HackTheBox - Interpreter

Why It Matters

Outdated Java services with deserialization flaws can expose entire backend databases, turning a simple web exploit into full credential theft and privileged access.

Key Takeaways

• Exploited Java deserialization CVE in Mirth Connect 4.4.0 via crafted XML.
• Gained shell, dumped MySQL DB, extracted PBKDF2‑HMAC‑SHA256 password hash.
• Converted hash to Hashcat format, enabling cracking of admin credentials.
• Discovered insecure custom templating engine allowing remote code execution.
• Demonstrated full exploitation chain from nmap scan to privileged access.

Summary

The video walks through the HackTheBox "Interpreter" machine, beginning with an nmap scan that reveals SSH, HTTP, and HTTPS services on a Debian host. By inspecting the web application’s JNLP file, the presenter identifies Mirth Connect 4.4.0 and locates CVE‑2023‑43208, a Java deserialization flaw exploitable via a crafted XML payload.

Using the vulnerability, a reverse shell is obtained, the attacker pivots to the server’s filesystem, and extracts the MySQL configuration from mirth.properties. Connecting to the local database yields a PBKDF2‑HMAC‑SHA256 password hash stored in the person_password table. The presenter demonstrates how to parse the Base64‑encoded value, isolate the salt and iteration count, and reformat it for Hashcat mode 10900, enabling offline cracking of the admin credential.

Key technical details include the use of a custom templating engine that evaluates triple‑f‑string expressions, the IFS‑based quote‑escaping trick to bypass Java’s quoting restrictions, and the base64‑encoding of the reverse‑shell command to avoid bad characters. The walkthrough also references the Swagger API endpoint, the YSOSerial payload generator, and the specific hash‑mode filters used to locate the correct PBKDF2 variant.

The demonstration underscores the danger of unpatched Java applications and insecure custom code paths, showing how a single deserialization bug can lead from remote code execution to full database compromise and credential harvesting. It provides a reproducible methodology valuable for both CTF participants and real‑world penetration testers.

Original Description

00:00 - Introduction

00:46 - Start of nmap

05:30 - Looking at CVE-2023-43208, Exploiting Mirth Connect 4.4.0

07:45 - Extracting the payload from python so we can send it via the API, getting ping to work to verify RCE

09:22 - Getting a reverse shell working in one-shot, weird oddity due to Java Deserialization

13:10 - Reverse shell returned, dumping the database

16:00 - Looking at Mirth Connect Source Code to see how the passwords are stored, then getting the passwords in a format hashcat likes to crack

27:00 - SSH as Sedric, discovering an app listening on port 54321, doing some weird eval

36:20 - Getting a payload to the custom webserver, troubleshooting XML Schema validation

40:20 - Confirming code execution then building a payload to get a shell