Takeoff HTB Writeup

I just solved Takeoff from Hack the Box!

Takeoff Machine Summary

Takeoff is a hard-difficulty Linux machine on Hack The Box that focuses on network enumeration, web application analysis, Server-Side Template Injection (SSTI), cryptographic token manipulation, remote code execution, Docker container enumeration, and Linux privilege escalation.

I began by performing Nmap enumeration to identify the exposed services. The scan revealed SSH on port 22 and an HTTP service on port 80 running behind Nginx. I then enumerated the web application using Feroxbuster and discovered an airline booking platform called HTB Airways, built with the Go Echo framework. By exploring the application's functionality, I registered and authenticated to the platform, searched for available flights, and completed a booking to generate a valid ticket containing a QR code.

During further application analysis, I discovered a ticket notes functionality that accepted user-controlled input. I tested for Server-Side Template Injection (SSTI) by submitting a Go template expression. Although the expression was not evaluated directly on the ticket management page, downloading the ticket as a PDF caused the template to be rendered. By exploiting this behavior to read /proc/self/environ, I recovered sensitive environment variables, including the TICKET_VALIDATION_TOKEN and N8N_API_KEY.

I then investigated the ticket's QR code and discovered that it contained a Go Gob-encoded structure followed by an HMAC-SHA256 signature. The decoded data included the booking reference, ticket token, passenger details, seat information, and a NotifyCmd field. Since the server processed this command during check-in, I recreated the Gob encoding using a small Go program and generated a valid HMAC signature using the previously extracted ticket validation token.

Using a custom Python script, I forged the QR payload and submitted it to the /api/check-in endpoint. By replacing the original notification command with a command of my choice, I confirmed Remote Code Execution (RCE) through a callback to my attacking machine. I subsequently used a Bash reverse-shell payload and obtained an interactive shell on the target as www-data.

With the initial foothold established, I performed internal enumeration using process and network inspection commands. I discovered that the host was running Docker and identified an n8n automation service listening locally on port 5678. Since I had recovered the n8n API key through the SSTI vulnerability, I authenticated to its REST API and enumerated the existing workflows.

Further investigation revealed that n8n was running as root inside its container and allowed workflows to execute system commands through an Execute Command node. I created and activated a custom workflow containing a Webhook trigger connected to an Execute Command node. Triggering the webhook confirmed that commands were executing as root inside the n8n container. I also discovered that the container's /root directory was bind-mounted to the host's /home/kpark directory, allowing me to access the host user's files and retrieve the user flag.

To obtain SSH access as kpark, I generated an SSH key pair on my attacking machine and used the root-level n8n workflow to create an authorized_keys file in the shared directory. After setting the appropriate ownership and permissions, I successfully authenticated to the target over SSH as kpark, obtaining a persistent user-level shell.

For the final privilege escalation, I abused the same Docker bind mount. From the SSH session, I copied the system's Bash binary into /home/kpark. I then modified the n8n workflow to change the copied binary's ownership to root and set its SUID permission. Because the container's /root directory mapped directly to the host's /home/kpark directory, these changes affected the binary on the host itself.

Finally, I executed the modified Bash binary with the -p option, which provided an effective root shell. I verified the elevated privileges and retrieved the root flag, successfully completing the machine.

Overall, Takeoff demonstrates how a chain of vulnerabilities involving insecure template rendering, exposure of sensitive environment variables, weakly isolated command execution through QR ticket processing, excessive automation API privileges, and unsafe Docker bind mounts can lead to complete Linux system compromise.