HACK THE BOX / RETIRED
Bizness
- System
- Linux
- Difficulty
- Easy
- Completion
- Completed
- Solved on
- 9 Oct 2025
Bizness: OFBiz RCE and credential reuse
A reviewed account of my Apache OFBiz lab path, from service enumeration to privileged access.
Context
Bizness is an Easy Linux machine. The notes identify Nginx, HTTPS and an Apache OFBiz application behind the web surface.
Reconnaissance
Version and endpoint enumeration led to the pre-authentication vulnerabilities CVE-2023-49070 and CVE-2023-51467. The documented path used the vulnerable XML-RPC surface to obtain command execution and then a shell as the application user.
Initial access
Post-exploitation review found an embedded Derby database in the OFBiz installation. The notes describe locating the administrator password hash and recovering the password offline. The secret, hash and flags are intentionally omitted.
Privilege escalation
The final escalation depended on password reuse: the recovered application credential also worked for the privileged system account. The defensive lessons are to patch OFBiz, restrict XML-RPC, use unique slow-hashed credentials and prevent reuse between applications and operating-system accounts.
Key decisions
Evidence limits: this is an editorial reconstruction of my lab notes. Instance-specific IPs, credentials, flags, payloads and cleanup commands are excluded; commands were not rerun for this portfolio.