Eloquia (Insane) HackTheBox Walkthrough

Eloquia is one of those boxes that reminds you why "Insane" difficulty exists. It is not a single clever trick. It is a chain of vulnerabilities where each one depends on the previous step. Miss a link, and you are stuck for hours. This post covers what the machine is about and the concepts it teaches, without walking through every keystroke. For the complete step by step exploitation guide with every command, payload, and screenshot, grab the CyberMaster Android app or visit my Buy Me a Coffee page.

Machine Overview

Field	Detail
Name	Eloquia
OS	Windows Server 2019
Difficulty	Insane
Platform	HackTheBox
Services	IIS 10.0 (HTTP), WinRM (5985)
AD	Standalone Windows Server, no AD

What Makes Eloquia Interesting

Eloquia is a modern enterprise simulation. It runs a custom Django blogging platform at eloquia.htb with a companion OAuth 2.0 identity provider at qooqle.htb. The box chains together:

• Web application exploitation
• Client side template injection
• SQLite extension loading abuse
• Windows DPAPI cryptography
• .NET service binary hijacking

Each layer teaches a real technique you will see in actual penetration tests.

The Conceptual Kill Chain

Here is the high level picture without giving away the exploitation details.

Stage 1: Web Enumeration and Hostname Discovery

Two ports open. IIS on 80 and WinRM on 5985. That is it. No SMB, no LDAP, no Kerberos. The port 80 service redirects to a vhost, and following the OAuth flow reveals a second vhost behind the same IP.

Concept: Always follow redirects, and always inspect OAuth flows for hostnames they reference. Vhost discovery is often the difference between seeing a wall and seeing a door.

Stage 2: OAuth Misconfiguration

The OAuth provider is django-oauth-toolkit based, and the flow has multiple weaknesses. The most interesting one is that the identity binding between the two applications lives in a user editable admin field rather than a cryptographically protected token.

Concept: OAuth implementations often fail at the binding step. When the state parameter is missing, or when identity mappings are stored in editable fields, an attacker who gets any kind of admin access can swap the binding and log in as someone else.

Stage 3: AngularJS Client Side Template Injection

The blogging platform renders user controlled HTML through $sce.trustAsHtml(). On AngularJS 1.8.2, that means expressions inside the rendered content can execute Angular directives. Combined with a session cookie that lacks HttpOnly, an article that an admin bot renders can exfiltrate the admin session.

Concept: CSTI is often overlooked because people treat it as a subcategory of XSS. It is not. Angular expressions evaluate against the application scope, which gives access to application logic and data. If the bot that reviews reported content is authenticated, CSTI in a rendered page is a session hijack.

Stage 4: SQLite VACUUM INTO and load_extension

Django admin exposes a SQL Explorer tool that runs raw SQL against the backend database. Keyword blacklists block the usual suspects (INSERT, CREATE, UPDATE, DELETE, DROP), but VACUUM INTO is not a DML statement, so it slips through. That is the database dump. And load_extension() is a function, not a keyword, so keyword based filters miss it entirely.

Concept: Blacklist based filtering is a losing game. SQLite exposes a lot of surface through pragmas and functions. If you are defending, disable extension loading entirely. If you are attacking, look for the operations that are not DML and are not in the filter list.

Stage 5: Windows DPAPI Credential Extraction

The IIS worker runs as a service account, and that account has a Microsoft Edge browser profile. Edge stores credentials using AES-GCM, keyed with a master key that is itself protected by Windows DPAPI. Because DPAPI decryption is transparent when called by the owning user, extracting that account saved passwords is straightforward.

Concept: Browser credential stores are only as strong as the user context. If an attacker has code execution as a user, they get that user saved passwords for free. Endpoint protection, Credential Guard, and browser level mitigations matter here.

Stage 6: Writable Service Binary Running as SYSTEM

The privilege escalation step is a service hijack. A custom .NET service called Failure2Ban runs as NT AUTHORITY\SYSTEM and reads a log file every 30 seconds. The service restarts itself periodically to handle log rotation. During that restart window, the file lock on its executable releases, and a tight replacement loop wins the race. The next restart runs the attacker payload as SYSTEM.

Concept: Insecure file permissions on service binaries are a classic privilege escalation. The race condition element makes this one more interesting than usual, since the binary is locked while the service is running.

Defensive Recommendations

If you are running something similar in production, here is what to fix:

• Web Application Security: Never render user controlled content without sanitization. Use a modern frontend framework. Enforce a strict Content Security Policy.
• OAuth Security: Always validate the state parameter. Use cryptographically signed identity bindings instead of user editable database fields.
• Database Security: Disable load_extension() at build time. Use a database user with minimum privileges. Do not expose admin database tools to the same interface that renders user content.
• Endpoint Security: Enable Credential Guard and Virtualization Based Security. Monitor for DPAPI credential extraction.
• Service Hardening: Remove write permissions from service binaries for all non admin users. Never ship debug builds to production. Never run a service as SYSTEM if a lower privileged account will do.

Key Takeaways

1. OAuth is full of footguns. Missing state validation, permissive redirect URIs, and editable identity mappings are the usual suspects.
2. CSTI is the bigger sibling of XSS. It is underrated and often overlooked in code review.
3. SQLite is an attack surface. VACUUM INTO, load_extension, and UNC paths all bypass naive defenses.
4. DPAPI is transparent to the owning user. Any code execution in a user context exposes that user browser credentials.
5. Service binary permissions matter. A writable binary running as SYSTEM is a full compromise waiting to happen.
6. Race conditions are real. Services that restart periodically open windows that do not appear in the running process.

Want the Full Walkthrough?

This post covers the concepts and the reasoning behind each stage. The full writeup with every command, every payload, and every step of the chain is available here:

Download the CyberMaster Android app:
https://play.google.com/store/apps/details?id=np.com.kebalbhandari.cybermaster

Or visit my Buy Me a Coffee page:
https://buymeacoffee.com/kebalbhandari/

Both links give you access to the complete Eloquia walkthrough along with dozens of other HackTheBox machines, labs, and CTF solutions. The app has the entire library in one place with search, bookmarks, and offline access. The Buy Me a Coffee page has the writeups in PDF and web format.

Whether you are prepping for OSCP, grinding through HTB Season rankings, or just curious how a modern Windows box falls apart, the CyberMaster library has you covered.

Related Content

If you enjoyed this writeup, you will find more in the CyberMaster app and on the Buy Me a Coffee page:

• HackTheBox Season 11 machines with full step by step exploitation
• Advanced Active Directory attacks including RBCD, ADCS abuse, and shadow credentials
• Web exploitation deep dives on OAuth, SAML, JWT, and session handling
• Windows privilege escalation covering services, tokens, and credential stores
• Linux privilege escalation covering SUID, capabilities, kernel exploits, and misconfigurations
• CVE walkthroughs for recent vulnerabilities with practical exploitation

Final Thoughts

Eloquia is one of those machines that rewards patience. Every stage is a medium difficulty step, and no single step is impossible. But the chain is long, and losing focus at any point costs you hours. If you are working on it, take notes, document every finding, and do not skip the boring enumeration steps. The answer is almost always in something you overlooked.

Until next time, happy hacking.

CyberMaster on Google Play
https://play.google.com/store/apps/details?id=np.com.kebalbhandari.cybermaster

Buy Me a Coffee for the full writeup library
https://buymeacoffee.com/kebalbhandari/