Hack The Box — ScriptKiddie Writeup
Tags: Information Technology, Pentesting, Information Security, Cybersecurity, Hackthebox

ScriptKiddie is an Easy machine listed on Hack The Box. It was released on February 6th, 2021. This box’s vulnerability was largely based on poor input validation, resulting in the upload of a malicious .apk file. While I could not find. CVE code for this vulnerability, the Exploit Database ID is 43905. It is also worth noting that keeping penetration testing tools on a public-facing system allowed me to escalate to root privileges almost immediately.

Part One: Enumeration

A SYN port scan picked up a number of open ports. Notably, a web server. This also showed me that the program Werkzeug was running. Banner grabbing is often promising on Hack The Box, so I research Werkzeug. What I find is interesting, but I am unable to make use of any of it right now.

This could very well be the Chekhov’s Gun that helps me pivot inwards, but putting this info on the back burner for the moment allows me to look for a more immediate pivot point.

Part Two: Checking For a Web-based Entry Point

It is an unfortunate reality that many Systems Administrators believe using non-standard ports will hide their web assets. That seems to be the case here, where a web page hosted on port 5000 features two common pentesting tools, and a file upload specifically for payload files.

Exploiting Werkzeug through this avenue does not immediately yield results, but the pull-down menu for payloads also has an Android option. So, I Google “android template injection apk” and the first option is a Rapid7 page offering the following instructions for making a Metasploit payload for such an occasion.

“msf > use exploit/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection msf exploit(metasploit_msfvenom_apk_template_cmd_injection) > show targets …targets… msf exploit(metasploit_msfvenom_apk_template_cmd_injection) > set TARGET < target-id > msf exploit(metasploit_msfvenom_apk_template_cmd_injection) > show options …show and set options… msf exploit(metasploit_msfvenom_apk_template_cmd_injection) > exploit”

This works exactly as it is supposed to.

Part Three: Getting The User Flag

Payload in hand, I start a Netcat server, and upload the malicious apk file. I am immediately given file access.

The Netcat shell has immediate access to the User Flag.

Part Four: Escalating to Root Access

A box named Script Kiddie seems like a good candidate for a quick pivot to a root flag.

It was worth a shot. Maybe a pty shell?

So the most immediate methods of privilege escalation don’t seem to work. Accordingly, I start looking through files, hoping to find something with root access, or the promise of getting root access later.

Since I know what this box is set up for, I am pretty sure I can find a pivot point using the tools on this box. Since Script Kiddie is something of a slur for people who overuse pentesting tools (like I do), let’s check for the big one.

Metasploit is installed, and file access is offered in Metasploit. However, my access limitations don’t seem to have changed. Using bash, I improve my shell access.

These attempts appear to work.

This is one of those situations where bothered comments such as those seen above are probably a good thing. As suspected, this allows access to the Root Flag.