search

HTB | Cypher

machine - https://app.hackthebox.com/machines/Cypherarrow-up-right

IP - 10.10.11.57

hashtag
NMAP

└─$ nmap -sT -p- --min-rate 10000 10.10.11.57 -Pn -oA nmap_ports
Starting Nmap 7.94SVN ( <https://nmap.org> ) at 2025-03-02 16:51 IST
Warning: 10.10.11.57 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.57
Host is up (0.21s latency).
Not shown: 58936 closed tcp ports (conn-refused), 6596 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
1337/tcp open  waste

Nmap done: 1 IP address (1 host up) scanned in 53.16 seconds
└─$ cat nmap_ports.nmap | awk '/^[0-9]+\\/tcp/ {gsub("/tcp",""); print $1}' | tr '\\n' ',' | sed 's/,$/\\n/'
22,80,1337
└─$ nmap -sC -sV -p 22,80,1337 10.10.11.57 -Pn -oA nmap_ports_details
Starting Nmap 7.94SVN ( <https://nmap.org> ) at 2025-03-02 16:53 IST
Nmap scan report for 10.10.11.57
Host is up (0.21s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 be:68:db:82:8e:63:32:45:54:46:b7:08:7b:3b:52:b0 (ECDSA)
|_  256 e5:5b:34:f5:54:43:93:f8:7e:b6:69:4c:ac:d6:3d:23 (ED25519)
80/tcp   open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to <http://cypher.htb/>
|_http-server-header: nginx/1.24.0 (Ubuntu)
1337/tcp open  waste?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 185.86 seconds

hashtag
Port 80

hashtag
directory enumeration

/login

on /testing we found a jar file

hashtag
Foothold/shell

hashtag
Cypher Injection

Let’s download it and decompile the jar file using an online decompiler, and analysis the code

Upon decompiling, we find a file named "CustomFunctions.java". After analyzing it, we can that there is command injection

hashtag
How the Code Works

  1. Takes a URL as input and ensures it starts with http:// or https://.

  2. Constructs a shell command using curl to fetch the HTTP status code:

  3. Executes the command using Runtime.getRuntime().exec(command).

  4. Reads the status code from the process output and returns it.

on passing admin:admin on /login I got invalid credential with the following Burp response

Found thisarrow-up-right article for exploiting the cypher injection

using the below payload to confirm the cypher injection in the username parameter

Since we get error, that means the cypher injection is possible

Let’s use the below payload to get the hit on our machine

We were able to get shell (for some reason it works with busybox, not normal nc)

found cred for neo4j in bbot_preset.yml

The cred did not work for , Neo4j, but it worked for Graphasm

we have user.txt

hashtag
Priv Esc

we have sudo write on /usr/local/bin/bbot

we can view the content of root.txt by

PreviousHTB | UnderPassNextHTB | Dog

Last updated