Post cover image

October 15, 2026

Hack The Box: Busqueda

By yeahacked

3 min read

Hack The Box: Busqueda · Joshua Eom

Machine: Busqueda on Hack The Box · Linux · Easy

Machine Description

Busqueda is an Easy Difficulty Linux machine that involves exploiting a command injection vulnerability present in a Python module. By leveraging this vulnerability, we gain user-level access to the machine. To escalate privileges to root, we discover credentials within a Git config file, allowing us to log into a local Gitea service. Additionally, we uncover that a system checkup script can be executed with root privileges by a specific user. By utilizing this script, we enumerate Docker containers that reveal credentials for the administrator user's Gitea account. Further analysis of the system checkup script's source code in a Git repository reveals a means to exploit a relative path reference, granting us Remote Code Execution (RCE) with root privileges.

Reconnaissance

PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIzAFurw3qLK4OEzrjFarOhWslRrQ3K/MDVL2opfXQLI+zYXSwqofxsf8v2MEZuIGj6540YrzldnPf8CTFSW2rk= | 256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTtbUicaITwpKjAQWp8Dkq1glFodwroxhLwJo6hRBUK 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.52 |_http-title: Searcher | http-methods: |_ Supported Methods: GET HEAD OPTIONS | http-server-header: | Apache/2.4.52 (Ubuntu) |_ Werkzeug/2.1.2 Python/3.10.6 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumerating HTTP

Looking into the server headers, we know that it's running Apache/2.4.52, Werkzeug/2.1.2, and Python/3.10.6. Going into the website after adding searcher.htb as the domain in /etc/hosts, we also see Searchor 2.4.0 which has a huge code injection vulnerability for the search feature provided.

None

User Flag

Searchor is a program that generates a query URL for a dropdown of search engines.

"Werkzeug, often referred to as the "Swiss Army knife" of Python web development, provides a robust set of tools and utilities for building WSGI-compliant applications" — Stackoverflow

Good tip is to look at a Github repository's changelog to see potential exploits they've fixed

Searchor Releases: https://github.com/ArjunSharda/Searchor/releases

None None

The reason this query function was vulnerable is due to the use of a vulnerable python function eval()

More information on how eval() is a dangerous function: https://medium.com/swlh/hacking-python-applications-5d4cd541b3f1

You can use these exploits:

I used Burpsuite to manipulate the query to create a reverse shell:

After you get the reverse shell, you can extract the user flag

Root Flag

After enumerating through the reverse shell, I found a git config file that contains user information for cody

Running sudo -l as a typical enumeration to see if I can sudo into a root shell. I would need to use the credentials found in the config file to see the results

Running the sudo script, we get these options

$ sudo python3 /opt/scripts/system-checkup.py testing Usage: /opt/scripts/system-checkup.py <action> (arg1) (arg2) docker-ps : List running docker containers docker-inspect : Inpect a certain docker container full-checkup : Run a full system checkup

Running docker-ps we now know there's 2 docker instances

Then we run docker-inspect to inspect data within the docker instances. In this case we can look through gitea

With this we can login and extract the admin credentials for another gitea account. In this account we see the source code for the scripts provided. Previously there was an option full-checkup which returned an error and now we know why:

It was looking for full-checkup.sh shell script in the current directory to run. So all we have to do is to copy /bin/bash and give it full permissions so I can run a root shell. Save this as full-checkup.sh in a directory you can write to, and make it executable with chmod +x full-checkup.sh:

Then run the checkup from that same directory:

$ sudo python3 /opt/scripts/system-checkup.py full-checkup [+] Done! $ /tmp/shell -p shell-5.1

And from there you have root!

Lessons Learned

  • Always look through the source code of the changes made to fix these real life vulnerabilities to learn what to look for. In this case it's an easy eval() exploit
  • sudo -l is an easy way to get into root shell
  • jq is a nice tool for cleaning up json data
  • Docker SQL servers have local IPs you need to find. In this case, you had to make a custom built docker query, but most of the time you can see using docker inspect