Hack The Box: Chemistry Machine Walkthrough – Easy Difficulty
Easy Machine BurpSuite, Challenges, CIF, Crystallographic Information File (CIF), CVE-2024-23346, HackTheBox, Linux, Penetration Testing, sqlite3Introduction to Chemistry:
In this writeup, we will explore the “Chemistry” machine from Hack The Box, categorized as an easy difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag.
Objective:
The goal of this walkthrough is to complete the “Chemistry” machine from Hack The Box by achieving the following objectives:
User Flag:
Exploiting CVE-2024-23346: Remote Code Execution via Malicious CIF File
This process demonstrates how a vulnerability in Pymatgen (CVE-2024-23346) can be exploited through a Crystallographic Information File (CIF) to achieve Remote Code Execution (RCE) and gain unauthorized system access. The attack begins by injecting malicious code into a CIF file’s _space_group_magn.transform_BNS_Pp_abc field. Once the modified file is uploaded to the dashboard, nothing happens initially. Further investigation reveals that execution is triggered by clicking the View button. This interaction successfully executes the payload, establishing a reverse shell connection to the attacker’s system.
With remote access secured, SQLite3 is used to inspect the database, revealing multiple user credentials and password hashes. After successfully cracking the hash, the plaintext password is obtained. Finally, using the command “cat user.txt”, the user flag is retrieved, marking the successful completion of the exploitation process.
Root Flag:
Exploiting aiohttp for Privilege Escalation
After discovering a service running on port 8080, an attempt was made to gather information about the server and access the assets directory, which returned a 403 Forbidden status. Further analysis revealed that the server was running aiohttp/3.9.1, prompting a search for known exploits.
Leveraging a Local File Inclusion (LFI) attack on the assets directory, it was possible to obtain the SSH key. With this access, further privilege escalation allowed for reading the root flag from the root.txt file.
Enumerating the Chemistry Machine
Reconnaissance:
Nmap Scan:
Begin with a network scan to identify open ports and running services on the target machine.
nmap -sC -sV -oN nmap_initial.txt 10.10.11.38Nmap Output: