HTB OneTwoSeven — Full Walkthrough

A complete, end-to-end walkthrough of OneTwoSeven, a retired HackTheBox Linux machine. The full chain: deterministic credential generation → symlink escape of an SFTP chroot → vim swap file recovery → SSH port-forwarding to a firewalled admin panel → bypass of commented-out Apache RewriteRules → RCE → CVE-2024-1086 (nf_tables UAF) for root.

The hook: the "disabled" plugin upload was not disabled — the addon manager's switch matched on REQUEST_URI, so the active download rewrite rule could be leveraged to reach the upload code path. And the kernel exploit's deliberate post-exploitation panic forced an exfiltration-by-design payload.

Flags

• User: 94ab980a4ab2c7c1eb8c7f78334d5a5e
• Root: 42379deee25d3b678a7f0df5c055e888

Chain overview

1. Credential generation is deterministic — password = md5(REMOTE_ADDR)[:8], username = "ots-" + base64(pw[3:]) → every IP gets its own SFTP account, and 127.0.0.1 yields the admin's.
2. SFTP chroot escape via symlinks — the chrooted SFTP allows symlinks; Apache resolves them outside the chroot → read /etc/passwd → discover the admin account via its GECOS field (127.0.0.1).
3. Vim swap file of root — .login.php.swp recovered from the admin's home → panel credentials ots-admin / Homesweethome1 (SHA-256 cracked with john + rockyou).
4. SSH port-forward — the admin SFTP account allows -L forwarding despite /bin/false → reach the firewalled 60080 admin panel.
5. RewriteRule bypass — upload "disabled" in .htaccess, but rewrite is active; the addon manager switches on → lands a PHP shell in → .

Contents

README.md     - this overview
WRITEUP.md    - the full walkthrough (recon → user → panel → RCE → root, findings, lessons, timeline)
LICENSE       - MIT

Note: the detailed walkthrough (WRITEUP.md) is written in Spanish; the README serves as the English executive summary.

Skills demonstrated

Lessons

1. A "disabled" feature enforced only by a commented-out RewriteRule is not a security control — it is an obstacle course.
2. An SFTP chroot without nosymlinks is decorative when a neighboring service (Apache) resolves paths outside it.
3. Kernel exploits with deliberate panics require the payload to exfiltrate data in the same instant it gains root.
4. env_keep in sudo -l is never decoration — if proxies are preserved, the allowed command's traffic can be MITM'd.

Author

Axel Feduzka · GitHub @dopaminauta · [email protected]

Practice walkthrough on a retired HackTheBox machine. All attacks executed in an authorized lab environment; target IPs sanitized.

Solve et Coagula — bound by EMET, driven by AHAVA.