root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat schooled.md
// writeups

Schooled

3 Apr 2021 · 18 min read · root access
writeupshacktheboxfreebsdMediumretiredvip
Schooled - maquina de Hack The Box

Executive summary — Schooled is an entirely application-layer chain: an outdated Moodle 3.9 running on FreeBSD. Student self-registration, combined with a confirmation trick that needs no real email server, opens the door to a stored XSS (CVE-2020-25627) that steals a teacher's cookie; that session is escalated with CVE-2020-14321 (a teacher can self-assign the Manager role while enrolling users) all the way up to a system Manager, who redefines their own role to grab site:config and install a plugin containing a webshell. From there, Moodle's own database credentials yield password hashes that, once cracked and reused over SSH, give the user shell; the final root is a FreeBSD classic: an unrestricted sudo pkg install runs any package's post-install script as root, signed or not.

PlatformHack The Box
Operating systemFreeBSD 13.0
DifficultyMedium
StatusRetired
Target IP10.129.96.53
Domainschooled.htb · vhost moodle.schooled.htb
Starting pointNo credentials (student self-registration on Moodle)

Attack map

Student self-registration (confirmation embedded in /login/confirm.php, no real email)
   │  student @student.schooled.htb
   ▼
Stored XSS in the "MoodleNet profile" field (CVE-2020-25627)
   │  the teacher review bot visits the profile -> MoodleSession cookie stolen
   │  (not HttpOnly)
   ▼
Teacher Manuel Phillips's session
   │  CVE-2020-14321: enrol/manual/ajax.php with roletoassign=1 (Manager)
   ▼
COURSE-level Manager  ->  login as Lianne Carter (SYSTEM-level Manager)
   │  redefine the Manager role -> grant moodle/site:config
   ▼
Install plugins -> block_rce (PHP webshell)
   │  RCE as www
   ▼
config.php (DB creds) -> mdl_user hashes -> bcrypt cracked
   │  jamie:!QAZ2wsx (reused)                        <- user.txt (SSH)
   ▼
[ROOT] sudo pkg install <local package with a malicious post-install script>
   │  post-install runs as root -> SUID /bin/sh
   ▼
root.txt

1. Reconnaissance

sudo nmap -p- --min-rate 2000 -T4 -Pn 10.129.96.53 -oN nmap/allports.txt
sudo nmap -p 22,80,33060 -sCV -Pn 10.129.96.53 -oN nmap/services.txt
22/tcp    OpenSSH 7.9 (FreeBSD)
80/tcp    Apache 2.4.46 (FreeBSD) PHP/7.4.15  -> "Schooled - A new kind of educational institute"
33060/tcp MySQL X protocol

The site at schooled.htb is static; its teachers.html page lists the faculty — including Manuel Phillips (Mathematics) and Lianne Carter (Manager) — two names that reappear as key pieces of the attack. Enumerating vhosts turns up moodle.schooled.htb, serving a Moodle 3.9 instance (confirmed by lib/upgrade.txt).

echo '10.129.96.53 schooled.htb moodle.schooled.htb' | sudo tee -a /etc/hosts

Port 33060 (MySQL X Protocol) confirms Moodle's database lives on the same box and will be reachable later once there's RCE — worth noting now even though it's not reachable from outside yet.

🔒 Clearance required

Root Access unlocks the content you can't see — everything else on the site is already open.

See Root Access plans

No account? Create one free then upgrade from your console.