RedPanda — HTB Writeup | The Hack Sparrow

Executive summary — RedPanda is a very Java-focused Easy Linux box. The «Red Panda Search» site (Spring Boot) is vulnerable to SSTI on the Thymeleaf engine, giving RCE as woodenk. For escalation, that same user belongs to the logs group and can write to a log file that a root process (launched by cron) processes periodically: that process opens every image referenced in the log, reads its EXIF Artist metadata field and uses it to build the path of an XML it parses without protection against external entities. By controlling the log line, the image and the metadata, we make root parse our own XXE that reads its SSH key. Path: SSTI → woodenk → poisoned log/EXIF → XXE (root cron) → root.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.227.207`

Attack map

[8080] Red Panda Search → search box → SSTI (Thymeleaf, *{...}) → RCE
   ▼
[SHELL]  woodenk  (user.txt)
   │  id → group "logs": redpanda.log is group-writable
   ▼
[PSPY]  root cron every ~2 min → LogParser.jar (App.java)
   │  reads redpanda.log line by line → URI → JPG image → EXIF Artist → XML
   ▼
[XXE]  URI (traversal) + Artist (traversal) point to our own XML
   │  <!ENTITY foo SYSTEM "file:///root/.ssh/id_rsa"> parsed as root
   ▼
[ROOT]  root SSH key → root.txt

1. Reconnaissance

nmap -sVC 10.129.227.207

22/tcp   open  ssh
8080/tcp open  http

Only two ports: SSH and a web app on http://10.129.227.207:8080. The page title is surprisingly generous with information: «Red Panda Search — Made with Spring Boot». Knowing the backend is Spring Boot already points at a usual suspect in Java land: its default template engine, Thymeleaf, vulnerable to SSTI whenever it concatenates user input carelessly.

Resumen ejecutivo — RedPanda es un Linux Easy muy centrado en Java. El buscador de «Red Panda Search» (Spring Boot) es vulnerable a SSTI sobre el motor Thymeleaf, lo que da RCE como woodenk. Para la escalada, ese mismo usuario pertenece al grupo logs y puede escribir en el log que un proceso de root (lanzado por cron) procesa periodicamente: ese proceso abre cada imagen referenciada en el log, lee su metadato EXIF Artist y con el construye la ruta de un XML que parsea sin proteccion contra entidades externas. Controlando log, imagen y metadato conseguimos que root parsee un XXE propio que lee su clave SSH. Recorrido SSTI → woodenk → log/EXIF envenenados → XXE (cron root) → root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.227.207`

Mapa del ataque

[8080] Red Panda Search → buscador → SSTI (Thymeleaf, *{...}) → RCE
   ▼
[SHELL]  woodenk  (user.txt)
   │  id → grupo "logs": redpanda.log es escribible por el grupo
   ▼
[PSPY]  cron root cada ~2 min → LogParser.jar (App.java)
   │  lee redpanda.log linea a linea → URI → imagen JPG → EXIF Artist → XML
   ▼
[XXE]  URI (traversal) + Artist (traversal) apuntan a XML propio
   │  <!ENTITY foo SYSTEM "file:///root/.ssh/id_rsa"> parseado como root
   ▼
[ROOT]  clave SSH de root → root.txt

1. Reconocimiento

nmap -sVC 10.129.227.207

22/tcp   open  ssh
8080/tcp open  http

Solo dos puertos: SSH y una aplicacion web en http://10.129.227.207:8080. El titulo de la pagina es muy generoso con la informacion: «Red Panda Search — Made with Spring Boot». Saber que el backend es Spring Boot ya apunta a un sospechoso habitual en Java: su motor de plantillas por defecto, Thymeleaf, vulnerable a SSTI cuando concatena entrada de usuario sin cuidado.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.