Help

Recon

Three ports, and the odd one out is the way in:

Port 80 serves the stock Apache page, but /support redirects to the vhost help.htb (added to /etc/hosts), which runs HelpDeskZ, a PHP support-desk app. Port 3000 answers as a GraphQL API. A GraphQL endpoint sitting next to a known-buggy PHP app is the thread to pull first.

Foothold

1. Unauthenticated GraphQL → leaked credentials

The API exposes a root user query with no authentication in front of it — asking for the record hands back the stored username and password hash:

{user{username password}}

That returns helpme@helpme.com and an unsalted MD5, 5d3c93182bb20f07b994a7f617e99cff. Unsalted MD5 against rockyou.txt cracks in seconds: godhelpmeplz.

2. HelpDeskZ arbitrary file upload → webshell

HelpDeskZ 1.0.2 has a known arbitrary-upload bug (EDB-40300). Logged into the support desk with the helpme credentials and submitted a ticket (a two-step form) with a .php file attached.

The bug is an ordering flaw: the app calls move_uploaded_file() into uploads/tickets/ before it checks the extension. It then errors “File is not allowed” — but the PHP file is already written to disk. It’s stored under a predictable name, md5(originalname + time()), where time() is the server’s upload timestamp.

Two things gate and locate it:

• Captcha — the save only goes through if the ticket’s captcha is solved in the same session, so read the captcha.php image and submit it with the upload.
• Finding the file — the stored name is md5(originalname + <upload epoch>). The upload time comes from the server’s Date response header (to the second), so compute the hash across a couple of seconds around it and request each until one hits.

Requesting uploads/tickets/<hash>.php gives a webshell as uid=1000(help) (php-fpm runs as the help user).

Privilege Escalation — kernel CVE-2017-16995

uname -a reports kernel 4.4.0-116-generic on Ubuntu 16.04.5 — in range for the eBPF verifier local privilege escalation (CVE-2017-16995, EDB-44298), whose PoC is literally labelled “Tested on 4.4.0-116-generic #140.” gcc is present on the box, so no cross-compiling — build and run it in place:

$ gcc 44298.c -o e
$ ./e

Drops a shell as uid=0(root) — root.txt.