DutyBound HTB Writeup

I just solved DutyBound from Hack the Box!

DutyBound Machine Summary

DutyBound is a medium difficulty Linux machine on Hack The Box that focuses on standard industrial communication protocols, insecure graphical session controls, and loose validation in automated management tooling. The machine demonstrates how misconfigured internal access vectors and a lack of input sanitization in background administrative tasks can be chained together to achieve complete system compromise, highlighting the risks of exposed legacy protocols and excessive system-wide trust.

The attack chain begins with Nmap enumeration, which reveals SSH, an Nginx web server, and an SSL-protected web interface that redirects users to the airsnacks.htb virtual host. After performing host configuration, subsequent web enumeration uncovers several sensitive endpoints, specifically an automated checkout workflow containing a boarding pass verification endpoint at /checkout/boarding-pass/verify.

During BCBP parsing exploration, probing the verification endpoint with malformed payloads triggers detailed error messages leaking an internal structural dependency on the standard IATA Resolution 792 Bar Coded Boarding Pass (BCBP) layout. After conducting protocol research, a valid 792-byte formatted string mimicking a mandatory single-leg boarding pass layout is crafted to bypass the structural validation checks, resulting in a successful database insertion confirmation.

Further testing reveals a severe SQL injection (SQLi) vulnerability within the INSERT query handling the parsed BCBP parameters. By leveraging PostgreSQL error responses, database environment enumeration confirms that the active database role possesses high system privileges, specifically the pg_execute_server_program permission. This leads to a successful stacked query exploitation attempt utilizing COPY TO PROGRAM, weaponizing the injection vector to achieve initial access as the postgres user via a reverse shell.

With an initial foothold established, extensive graphical session enumeration reveals a running Xorg X11 server on display :0 alongside an Openbox window manager session owned by a separate user named dutyfree-kiosk. Active X11 access verification confirms that a global xhost + access policy is in place, meaning access control checks are completely disabled and local users can interact with the active session without authentication.

To bridge the user gap, XTEST input simulation is performed using a Python script to send a virtual Ctrl+Alt+T key sequence, which triggers the Openbox desktop environment to spawn an administrative xterm instance. Through X11 window enumeration and tracking internal window metadata, the newly generated terminal's process identifier is successfully captured. By executing input focus manipulation, keyboard focus is forced away from the primary application directly onto the hidden terminal, allowing automated keystroke delivery to run a staging script and grant a secondary reverse shell, achieving user access escalation as dutyfree-kiosk along with the user flag.

The final stage of the attack chain targets a local privilege escalation vector involving automated administrative automation. While performing internal script enumeration, a background bash script at /opt/vrs/bin/apply-duty-rates.sh is found to process external data records using an unvalidated and dangerous eval expression. Cross-referencing this with systemd service enumeration confirms that a path watcher unit dynamically triggers this script to run with elevated privileges whenever changes are made to an associated configuration file.

Leveraging group membership exploitation, the user's membership in the pos-ops group provides write permissions to the monitored /opt/vrs/data/duty-rates.csv path. By executing CSV payload injection, a malicious row containing nested shell commands is appended to the document before triggering the automatic path watcher execution. The elevated service automatically parses the file and triggers the hidden payload through the eval statement, yielding root access via a final reverse shell and allowing retrieval of the root flag to complete the machine.

Overall, DutyBound is an excellent demonstration of how industrial data structures, weak graphical access policies, unsafe input evaluation, and automated administrative triggers can be sequentially combined into a highly technical and realistic exploit sequence from low-privileged execution to absolute control.