DoxPit — HackTheBox

Description

The owner of famous underground forum doxpit has been allegedly kidnapped, now that turmoil ensues it is the right time to strike and take down this appalling operation.

A Docker container runs two services via supervisord: a Next.js 14.1.0 front-end on port 1337 (the only externally exposed port) serving a static "doxpit" paste forum UI, and an internal Flask 3.0.3 "AV scanner" service on port 3000 that is not directly reachable from outside. The flag is at /flag<random10hex>.txt, renamed at startup via entrypoint.sh.

Analysis

Architecture

The Dockerfile reveals the dual-service setup:

• Next.js ([email protected]) on port 1337 — the only EXPOSEd port
• Flask (flask==3.0.3) on port 3000 — internal only

# supervisord.conf
[program:next]
command=npm start
directory=/app/front-end

[program:av]
command=python3 run.py
directory=/app/av

The front-end is entirely static — no API calls, no proxy to Flask. It's a decoy. The real attack surface is the internal Flask service, reachable only via SSRF.

Stage 1: Next.js Server Action SSRF (CVE-2024-34351)

Next.js 14.1.0 has a known SSRF vulnerability in server actions. When a server action calls redirect("/error") (a relative path starting with /), Next.js internally constructs a fetch URL as ${proto}://${host}${basePath}${redirectUrl}, where host comes from the client's Host header.

The front-end has a server action in app/serverActions.tsx:

"use server";
import { redirect } from "next/navigation";

export async function doRedirect() {
  redirect("/error");
}

The action ID is embedded in the homepage HTML as $ACTION_ID_0b0da34c9bad83debaebc8b90e4d5ec7544ca862.

...