HTB WhiteRabbit n8n HMAC Forgery, SQL Injection, restic Abus...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2025/12/13/htb-whiterabbit.html
• Blog Title: HTB WhiteRabbit: n8n HMAC Forgery, SQL Injection, restic Abuse, and Time-Seeded Password Cracking
• Suggested Section: Pentesting Web → WebSocket Attacks (for the WebSocket auth bypass); Pentesting Web → Web Vulnerabilities Methodology / API HMAC attacks (for HMAC forgery & proxy-assisted regeneration); Web / SQL Injection and Low-Code Pipelines (new subsection for n8n-style SQLi); Linux Privilege Escalation → Backup / restic Abuses (for sudo restic --password-command privesc and backup credential mining); Crypto & Stego → Predictable PRNG / Time-Seeded Passwords (for the srand(time)-based password reconstruction).

🎯 Content Summary

This post walks through a full compromise chain of the HackTheBox machine WhiteRabbit, starting from web recon, abusing a WebSocket-based Uptime Kuma login, discovering internal services, exploiting an n8n signed webhook SQL injection, abusing restic for container root, pivoting to the host via leaked SSH keys, and finally exploiting a time-seeded password generator to become root on the host.

1. Recon and Topology
The attacker scans the targe...

🔧 Technical Details

WebSocket Auth Bypass via Tampering Server Responses
When a web app uses Socket.IO/WebSockets for login and the front-end trusts a simple server flag like {"ok": false}, an attacker can intercept server-to-client frames (e.g., in Burp) and flip false to true. With interception left enabled to stall further WebSocket traffic, the UI may render as logged-in long enough to inspect configuration/version data (e.g., Uptime Kuma Settings → About) even though the user is never truly authenticated.

Finding Internal Assets via Public Uptime Kuma Status Pages
Uptime Kuma exposes public status dashboards at /status/<slug>. Brute-forcing slugs (e.g., with Feroxbuster) against /status often reveals operational dashboards that enumerate internal services, each with explicit hostnames (e.g., GoPhish and WikiJS on internal subdomains). These domains usually sit behind auth but are network-reachabl...

🤖 Agent Actions

Summary:

• Expanded src/pentesting-web/websocket-attacks.md with a new section on tampering server-to-client Socket.IO frames to trigger client-side logins for reconnaissance, and referenced the HTB WhiteRabbit case.
• Augmented src/network-services-pentesting/pentesting-web/web-api-pentesting.md by detailing how leaked low-code workflow exports can be used to recompute webhook HMACs and by providing a mitmproxy addon plus workflow for transparently re-signing requests during automated exploitation.
• Updated src/pentesting-web/sql-injection/README.md with guidance on exploiting n8n-style templated SQL nodes, including error reflection, signing requirements, and automation tips, and added the related reference.
• Added a “restic backups & --password-command abuse” subsection to src/linux-hardening/privilege-escalation/README.md, covering credential leakage from logs, restic loot recovery, and using sudo restic as a root execution primitive, and cited the new source.
• Extended src/crypto-and-stego/crypto-ctfs-tricks.md with a section on predicting time-seeded libc rand() password generators (including a helper script) and introduced a references section citing the blog.

Tests: Not run (not requested).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2025/12/13/htb-whiterabbit.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web → WebSocket Attacks (for the WebSocket auth bypass); Pentesting Web → Web Vulnerabilities Methodology / API HMAC attacks (for HMAC forgery & proxy-assisted regeneration); Web / SQL Injection and Low-Code Pipelines (new subsection for n8n-style SQLi); Linux Privilege Escalation → Backup / restic Abuses (for sudo restic --password-command privesc and backup credential mining); Crypto & Stego → Predictable PRNG / Time-Seeded Passwords (for the srand(time)-based password reconstruction).".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0