filtrando en claro la contraseña de una cuenta de servicio; un backup cifrado en su home revela el código fuente que a su vez filtra la credencial de un segundo usuario, y ese usuario tiene una copia de openssl con todas las capabilities — incluida cap_setuid — que permite ejecutar código arbitrario como root a través de un engine malicioso.

Plataforma	Hack The Box
Sistema operativo	CentOS 7 (Linux)
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.95.236`

Mapa del ataque

[HTTP] user.php crea cuenta SSH -- usuario=password=<TU_IP>
   |
   v
[SSH] shell de bajo privilegio -- tcpdump con cap_net_raw disponible sin ser root
   |  esnifa el 389/loopback mientras status.php hace bind
   v
[LDAP] simple bind en claro capturado -> ldapuser2 : 8bc8251332abe1d7f105d3e53ad39ac2
   |  su ldapuser2 -> user.txt + backup.7z (7zAES, pass "delete" via rockyou)
   v
[backup.7z] codigo PHP de status.php filtra la credencial de ldapuser1
   |  su ldapuser1
   v
[CAPABILITIES] openssl propio con "=ep" (incl. cap_setuid) -> engine .so malicioso
   v
[ROOT] setuid(0) en el constructor del engine -> bash SUID -> root.txt

1. Reconocimiento

El TTL de la respuesta (63, es decir 64 menos un salto) apunta a Linux antes de tocar ningún servicio.

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.95.236

Solo tres puertos abiertos, pero uno de ellos es poco habitual en una máquina Linux:

Puerto	Servicio	Comentario
22	OpenSSH 7.4	Estándar
80	Apache 2.4.6 (CentOS, PHP/5.4.16)	"Lightweight slider evaluation page"
389	OpenLDAP 2.2.X–2.3.X	Directorio expuesto directamente al exterior — el eje de la máquina

sudo nmap -p22,80,389 -sCV -Pn -oN nmap-services.txt 10.129.95.236

22/tcp  ssh   OpenSSH 7.4
80/tcp  http  Apache 2.4.6 ((CentOS) ... PHP/5.4.16) — title: "Lightweight slider evaluation page - slendr"
389/tcp ldap  OpenLDAP 2.2.X - 2.3.X
| ssl-cert: Subject: commonName=lightweight.htb

El resto de puertos responde con host-prohibited, la firma de firewalld en un RHEL/CentOS — un firewall que, como se ve enseguida, no solo filtra puertos.

echo "10.129.95.236 lightweight.htb" | sudo tee -a /etc/hosts

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.