HackTheBox - Conversor

Why It Matters

The demo shows that even basic file‑upload features can lead to full system compromise, emphasizing the need for strict path sanitization and timely patching of known vulnerable services.

Key Takeaways

• Web app uses XSLT conversion, vulnerable to XSLT injection.
• File upload allows path traversal, enabling arbitrary file writes.
• Root service runs outdated NeedRestart, exposing known CVE exploit.
• Flask framework identification guides targeted testing for framework-specific bugs.
• Combining XSLT payloads with traversal yields remote code execution.

Summary

The video walks through the Hack The Box "Conversor" machine, an ostensibly easy box that hides two distinct attack vectors. The target is a Flask‑based web application that accepts XML and XSLT files to generate HTML reports, while the underlying host runs an outdated NeedRestart service vulnerable to a publicly disclosed CVE.

The presenter demonstrates how the XSLT conversion can be abused for injection, but more reliably exploits a path‑traversal flaw in the file‑upload routine. By supplying "../" sequences or a leading slash, the os.path.join call is bypassed, allowing arbitrary files—including a malicious Python script—to be written to the server’s filesystem. The need for careful framework identification is highlighted, as Flask’s default 404 page helped confirm the stack and guide payload selection.

A memorable line from the host is, “It does a good job at showing how common vulnerabilities can just hide in plain sight,” underscoring the box’s educational value. The walkthrough also notes that the XML parser disables external entity resolution, rendering XXE attempts ineffective, and that the NeedRestart daemon provides a second, CVE‑based privilege‑escalation path.

The dual‑vector approach illustrates why pen‑testers must examine both application‑level logic and underlying services. Overlooking simple file‑path sanitization can grant remote code execution, while unpatched system daemons offer quick root access. The lesson extends to real‑world environments: regular updates and rigorous input validation are essential to mitigate such low‑complexity, high‑impact exploits.

Original Description

00:00 - Introduction

00:52 - Start of nmap, look at 404 errors to discover it is flask

03:30 - Logged into the application, uploading an XML and XSLT to look at the converter

05:45 - Attempting to use XXE to get File Disclosure, which doesn't work

09:10 - Discovering the source code to the web application is on the about page, running it on localhost which makes it easier to identify why exploits fail

13:20 - Exploiting the Path Traversal vulnerability, due to putting user data in os.path.join(), this write files anywhere the webserver has permission to

16:25 - Looking at documentation of the webapp, shows there is a cron executing python scripts in /var/www/conversor/scripts, write a file there to get RCE

20:28 - Showing the XSLT Injection to write files to the server

30:55 - Can run NeedRestart with sudo, which is a GTFOBin, looking at sudoers file it shows how this was overlooked

33:00 - Exploiting CVE-2024-48990 which is a vulnerability against NeedRestart below version 3.7