Usage — HTB Writeup | The Hack Sparrow

Executive summary — Usage combines a blind SQL injection in a Laravel blog's password-reset flow with an unvalidated file upload in its admin panel (CVE-2023-24249 in laravel-admin), which yields a PHP webshell and RCE. The escalation chains two password-reuse steps — first from a Monit config file, then a lesser-known abuse of 7-Zip: a sudo-enabled binary that archives an attacker-writable directory can be turned into a primitive to leak, line by line, any file on the system — including root's SSH private key.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.37.225`

Attack map

[80] usage.htb — blind SQLi in /forget-password (Laravel)
   │  dump admin_users → bcrypt hash → cracked: admin:whatever1
   ▼
[80] admin.usage.htb — Laravel-Admin panel
   │  CVE-2023-24249 — unvalidated avatar upload → PHP webshell
   ▼
[RCE]  dash  (user.txt)
   │  ~/.monitrc leaks admin:3nc0d3d_pa$$w0rd, reused by xander
   ▼
[SU]  xander
   │  sudo NOPASSWD /usr/bin/usage_management → 7za -- * on /var/www/html (777)
   │  7-Zip wildcard file-read (@listfile) → /root/.ssh/id_rsa
   ▼
[ROOT]  SSH with the leaked private key → root.txt

1. Reconnaissance and web enumeration

The lab didn't offer passwordless sudo to edit /etc/hosts, so most enumeration used curl --resolve instead of real vhosts on the system:

echo "10.129.37.225 usage.htb admin.usage.htb" | sudo tee -a /etc/hosts
# No-sudo alternative:
curl --resolve usage.htb:80:10.129.37.225 --resolve admin.usage.htb:80:10.129.37.225 http://usage.htb/

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN m3_allports.txt 10.129.37.225

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

nmap -sT -sCV -p22,80 -Pn -oN m3_services.txt 10.129.37.225

22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/

nginx redirects to usage.htb — virtual hosting is in play:

curl -s --resolve usage.htb:80:10.129.37.225 http://usage.htb/ | grep -oiE '<title>|href='

<title>Daily Blogs</title>
href="http://usage.htb/login"
href="http://usage.htb/registration"
href="http://usage.htb/forget-password"
href="http://admin.usage.htb/"          <-- admin subdomain

A Laravel blog app with login, registration, password reset, and an admin panel under the admin.usage.htb subdomain. Checking the forms:

R() { curl -s -c cj.txt -b cj.txt --resolve usage.htb:80:10.129.37.225 --resolve admin.usage.htb:80:10.129.37.225 "$@"; }

# forget-password
R http://usage.htb/forget-password | grep -oiE 'name="[^"]*"|action="[^"]*"'
# name="_token"   name="email"   action=".../forget-password"

# admin.usage.htb
R http://admin.usage.htb/ | grep -oiE '<title>[^<]*|name="[^"]*"|laravel'
# <title>Admin | Login</title>   username / password / _token   (laravel-admin)

admin.usage.htb is a Laravel-Admin panel (the encore/laravel-admin package) — a key fact to remember for later.

Resumen ejecutivo — Usage combina una inyección SQL ciega en el flujo de recuperación de contraseña de un blog Laravel con una subida de fichero sin validar en su panel de administración (CVE-2023-24249 de laravel-admin), que da un webshell PHP y RCE. La escalada encadena dos reutilizaciones de contraseña — primero desde un fichero de configuración de Monit, luego un abuso poco conocido de 7-Zip: un binario con sudo que comprime un directorio escribible por el atacante puede usarse para filtrar, carácter a carácter, cualquier fichero del sistema — incluida la clave privada SSH de root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.37.225`

Mapa del ataque

[80] usage.htb — SQLi ciega en /forget-password (Laravel)
   │  dump de admin_users → hash bcrypt → crackeado: admin:whatever1
   ▼
[80] admin.usage.htb — panel Laravel-Admin
   │  CVE-2023-24249 — subida de avatar sin validar extensión → webshell PHP
   ▼
[RCE]  dash  (user.txt)
   │  ~/.monitrc filtra admin:3nc0d3d_pa$$w0rd, reutilizada por xander
   ▼
[SU]  xander
   │  sudo NOPASSWD /usr/bin/usage_management → 7za -- * en /var/www/html (777)
   │  fuga de fichero por comodín de 7-Zip (@listfile) → /root/.ssh/id_rsa
   ▼
[ROOT]  SSH con la clave privada filtrada → root.txt

1. Reconocimiento y enumeración web

El laboratorio no ofrecía sudo sin contraseña para editar /etc/hosts, así que la mayor parte de la enumeración usó curl --resolve en vez de vhosts reales en el sistema:

echo "10.129.37.225 usage.htb admin.usage.htb" | sudo tee -a /etc/hosts
# Alternativa sin sudo:
curl --resolve usage.htb:80:10.129.37.225 --resolve admin.usage.htb:80:10.129.37.225 http://usage.htb/

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN m3_allports.txt 10.129.37.225

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

nmap -sT -sCV -p22,80 -Pn -oN m3_services.txt 10.129.37.225

22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/

nginx redirige a usage.htb — hay virtual hosting de por medio:

curl -s --resolve usage.htb:80:10.129.37.225 http://usage.htb/ | grep -oiE '<title>|href='

<title>Daily Blogs</title>
href="http://usage.htb/login"
href="http://usage.htb/registration"
href="http://usage.htb/forget-password"
href="http://admin.usage.htb/"          <-- subdominio de administración

Una aplicación Laravel (blog) con login, registro, recuperación de contraseña, y un panel de administración en el subdominio admin.usage.htb. Revisando los formularios:

R() { curl -s -c cj.txt -b cj.txt --resolve usage.htb:80:10.129.37.225 --resolve admin.usage.htb:80:10.129.37.225 "$@"; }

# forget-password
R http://usage.htb/forget-password | grep -oiE 'name="[^"]*"|action="[^"]*"'
# name="_token"   name="email"   action=".../forget-password"

# admin.usage.htb
R http://admin.usage.htb/ | grep -oiE '<title>[^<]*|name="[^"]*"|laravel'
# <title>Admin | Login</title>   username / password / _token   (laravel-admin)

admin.usage.htb es un panel Laravel-Admin (paquete encore/laravel-admin) — un dato clave a retener para más adelante.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.