Cosm3No1de/TwoMillion-HTB-Write-up

GitHubRepository PoCWriteup

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Hack The Box writeup for the 'TwoMillion' machine. It describes a multi-step attack chain including API abuse, command injection, and privilege escalation via CVE-2023-0386. It contains no executable exploit or scanner code; it is a narrative technical analysis with example commands.

Backdoor review

No backdoor observed in reviewed code

The artifact is a Hack The Box write-up for the TwoMillion machine. It contains educational text, HTML, and CSS describing a penetration testing methodology, including API enumeration, command injection, and privilege escalation via CVE-2023-0386. No backdoor, trojan, or deceptive payload targeting the reader was observed. The included C code snippet is a non-functional, commented outline of an exploit, and the instructions reference cloning a well-known public repository. No concealed executable behavior or operator-directed harm is present.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
LanguagesMarkdownHTMLCSSBashC
Target softwareLinux KernelWeb Application (API)
Attack typesCommand InjectionPrivilege EscalationInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Hack The Box writeup. It provides a step-by-step narrative of an attack, including example curl commands and shell interactions, but does not contain functional exploit or scanner code. The included C code snippet is a non-functional placeholder. The primary purpose is technical analysis and documentation, not automated exploitation or scanning.

README.md:1-5README.md:306-329

Requirements

  • Access to the target web application API endpointsREADME.md:49-55
  • Ability to register a user account on the targetREADME.md:84-92
  • Local access to a vulnerable Linux kernel (5.15.70) for CVE-2023-0386README.md:188-194

Observed behavior

  • Describes using a PUT request to /api/v1/admin/settings/update to escalate a user to admin by setting is_admin=1README.md:96-102
  • Describes command injection via the username parameter in a POST to /api/v1/admin/vpn/generate, resulting in remote code execution as www-dataREADME.md:115-135
  • Describes lateral movement to the admin user by reading database credentials from a .env file and using SSHREADME.md:160-176
  • Describes privilege escalation to root by compiling and executing a public CVE-2023-0386 exploitREADME.md:196-210
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
CVE-2023-0386The write-up describes using a public kernel exploit for privilege escalation on a target machine. This is standard educational content for a CTF write-up.README.md:24README.md:184-194
External Repository Reference
https://github.com/veritas501/CVE-2023-0386.gitThe write-up instructs the reader to clone a public GitHub repository containing a known CVE-2023-0386 proof-of-concept. This is a reference to an external resource, not a payload within the artifact.README.md:199index.html:598
Non Executable Code Snippet
C code outline in README.md lines 309-329The artifact includes a commented, non-functional C code skeleton that describes the logic of an OverlayFS exploit. It is not a complete, compilable, or executable payload and serves only as an illustration.README.md:306-329
Review boundaries

What the analysis did not establish

  • The artifact contains a non-functional, summarized C code snippet (lines 309-329) that does not constitute a working exploit.
  • The evidence includes only the writeup text; no actual exploit binaries or scanner scripts are present.
  • The analysis is based solely on the provided text files; the non-text media file (twomillion.png) was not inspected.
  • One non-text media file (twomillion.png, 64067 bytes) was present but not analyzed per binary policy. It is used as a banner image in the HTML and is unlikely to contain executable content.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1