Chronos Walkthrough

Chronos VulnHub Walkthrough#

This is a walkthrough for the Chronos machine on VulnHub

Step 1: Initial Enumeration with Nmap#

Started with an nmap scan and found three open ports: 22 (SSH), 80 (HTTP), and 8000 (an HTTP service running on a Node.js framework).

Step 2: Analyzing the HTTP Service#

After visiting the website on port 8000, I found a basic site with no forms or interactive elements. However, by examining its JavaScript code, I noticed a request being sent for date and time using a format query parameter.

Step 3: Investigating the Query Parameter#

I intercepted the request with Burp Suite and discovered that the format parameter accepts a Base58-encoded string. Initially, I suspected that it might be a Server-Side Template Injection (SSTI) or command injection vulnerability. It turned out to be a command injection vulnerability with Base58 encoding, so I crafted a reverse shell payload encoded in Base58.

Step 4: Executing the Payload#

By sending the payload to the vulnerable URL, I was able to gain a reverse shell as the www-data user.

Step 5: Further Enumeration with LinPEAS#

After basic enumeration with LinPEAS, I found multiple directories named chronos and chronos-v2. It seemed like another npm server was running locally on 127.0.0.1.

Step 6: Exploiting Local NPM Server#

After enumerating the code, I found a vulnerable version of express-fileupload with known Remote Code Execution (RCE) vulnerabilities.

Step 7: Gaining a Higher Privileged Shell#

I set up a script on the victim machine and managed to get a reverse shell as imera.

Step 8: Privilege Escalation to Root#

Using sudo -l, I found that imera can run npm and node with NOPASSWORD. As expected, I used node for privilege escalation and gained a root shell.

- Sagar Sehrawat

Adapted from sagar-sehrawat/VulnHub-Machine-Solutions under MIT.