Conversor — HackTheBox (Full Box)

Challenge Info

Field	Value
Platform	HackTheBox
Target	10.129.1.165
Category	Web / Linux Privilege Escalation
Difficulty	Medium
User Flag	aeff561c839d56cfced2c19e6ec562eb
Root Flag	4f83b59aad1bc7ababce8678ff0feaed

Overview

This is a complete HackTheBox machine involving:

1. User Flag: XSLT Injection → Cron Job RCE → Credential Theft → SSH Access
2. Root Flag: CVE-2024-48990 needrestart PYTHONPATH Injection → Local Privilege Escalation

---

PART 1: User Flag

Reconnaissance

Port Scanning

nmap -sV -sC 10.129.1.165

Results:

Port	Service	Version
22	SSH	OpenSSH 8.9p1
53	DNS	-
80	HTTP	Apache 2.4.52

The HTTP service redirects to conversor.htb - added to /etc/hosts:

echo "10.129.1.165 conversor.htb" | sudo tee -a /etc/hosts

Web Application Analysis

Initial Exploration

The website is an XML to HTML converter using XSLT transformation:

1. User registers an account
2. User uploads XML file
3. User uploads XSLT stylesheet
4. Server transforms XML using XSLT
5. Returns HTML result

Source Code Discovery

On the /about page, found a download link:

/static/source_code.tar.gz

curl -O http://conversor.htb/static/source_code.tar.gz
tar -xzf source_code.tar.gz

Source Code Analysis

Key File: app.py

from lxml import etree

# XML Parser - SECURE configuration (XXE blocked)
parser = etree.XMLParser(
    resolve_entities=False,   # No XXE
    no_network=True,          # No external requests
    dtd_validation=False,
    load_dtd=False
)
xml_tree = etree.parse(xml_path, parser)

# XSLT Parser - INSECURE configuration (no restrictions!)
xslt_tree = etree.parse(xslt_path)  # Default parser = vulnerable!
transform = etree.XSLT(xslt_tree)

...