search

HTB | Atlas

Machine - https://app.hackthebox.com/machines/Atlasarrow-up-right

hashtag
NMAP

└─$ nmap -sC -sV -p 21,22,3389,8080 10.129.238.8 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2026-01-23 22:26 IST
Nmap scan report for 10.129.238.8
Host is up (0.33s latency).

PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           FileZilla ftpd 1.7.2
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla.
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -r--r--r-- 1 ftp ftp        22851463 Jul 03  2023 atlas-pilot-1.0.0-SNAPSHOT.jar
|_-r--r--r-- 1 ftp ftp          586379 Jul 03  2023 atlas_generator.zip
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=filezilla-server self signed certificate
| Not valid before: 2023-06-30T15:35:45
|_Not valid after:  2024-06-30T15:40:45
22/tcp   open  ssh           OpenSSH for_Windows_9.5 (protocol 2.0)
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: ATLAS
|   NetBIOS_Domain_Name: ATLAS
|   NetBIOS_Computer_Name: ATLAS
|   DNS_Domain_Name: ATLAS
|   DNS_Computer_Name: ATLAS
|   Product_Version: 10.0.19041
|_  System_Time: 2026-01-23T16:56:43+00:00
|_ssl-date: 2026-01-23T16:56:53+00:00; +4s from scanner time.
| ssl-cert: Subject: commonName=ATLAS
| Not valid before: 2025-10-08T22:02:25
|_Not valid after:  2026-04-09T22:02:25
8080/tcp open  http          Apache Tomcat (language: en)
|_http-title: Site doesn't have a title (text/html;charset=UTF-8).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 3s, deviation: 0s, median: 3s

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 29.67 seconds

hashtag
Port 21

We can login as anonymous

There are two files

hashtag
Port 8080

There is a web page, which ask us for employee data in XML format.

When we upload a demo XML file, we get the following output:

hashtag
Foothold/ Shell

hashtag
Source Code Analysis

Extracting the Zip file we got from the FTP server, it seems that this is the web application which we saw on Port 8080

In pom.xml we can see the dependency and their version, one that caught my attention is Castor 1.4.1

In the FileUploadController source code, we can find the endpoints of the application, the endpoint /genereateTemplate is interesting:

It seems that this endpoint calls the method createXML from the Client class and will generate a xml template when we call it.

hashtag
Marshall

If we take a closer look at Client.java, we can notice that the xml file is created by using the Castor Marshaller library and If we call /genereateTemplate endpoint we can see that the employee_template.xml is created on the ftp server

And when we upload this file to the webserver we get the following output

hashtag
Unmarshall

In the FileUploadController we can also notice that the uploaded xml file will be handover to the parseXML method.

And in the ParseXML method from the Client.java The file will be unmarshalled back into the employee class.

circle-info

💡 Refer https://dzone.com/articles/introduction-to-jaxb-20arrow-up-right for a better understanding of Marshalling and Unmarshalling

hashtag
Java Deserialization Attacks and JNDI

When searching for java marshale exploit we found https://github.com/mbechler/marshalsecarrow-up-right

But to use this we will required java 8, let’s spin one docker instance for java 8

This will give us

  • Java 8

  • Maven

  • marshalsec built and ready

  • interactive shell by default

Now we build the image

Now let’s run

hashtag
Castor Gaget Chain

With the following command, we notice that there are two gadgets available with Castor

so we are going to try the first one, to get an output we need to define a URL, remembering back to the log4shell vulnerability we can go and try to define a LDAP server

which gives us the following payload

we also start a malicious JNDI / LDAP server via marschalsec

Let’s make Exploit.class

hashtag
Upload

now we only need to prepare the xml template with our payload, for this we need to choose a tag which will be parsed from the code, so we change the "x" to "name" and delete the original name tag from our payload and upload the following xml

as we can see, this will hit our LDAP server but unfortunately the redirect to our webserver will not be executed

But at least we have a confirmed SSRF

hashtag
SSRF to RCE via RMI

When looking for java SSRf JNDi I found some article that uses RMI instead of LDAP ( Since redirection is not working with LDAP)

We'll regenerate our SSRF payload using the RMI scheme and replace it in our generated template again.

hashtag
Ysoserial

Now we can use the ysoserialarrow-up-right tool to generate our RCE payload. FOr running this we will use docker since it it require old dependencied

Now let’s build and run

To verify a simple RCE first let’s set the payload to ping our machine.

Once we upload our XML template again we can see we get a call back right away with code execution.

Now that we've confirmed we have RCE we can now get a reverse shell. Simply changing the command is all that is required at this point since the generated template will still point to our RMI listener.

and we got user.txt

hashtag
Priveleage Esclation

hashtag
WinSSHterm

In the download folder of John we found the WinSSHTerm files

In connections.xml of WinSSHTerm we found the encoded password of admin

Let’s download the WinSSHTerm folder and open it on DNSpy to analysis further

When running the exe it is prompting for master password

To understand this binary better we'll load it into dnSpy

There is AESCrypt method in which there is another function in that method function DecryptWithMP

DecryptWithMP sounds like decrypt with masterpassword, so we are going to investigate the AESCrypt.a Method which is called from this method.

we can see that this method takes a string (A_1) and add a byte array to this and create a rfc289DeriveBytes object out of it and It also uses a hardcoded salt:

It will then use these values to decrypt something, we can add a break point, start the app and try to enter the password "test" to check how this will work, we can see that our provided password will also be salted with some hardcoded value

further we can take a look at the key file, uploading the file to cyberchef and converting it to hex

we can see that this is equal to our array in the code (we just need to exclude the first byte of the key file)

What we also can notice, if we provide a wrong password, the decryption will fail an throw an exception

This should be enough information to write a little brute forcer and try to crack the master password. We can copy and past the most of code out from dnspy and only need to add:

  • loading the key file

  • strip the first byte

  • use a while loop for loading the passwords from rockyou

  • loop until we have no decrypt execption

  • and check if we can base64 decode

with this password we can login and got the administrator password

Since port 22 was open we were able to ssh via administrator

and got the root.txt

PreviousHTB | DelegateNextHTB | BoardLight

Last updated