TartarSauce — HTB Writeup | The Hack Sparrow

Executive summary — TartarSauce is a Medium Linux box where the real vector hides two levels below the web root: a nested WordPress at /webservices/wp running the gwolle-gb plugin, vulnerable to unauthenticated Remote File Inclusion (CVE-2015-8351) → shell as www-data. A sudo permission over tar escalates to onuma (user flag) via a documented GTFOBins abuse. Root comes from manipulating a periodic root backup script (backuperer): replacing a file with a symlink to root.txt during the race window between packaging and validation forces its diff comparison to fail and leak the flag's content into a readable error log.

Platform	Hack The Box
Operating system	Linux
Difficulty	Medium
Status	Retired
Target IP	`10.129.17.13`

Attack map

[1] Recon -- 80/tcp http (only vector)
        |
[2] gobuster (two rounds) -- /webservices -> /webservices/wp (nested WordPress)
        |
[3] gwolle-gb plugin -- unauthenticated Remote File Inclusion (RFI) via ajaxresponse.php?abspath=
      +-> PHP reverse shell hosted on our own server, remotely included
      +-> shell as www-data
        |
[4] sudo -l -- (onuma) NOPASSWD: /bin/tar
      GTFOBins: tar --checkpoint-action=exec -> arbitrary execution
      +-> shell as onuma  ->  user.txt
        |
[5] Periodic root process: /usr/sbin/backuperer -- backup at /var/tmp/.random,
      sleep 30, decompresses, diff, error log if differences found
        |
[6] Replace the backup's robots.txt with a symlink to /root/root.txt before
      backuperer processes it -> repack -> diff fails -> the error log
      leaks root.txt's content

1. Reconnaissance

As with any assessment, the first step is finding out which services the box exposes before deciding where to attack.

nmap -p- --min-rate 5000 10.129.17.13

80/tcp open http

-p- scans all 65535 ports (not just the default top 1000) and --min-rate 5000 speeds things up by forcing a more aggressive packet rate — essential so a service on a non-standard port doesn't slip through. The result here is blunt: a single open port, 80. With no SSH exposed and nothing else listening, the entire initial compromise has to go through the web application.

Resumen ejecutivo — TartarSauce es una Medium de Linux donde el vector real está escondido dos niveles bajo la raíz web: un WordPress anidado en /webservices/wp con el plugin gwolle-gb, vulnerable a Remote File Inclusion sin autenticación (CVE-2015-8351) → shell como www-data. Un permiso sudo sobre tar escala a onuma (user flag) vía un abuso documentado en GTFOBins. El root llega manipulando un script de backup (backuperer) que se ejecuta periódicamente como root: sustituir un fichero por un symlink a root.txt durante la ventana de carrera entre el empaquetado y la validación fuerza que su comparación diff falle y filtre el contenido de la flag en un log de error legible.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.17.13`

Mapa del ataque

[1] Recon -- 80/tcp http (unico vector)
        |
[2] gobuster (dos rondas) -- /webservices -> /webservices/wp (WordPress anidado)
        |
[3] Plugin gwolle-gb -- Remote File Inclusion (RFI) sin auth via ajaxresponse.php?abspath=
      +-> reverse shell PHP alojada en un server propio, incluida remotamente
      +-> shell como www-data
        |
[4] sudo -l -- (onuma) NOPASSWD: /bin/tar
      GTFOBins: tar --checkpoint-action=exec -> ejecucion arbitraria
      +-> shell como onuma  ->  user.txt
        |
[5] Proceso root periodico: /usr/sbin/backuperer -- backup en /var/tmp/.random,
      sleep 30, descomprime, diff, log de error si hay diferencias
        |
[6] Sustituir robots.txt del backup por un symlink a /root/root.txt antes de que
      backuperer lo procese -> reempaquetar -> diff falla -> el log de error
      filtra el contenido de root.txt

1. Reconocimiento

Como en cualquier auditoría, se empieza identificando qué servicios expone la máquina antes de decidir por dónde atacar.

nmap -p- --min-rate 5000 10.129.17.13

80/tcp open http

-p- escanea los 65535 puertos (no solo el top 1000 por defecto) y --min-rate 5000 acelera el escaneo forzando un envío de paquetes más agresivo — imprescindible para no perderse un servicio en un puerto no estándar. Aquí el resultado es tajante: un único puerto abierto, el 80. Sin SSH expuesto ni otros servicios, todo el compromiso inicial tiene que pasar por la aplicación web.

🔒 Clearance required

Root Access unlocks the content you can't see — everything else on the site is already open.

See Root Access plans

No account? Create one free then upgrade from your console.