TwoMillion

Technical Walkthrough

TwoMillion Walkthrough

Raw flags and reusable secrets are stored only under loot/.

Summary

TwoMillion exposed a web app on 2million.htb. The invite workflow allowed account creation, the authenticated API exposed admin and VPN routes, and the admin settings endpoint accepted a JSON request that promoted the current user. The admin VPN generation endpoint then allowed command injection through the username field.

The injection read the web application environment file. A reused credential from that file allowed SSH login as admin, where the user flag was captured to loot/user.txt. Local mail pointed to an OverlayFS/FUSE kernel issue; the target kernel and tooling matched <secret redacted> conditions. A two-process PoC yielded root execution and the root flag was captured to loot/root.txt.

An alternative privilege escalation was also validated with <secret redacted> Looney Tunables. The vulnerable trigger is the <secret redacted> environment variable; the PoC produced root execution and captured proof to loot/root-looney.txt.

Reproduction Notes

1. Use host-aware requests for 2million.htb against <TARGET>.
2. Generate an invite and register through /api/v1/user/register using the form field code.
3. Login through /api/v1/user/login and enumerate /api/v1.
4. Send a JSON PUT to /api/v1/admin/settings/update for the current account.
5. Send JSON to /api/v1/admin/vpn/generate; verify command injection with a harmless identity command.
6. Read the application environment file through the injection and test credential reuse over SSH as admin.
7. Use the local mail hint and kernel/tooling checks to justify <secret redacted>.
8. Run the two-process OverlayFS/FUSE PoC, prove root execution, and capture root.txt.

Evidence

• Recon: nmap/initial.txt, nmap/allports.txt
• Web/API: enum/authenticated-api-summary-20260527T093138Z.txt, enum/admin-update-vpn-summary-20260527T093210Z.txt
• Command injection: enum/vpn-injection-summary-20260527T093235Z.txt
• Foothold: enum/foothold-summary-20260527T093428Z.txt
• Privilege escalation: enum/admin-privesc-enum-20260527T093528Z.txt, enum/root-exploit-summary-20260527T095404Z.txt
• Alternative privilege escalation: enum/root-exploit-looney-summary-20260527T101434Z.txt

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

Evidence Ledger

Synthesis

Current completion state: COMPLETE.

Attack chain:

1. Host-aware HTTP enumeration identified 2million.htb and the invite/register/login workflow.
2. Invite generation allowed account registration.
3. Authenticated /api/v1 route listing exposed admin settings and VPN generation endpoints.
4. Admin settings accepted a JSON update that set the current account as admin.
5. Admin VPN generation was vulnerable to command injection in username.
6. Command injection read the web app environment file; credential reuse gave SSH access as admin.
7. Local mail and kernel details supported <secret redacted> OverlayFS/FUSE privilege escalation.
8. Two-process <secret redacted> exploit yielded root execution and root flag capture.

Alternative privilege escalation: GLIBC 2.35 was vulnerable to <secret redacted> Looney Tunables. A PoC using <secret redacted> also yielded root execution and captured root proof to loot/root-looney.txt.

Raw flags and reusable secrets must be stored only under loot/.

Attack Map

Confirmed Path

Key Decisions

• Used curl --resolve instead of relying on a persistent /etc/hosts edit on the Pwnbox.
• Corrected registration from invite_code to the form-backed code parameter.
• Used JSON content type for admin update and VPN generation after form posts returned content-type errors.
• Switched from the first single-binary OverlayFS PoC to the two-process <secret redacted> workflow after the first PoC did not trigger on this kernel.

Memory Summary

TwoMillion validated chain:

• Add 2million.htb or use curl --resolve; IP root redirects to the vhost.
• Invite workflow allows generating a code and registering with form field code.
• Authenticated /api/v1 route list exposes admin settings and VPN generation.
• JSON PUT /api/v1/admin/settings/update with the registered email and admin flag can set the current account as admin.
• JSON POST /api/v1/admin/vpn/generate command-injects through username.
• Web app .env contains a reusable credential that works for SSH as admin.
• Local mail points to OverlayFS/FUSE; on Ubuntu 22.04 kernel 5.15.70-051570-generic, the two-process <secret redacted> PoC worked where the first single-binary PoC did not.

Do not store raw invite codes, cookies, app credentials, or flags outside loot/.

Dead Ends

Notes

Scope

Evidence Ledger