Titanic — HTB Writeup | The Hack Sparrow

Executive summary — Titanic chains a path traversal in the ticket-download endpoint of a Flask app, allowing arbitrary file read as www-data. That LFI is used to steal the SQLite database of an internal Gitea instance, crack a PBKDF2-HMAC-SHA256 hash, and reuse the recovered password to get SSH access. The final escalation abuses CVE-2024-41817 in ImageMagick: a root cron job runs magick from a directory writable by the user, which loads a malicious shared library planted there.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.231.221`

Attack map

[80] titanic.htb — booking app (Flask/Werkzeug)
   │  /download?ticket= does not confine the path to the tickets directory
   ▼
[LFI]  arbitrary file read as www-data
   │  steals gitea.db (SQLite) from the dev.titanic.htb vhost
   ▼
[Gitea DB]  developer's PBKDF2-HMAC-SHA256 hash -> cracked (hashcat -m 10900)
   │  password reused as the SSH password
   ▼
[SSH]  developer  (user.txt)
   │  a root cron job runs every minute a script that cd's into a
   │  directory writable by developer before invoking magick
   │  CVE-2024-41817 — ImageMagick looks for libxcb.so.1 in the CWD
   ▼
[ROOT]  malicious libxcb.so.1 -> constructor executed as root  (root.txt)

1. Reconnaissance

The host doesn't respond to ICMP, and a quick top-100 scan came back all filtered — a typical artifact of a firewall dropping pings, not an actual absence of services. A full scan with -Pn (not relying on ping) clears up the real surface:

nmap -p- --min-rate 2000 -Pn -oN recon/nmap-allports.txt 10.129.231.221
nmap -sCV -p22,80 -Pn -oN recon/nmap-services.txt 10.129.231.221

22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu 22.04)
80/tcp open  http    Apache 2.4.52
|_http-title: Did not follow redirect to http://titanic.htb/

Apache's redirect reveals the vhost titanic.htb. After adding it to /etc/hosts, response headers show Server: Werkzeug/3.0.3 Python/3.10.12 — the real app is Flask, with Apache sitting in front as a reverse proxy:

curl -s http://titanic.htb/ | grep -oiE '<title>[^<]*|action="[^"]*"'

<title>Titanic - Book Your Ship Trip
action="/book"

A ticket-booking form (/book) is all the visible functionality on the homepage.

Resumen ejecutivo — Titanic encadena un path traversal en el endpoint de descarga de tickets de una app Flask, que permite lectura arbitraria de ficheros como www-data. Con esa LFI se roba la base de datos SQLite de un Gitea interno, se crackea un hash PBKDF2-HMAC-SHA256 y la contraseña resultante —reutilizada en el sistema— da acceso SSH. La escalada final abusa de CVE-2024-41817 en ImageMagick: una tarea programada de root ejecuta magick desde un directorio escribible por el usuario, que carga una biblioteca compartida maliciosa colocada allí.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.231.221`

Mapa del ataque

[80] titanic.htb — app de reservas (Flask/Werkzeug)
   │  /download?ticket= no confina la ruta al directorio de tickets
   ▼
[LFI]  lectura arbitraria de ficheros como www-data
   │  roba gitea.db (SQLite) del vhost dev.titanic.htb
   ▼
[Gitea DB]  hash PBKDF2-HMAC-SHA256 de developer -> crackeado (hashcat -m 10900)
   │  contraseña reutilizada como contraseña SSH
   ▼
[SSH]  developer  (user.txt)
   │  cron de root ejecuta cada minuto un script que hace cd a un
   │  directorio escribible por developer antes de invocar magick
   │  CVE-2024-41817 — ImageMagick busca libxcb.so.1 en el CWD
   ▼
[ROOT]  libxcb.so.1 maliciosa -> constructor ejecutado como root  (root.txt)

1. Reconocimiento

El host no responde a ICMP y un barrido rápido de los 100 puertos más comunes devolvió todo como filtered — un artefacto típico de un firewall que descarta pings, no una ausencia real de servicios. Un escaneo completo con -Pn (sin depender del ping) aclara la superficie real:

nmap -p- --min-rate 2000 -Pn -oN recon/nmap-allports.txt 10.129.231.221
nmap -sCV -p22,80 -Pn -oN recon/nmap-services.txt 10.129.231.221

22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu 22.04)
80/tcp open  http    Apache 2.4.52
|_http-title: Did not follow redirect to http://titanic.htb/

La redirección de Apache revela el vhost titanic.htb. Tras añadirlo a /etc/hosts, las cabeceras de respuesta muestran Server: Werkzeug/3.0.3 Python/3.10.12 — la app real es Flask, con Apache delante como proxy inverso:

curl -s http://titanic.htb/ | grep -oiE '<title>[^<]*|action="[^"]*"'

<title>Titanic - Book Your Ship Trip
action="/book"

Un formulario de reserva de billetes (/book) es toda la funcionalidad visible en la portada.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.