DutyBound HTB Writeup

I just solved DutyBound from Hack the Box!

DutyBound Machine Summary

DutyBound is a medium difficulty Linux machine on Hack The Box that focuses on standard industrial communication protocols, insecure graphical session controls, and loose validation in automated management tooling. The machine demonstrates how misconfigured internal access vectors and a lack of input sanitization in background administrative tasks can be chained together to achieve complete system compromise, highlighting the risks of exposed legacy protocols and excessive system-wide trust.

The attack chain begins with Nmap enumeration, which reveals SSH, an Nginx web server, and an SSL-protected web interface that redirects users to the airsnacks.htb virtual host. After performing host configuration, subsequent web enumeration uncovers several sensitive endpoints, specifically an automated checkout workflow containing a boarding pass verification endpoint at /checkout/boarding-pass/verify.

During BCBP parsing exploration, probing the verification endpoint with malformed payloads triggers detailed error messages leaking an internal structural dependency on the standard IATA Resolution 792 Bar Coded Boarding Pass (BCBP) layout. After conducting protocol research, a valid 792-byte formatted string mimicking a mandatory single-leg boarding pass layout is crafted to bypass the structural validation checks, resulting in a successful database insertion confirmation.

Further testing reveals a severe SQL injection (SQLi) vulnerability within the INSERT query handling the parsed BCBP parameters. By leveraging PostgreSQL error responses, database environment enumeration confirms that the active database role possesses high system privileges, specifically the pg_execute_server_program permission. This leads to a successful stacked query exploitation attempt utilizing COPY TO PROGRAM, weaponizing the injection vector to achieve initial access as the postgres user via a reverse shell.

With an initial foothold established, extensive graphical session enumeration reveals a running Xorg X11 server on display :0 alongside an Openbox window manager session owned by a separate user named dutyfree-kiosk. Active X11 access verification confirms that a global xhost + access policy is in place, meaning access control checks are completely disabled and local users can interact with the active session without authentication.

To bridge the user gap, XTEST input simulation is performed using a Python script to send a virtual Ctrl+Alt+T key sequence, which triggers the Openbox desktop environment to spawn an administrative xterm instance. Through X11 window enumeration and tracking internal window metadata, the newly generated terminal's process identifier is successfully captured. By executing input focus manipulation, keyboard focus is forced away from the primary application directly onto the hidden terminal, allowing automated keystroke delivery to run a staging script and grant a secondary reverse shell, achieving user access escalation as dutyfree-kiosk along with the user flag.

The final stage of the attack chain targets a local privilege escalation vector involving automated administrative automation. While performing internal script enumeration, a background bash script at /opt/vrs/bin/apply-duty-rates.sh is found to process external data records using an unvalidated and dangerous eval expression. Cross-referencing this with systemd service enumeration confirms that a path watcher unit dynamically triggers this script to run with elevated privileges whenever changes are made to an associated configuration file.

Leveraging group membership exploitation, the user's membership in the pos-ops group provides write permissions to the monitored /opt/vrs/data/duty-rates.csv path. By executing CSV payload injection, a malicious row containing nested shell commands is appended to the document before triggering the automatic path watcher execution. The elevated service automatically parses the file and triggers the hidden payload through the eval statement, yielding root access via a final reverse shell and allowing retrieval of the root flag to complete the machine.

Overall, DutyBound is an excellent demonstration of how industrial data structures, weak graphical access policies, unsafe input evaluation, and automated administrative triggers can be sequentially combined into a highly technical and realistic exploit sequence from low-privileged execution to absolute control.

Protected Page

asdf

a

b

c

d

e

f

g

h

i

j

k

l

m

n

o

p

q

r

s

t

u

v

w

x

y

z

asdf

Keywords

DutyBound HTB Writeup

DutyBound HTB Walkthrough

airsnacks.htb

I just solved Dutybound from Hack the Box

HackTheBox - DutyBound Season 12 Writeup

HTB: DutyBound Writeup

HTB DutyBound Season 12 Walkthrough

HTB & CTF Writeups / Walkthroughs | DutyBound

Hack The Box - HTB DutyBound Medium - Weekly - October 24th

DutyBound Hack the Box Machine Season 12 HTB Solution

HTB DutyBound - Technical Walkthrough & PoC

Owned DutyBound on Hack The Box - Season 12 OS: Linux

Hack The Box DutyBound Stats (Medium Linux)

DutyBound Writeup - HackTheBox

HackTheBox DutyBound Writeup | SQL Injection to Root

HTB DutyBound Writeup - Hack The Box Season 12

DutyBound - SQL Injection & Enumeration

Pwn3d DutyBound!! : r/hackthebox

DutyBound HTB - From a Boarding Pass to Root

HackTheBox DutyBound - Medium Linux Machine Writeup

HackTheBox | DutyBound

HTB DutyBound

DutyBound - HTB Writeup

Dutybound Walkthrough - HackTheBox

dutybound.htb

Dutybound Walkthrough: Beginner's Writeup from Hack The Box

Pwn3d DutyBound

 https://WS01/DAVID.M@dc01.trustfall.htb

TrustFall

https://dc01.trustfall.htb/certsrv/certfnsh.asp

trustfall.htb

TrustFall Walkthrough: Beginner's Writeup from Hack The Box

SqlS3rv_5S463G!

root@ticket01

WS01/DAVID.M@127.0.0.1

TrustFall - Pwned

santiago@trustfall.htb

C1pher@MoonLake!11

TrustFall_TK1 - TrustFall_TK30

dc01.trustfall.htb

it.junior

TRUSTFALL\sql_svc

TrustFall Walkthrough: Beginner's Writeup from Hack The Box

HTB Writeup - TrustFall

TrustFallHRSalvador1988!

TrustFallFINANCEAlejandro1993!

TrustFall has been Pwned

http://ticket.trustfall.htb

Hack The Box TrustFall Stats (Insane Windows)

administrator@trustfall.htb

TrustFall Writeup - HackTheBox

Scaffold HTB Writeup

TrustFallMARKETINGSantiago1995!

HTB Trustfall Complete Writeup - osTicket mPDF Arbitrary File Read

HTB Writeup - TrustFall

HackTheBox - TrustFall: Multi-Stage Exploitation From Public Attack

TrustFall HTB - Complete Writeup Key

Scaffold HTB Walkthrough

I just solved Scaffold from Hack the Box

HackTheBox - Scaffold

scaffold.htb

Pwned Scaffold from Hack the Box

HTB - Scaffold HTB Season 12 Aero Machine Writeup

Scaffold - HackTheBox Season 12 Walkthrough Machine HTB Solution

Rooted Scaffold from Hack the Box