Skip to content

Usage — Attack Chain

Target: usage.htb / admin.usage.htb (IP has changed repeatedly on redeploy — current: 10.129.37.180)

Current Path

Nmap (22, 80) → /forget-password blind SQLi → dump admin_users → crack bcrypt hash → Laravel-admin login → CVE-2023-24249 file-manager rename bypass → webshell → reverse shell as dash → user.txt → su xander → stuck: NOPASSWD sudo on custom binary /usr/bin/usage_management, not yet reversed

Branch Points

  • Full nmap only turned up 22/80 — no low-hanging service misconfig, had to go through the web app
  • searchsploit fishing (bootstrap, fontawesome, adminLTE, nginx) was unproductive — the real fingerprint (Laravel-admin) only became obvious after logging into admin.usage.htb, not before
  • /forget-password email param — blind SQLi, --technique=B required (UNION-based tests all failed; app gives no error/UNION surface)
  • Static --csrf-token sqlmap runs failed repeatedly (session-tied/one-time tokens) — fix was replaying a fresh Burp request file with -r and letting sqlmap manage cookies/tokens itself
  • Cracked admin bcrypt hash to password (rockyou, position ~1600 — very early hit)
  • Public PoC for CVE-2023-24249 (IDUZZEL/CVE-2023-24249-Exploit) did not work against this instance — had to do the upload+rename bypass manually via the panel UI
  • Reverse shell landed as dash, not www-data — app runs as its own service user
  • xander credential (3nc0d3d_pa$$w0rd) was already on hand when su xander was run — exact discovery step is NOT in the terminal logs (likely found via the browser during the webshell phase). Needs re-derivation/documentation.
  • Unresolved: pepper.key RSA private key found before logging started, referencing a since-reset IP — doesn't fit the confirmed chain, unclear if still relevant

Next Steps

  • Reverse /usr/bin/usage_management (ELF PIE, not stripped) — root vector via NOPASSWD sudo
  • Pull binary to attacker box for Ghidra/objdump, or at minimum strings/run it unauth'd as xander first
  • Re-verify whether pepper.key / user pepper exists on the current box instance
  • Worth poking Monit on dash's box (.monitrc, port 2812, localhost-only) if the binary reversing stalls — would need a port forward/tunnel from xander's shell