Stream HTB Writeup

I just solved Stream from Hack the Box!

Stream Machine Summary

Stream is a Linux-based Hack The Box machine that involves exploiting multiple security misconfigurations, including an exposed Java heap dump, XML External Entity (XXE) injection, credential reuse, insecure backup storage, and unsafe execution of scripts by a root-owned service.

The attack begins with the enumeration of web services and the discovery of an exposed Spring Boot heap dump containing ClickHouse database credentials. These credentials provide access to a database used by an AIDX flight-leg processing pipeline. By exploiting XXE in the downstream XML parser, sensitive files can be retrieved from the target system, including Kafka configuration files containing credentials that are reused for SSH access.

After gaining initial access as svc-infra, lateral movement to martin_cole is achieved through password authentication, allowing retrieval of the user flag. Further enumeration reveals a passwordless Kopia backup repository containing ClickHouse logs, which disclose the database administrator's password.

The documented privilege-escalation path involves abusing ClickHouse's file-writing functionality to overwrite a Python formatter executed by a root-owned Kafka Dead Letter Queue (DLQ) drainer service.

Stream machine demonstrates how several individually exploitable weaknesses can be chained into a complete system compromise. The attack progresses from web-service enumeration and information disclosure to XXE exploitation, credential recovery, SSH access, and lateral movement.

The most significant aspect of the machine is the interaction between the AIDX ingestion service, Kafka message processing, ClickHouse database functionality, and a privileged systemd service. These components create an attack path in which credentials exposed through backups and application logs can ultimately be used to influence code executed with elevated privileges.

The machine highlights the importance of restricting diagnostic endpoints, disabling unsafe XML entity resolution, protecting credentials and backups, enforcing least-privilege database permissions, and preventing privileged services from executing files that lower-privileged components can modify.