HackTheBox - Eloquia

The video demonstrates the exploitation of the Hack the Box machine "Alriia," focusing on bypassing strict security controls like AppLocker to achieve root access. The attacker leverages a Client-Side Template Injection (CSTI) in an Angular application to orchestrate an OAuth account linking attack, gaining administrative privileges. From there, they abuse a SQLite browser to load a malicious DLL for initial Remote Code Execution (RCE), and finally decrypt stored credentials to escalate to the system user.

Key Takeaways:
• The initial foothold is achieved by exploiting Angular internals to bypass Content Security Policy (CSP) and execute JavaScript via ng-click 2:04.
• The attacker forces a bot to visit a crafted page, triggering an OAuth flow that links the attacker's account to the admin's Google account, granting admin panel access 28:06.
• Access to the Django admin panel reveals a SQLite browser, which allows uploading a malicious DLL and using load_extension to execute code on the server 52:50.
• Due to AppLocker blocking PowerShell and standard executables, the attacker uses a Python script to query the Windows DPAPI and decrypt passwords from Microsoft Edge's login database 10:30.
• Root access is gained by analyzing a ProcMon log file to identify a DLL search order vulnerability in a scheduled task, allowing the attacker to inject a malicious version.dll 19:20.

The challenge highlights the importance of securing OAuth implementations and the risks of allowing file uploads in administrative interfaces. By combining client-side vulnerabilities with server-side database abuse and Windows API manipulation, the attacker successfully navigates complex defenses to compromise the entire system.

Sources:

• 2:04 Demonstrating Angular CSTI and CSP bypass.
• 28:06 Exploiting OAuth flow to hijack admin account.
• 52:50 Using SQLite load_extension for RCE.
• 10:30 Decrypting DPAPI protected credentials via Python.
• 19:20 Analyzing ProcMon logs for DLL injection opportunities.