Sau — HTB Writeup | The Hack Sparrow

Executive summary — Sau chains an SSRF in Request Baskets (CVE-2023-27163) to reach an internal service blocked by the perimeter firewall, an unauthenticated command injection in that service (Maltrail, CVE-2023-27148) that gives the initial shell, and a privilege escalation abusing the fact that systemctl status launches a pager with sudo's privileges — the pager lets you run a shell with !.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.229.26`

Attack map

[55555] Request Baskets v1.2.1 — basket created without authentication
   │  CVE-2023-27163 — forward_url doesn't validate the destination (SSRF)
   ▼
[127.0.0.1:80] Maltrail 0.53 — only reachable on localhost, behind the firewall
   │  CVE-2023-27148 — unauthenticated OS command injection
   │  (username parameter on the /login endpoint, via the SSRF proxy)
   ▼
[RCE]  puma  (maltrail service account) → user.txt
   │  sudo NOPASSWD: systemctl status trail.service
   │  with a real TTY, systemctl invokes the pager (less) as root
   ▼
[ROOT]  pager escape ("!/bin/sh") → root shell → root.txt

1. Enumeration

sudo nmap -p- --min-rate 3000 -T4 -Pn -n -oA nmap_all 10.129.229.26

PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    filtered http
8338/tcp  filtered unknown
55555/tcp open     unknown

Ports 80 and 8338 show as filtered, not closed: the firewall is silently dropping packets rather than rejecting them. First hint that there are internal services unreachable from outside — for now, the only real web surface is port 55555.

sudo nmap -p22,80,8338,55555 -sC -sV -Pn -n -oA nmap_svc 10.129.229.26

22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
55555/tcp open     http    Golang net/http server
| http-title: Request Baskets
|_Requested resource was /web

Port 55555 serves Request Baskets (darklynx/basket), an open-source "request bin" style tool: it creates "baskets" with a unique URL, captures the HTTP requests that hit it, and, if configured, forwards them as a proxy to a destination URL.

Resumen ejecutivo — Sau encadena un SSRF en Request Baskets (CVE-2023-27163) para alcanzar un servicio interno bloqueado por el firewall perimetral, una inyección de comandos no autenticada en ese servicio (Maltrail, CVE-2023-27148) que da la shell inicial, y una escalada a root abusando de que systemctl status lanza un pager con los privilegios de sudo — el pager permite ejecutar un shell con !.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.229.26`

Mapa del ataque

[55555] Request Baskets v1.2.1 — cesta creada sin autenticación
   │  CVE-2023-27163 — forward_url no valida el destino (SSRF)
   ▼
[127.0.0.1:80] Maltrail 0.53 — solo accesible en localhost, tras el firewall
   │  CVE-2023-27148 — inyección de comandos OS sin autenticar
   │  (parámetro username del endpoint /login, vía el proxy SSRF)
   ▼
[RCE]  puma  (cuenta del servicio maltrail) → user.txt
   │  sudo NOPASSWD: systemctl status trail.service
   │  con TTY real, systemctl invoca el pager (less) como root
   ▼
[ROOT]  escape del pager ("!/bin/sh") → shell root → root.txt

1. Enumeración

sudo nmap -p- --min-rate 3000 -T4 -Pn -n -oA nmap_all 10.129.229.26

PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    filtered http
8338/tcp  filtered unknown
55555/tcp open     unknown

Los puertos 80 y 8338 aparecen como filtered, no closed: el firewall descarta los paquetes en silencio en lugar de rechazarlos. Es la primera pista de que hay servicios internos inalcanzables desde fuera — la única superficie web real, de momento, es el puerto 55555.

sudo nmap -p22,80,8338,55555 -sC -sV -Pn -n -oA nmap_svc 10.129.229.26

22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
55555/tcp open     http    Golang net/http server
| http-title: Request Baskets
|_Requested resource was /web

El puerto 55555 sirve Request Baskets (darklynx/basket), una herramienta open-source tipo "request bin": crea "cestas" con URL única, captura las peticiones HTTP que le llegan y, si se configura, las reenvía como proxy hacia una URL de destino.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.