{"id":224,"date":"2025-08-02T18:59:00","date_gmt":"2025-08-02T18:59:00","guid":{"rendered":"https:\/\/thecyberstaff.com\/?p=224"},"modified":"2025-12-28T19:25:44","modified_gmt":"2025-12-28T19:25:44","slug":"broker-hackthebox-lab","status":"publish","type":"post","link":"https:\/\/thecyberstaff.com\/?p=224","title":{"rendered":"Broker- Hackthebox lab"},"content":{"rendered":"\n<p>As always, I start off the assessment with scanning for open TCP and UDP ports.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"774\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-37-1024x774.png\" alt=\"\" class=\"wp-image-400\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-37-1024x774.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-37-300x227.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-37-768x581.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-37.png 1062w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"758\" height=\"142\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-38.png\" alt=\"\" class=\"wp-image-401\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-38.png 758w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-38-300x56.png 300w\" sizes=\"auto, (max-width: 758px) 100vw, 758px\" \/><\/figure>\n\n\n\n<p>I started looking into the ActiveMQ service and did a search for version 5.15.15. This led to the CVE-2023-46604 exploit with a public RCE on GitHub.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"707\" height=\"162\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-40.png\" alt=\"\" class=\"wp-image-403\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-40.png 707w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-40-300x69.png 300w\" sizes=\"auto, (max-width: 707px) 100vw, 707px\" \/><\/figure>\n\n\n\n<p>I pulled down the exploit to my attack machine and ran the thing.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"651\" height=\"217\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-41.png\" alt=\"\" class=\"wp-image-404\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-41.png 651w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-41-300x100.png 300w\" sizes=\"auto, (max-width: 651px) 100vw, 651px\" \/><\/figure>\n\n\n\n<p>I got a reverse shell on my listener.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"632\" height=\"251\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-42.png\" alt=\"\" class=\"wp-image-405\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-42.png 632w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-42-300x119.png 300w\" sizes=\"auto, (max-width: 632px) 100vw, 632px\" \/><\/figure>\n\n\n\n<p>At this point I must have gotten distracted and started working on the setlist for my band, here is a screenshot of that.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"839\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-43.png\" alt=\"\" class=\"wp-image-407\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-43.png 640w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/image-43-229x300.png 229w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p>Running &#8220;sudo -l&#8221; I see that the user has permissions to run nginx as root.<\/p>\n\n\n\n<p>By default Nginx starts as root (so it can bind to low ports) then immediately drops to the user named in the user directive (often www-data or nginx). Setting it explicitly to root stops that privilege drop, so every worker process keeps root\u2019s file-system permissions. I snagged this conf file from <a href=\"https:\/\/0xdf.gitlab.io\/2023\/11\/09\/htb-broker.html\">https:\/\/0xdf.gitlab.io\/2023\/11\/09\/htb-broker.html<\/a>. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"874\" height=\"432\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110600-2.png\" alt=\"\" class=\"wp-image-410\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110600-2.png 874w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110600-2-300x148.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110600-2-768x380.png 768w\" sizes=\"auto, (max-width: 874px) 100vw, 874px\" \/><\/figure>\n\n\n\n<p>This basically allows me to read and write files to the root directory so I was able to read out the required flag.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"204\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110625-1024x204.png\" alt=\"\" class=\"wp-image-411\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110625-1024x204.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110625-300x60.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110625-768x153.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729110625.png 1316w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I also created a key pair for ssh and write the public key to the \/root\/.ssh\/ folder to attempt an ssh connection with no password.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"627\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729120523-1024x627.png\" alt=\"\" class=\"wp-image-412\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729120523-1024x627.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729120523-300x184.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729120523-768x470.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729120523.png 1172w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"410\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729121832-1024x410.png\" alt=\"\" class=\"wp-image-413\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729121832-1024x410.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729121832-300x120.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729121832-768x308.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729121832-1536x615.png 1536w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729121832.png 1708w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>With the public key on the target box. I was able to connect with ssh gaining access to the root user on the box.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1009\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729123348-1024x1009.png\" alt=\"\" class=\"wp-image-414\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729123348-1024x1009.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729123348-300x296.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729123348-768x757.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/08\/Pasted-image-20250729123348.png 1254w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>In this lab, Broker\u2019s lesson is simple: least privilege is not optional security hygiene- it\u2019s the last line of defense. One overly permissive sudo rule, one careless config file, and the entire filesystem becomes a public website.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As always, I start off the assessment with scanning for open TCP and UDP ports. I started looking into the ActiveMQ service and did a search for version 5.15.15. This led to the CVE-2023-46604 exploit with a public RCE on GitHub. I pulled down the exploit to my attack machine [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":225,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-224","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-pentesting"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=224"}],"version-history":[{"count":2,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/224\/revisions"}],"predecessor-version":[{"id":415,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/224\/revisions\/415"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/media\/225"}],"wp:attachment":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}