In this post, I would like to share a walkthrough of the OpenSource Machine from Hack the Box

This room will be considered an Easy machine on Hack The box

What will you gain from the OpenSource machine?

For the user flag, you will need to abuse the API on the website which will give us a shell that way

As for the root flag, you need to play the PAM-Wordle game to get some information about the permission

Information Gathering on OpenSource Machine

Once we have started the VPN connection which requires a download from Hackthebox, we can start the information gathering on the machine by executing the command nmap -sC -sV -p- <IP Address> -PN

# Nmap 7.92 scan initiated Mon May 23 02:04:15 2022 as: nmap -sC -sV -oA initial
Nmap scan report for
Host is up (0.60s latency).
Not shown: 997 closed tcp ports (conn-refused)
22/tcp   open     ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 1e:59:05:7c:a9:58:c9:23:90:0f:75:23:82:3d:05:5f (RSA)
|   256 48:a8:53:e7:e0:08:aa:1d:96:86:52:bb:88:56:a0:b7 (ECDSA)
|_  256 02:1f:97:9e:3c:8e:7a:1c:7c:af:9d:5a:25:4b:b8:c8 (ED25519)
80/tcp   open     http    Werkzeug/2.1.2 Python/3.10.3
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 OK
|     Server: Werkzeug/2.1.2 Python/3.10.3
|     Date: Mon, 23 May 2022 06:05:14 GMT
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 5316
|     Connection: close
|     <html lang="en">
|     <head>
|     <meta charset="UTF-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1.0">
|     <title>upcloud - Upload files for Free!</title>
|     <script src="/static/vendor/jquery/jquery-3.4.1.min.js"></script>
|     <script src="/static/vendor/popper/popper.min.js"></script>
|     <script src="/static/vendor/bootstrap/js/bootstrap.min.js"></script>
|     <script src="/static/js/ie10-viewport-bug-workaround.js"></script>
|     <link rel="stylesheet" href="/static/vendor/bootstrap/css/bootstrap.css"/>
|     <link rel="stylesheet" href=" /static/vendor/bootstrap/css/bootstrap-grid.css"/>
|     <link rel="stylesheet" href=" /static/vendor/bootstrap/css/bootstrap-reboot.css"/>
|     <link rel=
|   HTTPOptions: 
|     HTTP/1.1 200 OK
|     Server: Werkzeug/2.1.2 Python/3.10.3
|     Date: Mon, 23 May 2022 06:05:14 GMT
|     Content-Type: text/html; charset=utf-8
|     Allow: HEAD, OPTIONS, GET
|     Content-Length: 0
|     Connection: close
|   RTSPRequest: 
|     "">
|     <html>
|     <head>
|     <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
|     <title>Error response</title>
|     </head>
|     <body>
|     <h1>Error response</h1>
|     <p>Error code: 400</p>
|     <p>Message: Bad request version ('RTSP/1.0').</p>
|     <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.</p>
|     </body>
|_    </html>
|_http-title: upcloud - Upload files for Free!
|_http-server-header: Werkzeug/2.1.2 Python/3.10.3
3000/tcp filtered ppp
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at :
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at .
# Nmap done at Mon May 23 02:07:10 2022 -- 1 IP address (1 host up) scanned in 175.52 seconds

Let’s access the website interface.

There is nothing that we can investigate on the upper page

However, I notice that there’s a download button at the bottom of the page.

Analyze the file download from the website

Therefore, let’s download the file to our attacker’s machine

After we have successfully unzipped the file, there are only 4 items that i found.

As a result, let’s analyze all the file that resides inside the zip file

Ops! I have missed one hidden file such as .git

There are a few files that look promising

Inside the file, it shows some python code related to uploading into the server.

I will add some python code so that we can use it to create the reverse shell connection.

Uploading the file to the upcloud on an opensource machine

It’s just my instinct but let’s try accessing the upcloud directory. Wow, it exists!

As a result, let’s incept with burpsuite for the packet of uploading the file.

Before we click the forward button, we need to modify the payload especially the header

From the file that we download earlier, I can assume that the filename directory will be the same as downloaded

Darn! It’s been filtered by a WAF application

Therefore, let’s bypass that WAF protection and see if it still is filtered from WAF.

At last, the file has been successfully uploaded to the server

At last, we finally obtain a reverse shell connection back to us. However, it looks like more to a docker environment

As i expected, we are inside the docker environment

Let’s transfer the chisel to the victim’s machine.

Sadly, we cannot transfer it to /dev/shm directory because the permission is denied by the server.

Therefore, we need to transfer it to the /app directory and it works like charm!

We can execute the chisel command just like shown above.

Finally, we can see the website on port 3000 which show Gitea website.

I was thinking that we might be able to access using the credential that we obtain from the file download earlier.

I notice that there’s an ssh private key that we can use to access the machine

Voila! We can access the machine via ssh service.

We can read the user flag by executing the “cat user.txt” command

Escalate to Root Privileges Access

We cannot find any process that we can abuse over here.

Wait! I might be thinking it too much but there is a git directory on the file downloaded earlier.

Lucky! We can see the .git directory and we can see the hooks directory too.

The file pre-commit sample looks promising to me.

Let’s try to make the /bin/bash file as SUID binary

After that, we can save the edited file into pre-commit where remove the sample format

Let’s run /bin/bash -p command and be surprised it works

We can read the root flag by using the “cat /root/root.txt” command

Another method of obtaining the root flag

We can start our nc listener as shown above.

We can use the encoded base64 and decode it with the base64 -d command

Finally, we can obtain the root flag this way on the opensource machine

Extra Information