kami@kali:~$ journalctl

Nibbles writeup

https://app.hackthebox.com/machines/Nibbles?sort_by=created_at&sort_type=desc

10.129.1.118

Scanned the machine.

Navigate to the webserver to check it out.

Nothing in robots.txt but checking source code we do see a mention of /nibbleblog.

Looks like it’s powered by Nibbleblog bottom right. Checking exploits, it looks like theres a metasploit module we can use.

Started metasploit. Found the exploit but we actually need credentials. Let’s find the actual login page. To do this I ran gobuster (Disregard the failed commands I was brainfarting the wordlist location). While the scan was running I was poking around the directories it already found. The /admin was the most interesting but I didn’t see any files that would let us move forward. Since this is ran on PHP I randomly just typed in admin.php and got lucky.

I tried a bunch of random credentials but wasn’t having too much luck. Also after some manual guessing it also looks like it blacklisted us so brute forcing isn’t an option.

I did more looking around the directories that gobuster found and it looks like we found an admin but still no password.

It doesn’t look like the blacklist goes away so I reset the machine. New IP is 10.129.1.119. Since we arn’t asked to bruteforce (or possible technically) I still guessed random passwords. It ended up being the name of the machine…

Updated my earlier metasploit exploit options.

And we’re in.

Poked around files until I found something useful. I was actually able to read passwd.

This isn’t actually much help as we know we need root. If I run sudo -l I actually get something interesting.

When I tried to cat it, it wouldn’t read but it looks like it’s executing in the cli which is weird. I can’t really replicate that without recording. I was seeing if it was actually just running whatever was after it so I tried bash and python but I think I’m just wasting my time.

My other thought it that it runs on a scheduled task. Unfortunately that does not look like the case.

I wanted to see the privilege on the files but this actually doesn’t even exist.

So now I’m thinking, what if I just create that file as a reverse shell. Created a shell and tried creating it but even directories above that didn’t exist which was weird. I wanted to confirm that so I navigates to /home/nibbler and I should’ve just went here earlier.

The file had a bunch of content. Don’t care though I’ll try overwriting it.

And we get a shell but it was just nibbler again. Reran it as sudo.

Submit User Flag –

A: 5e6b8e6225c8d7ec4b9f8df02ee4b23d

Submit Root Flag –

A: b7077f18f61da82efb73411a2d495593

GG
Legacy writeup

https://app.hackthebox.com/machines/Legacy?sort_by=created_at&sort_type=desc

10.129.227.181

Scanned the machine.

Tried SMBclient but didn’t get anything back.

Smbmap also failed interestly enough.

Enum4linux also didn’t return anything. Tried running searchsploit against versions of things but nothing interesting. The nmap results earlier mentioned conficker. Did some research and found an nmap script i can specifically run to see if I can get more information.

Turns out it’s likely vulnerability to this. This is the blog I started to refer to https://blog.razzsecurity.com/2025/04/27/windows-penetration-testing/windows-xp-penetration-testing-ms08-067-smb-exploit-1/

Let’s trying using that msfconsole exploit.

And damn…. I thought this was it but it failed.

I searched the CVE in msconsole and I actually found a module that was built specifically for this so I wanted to try this because I feel like we are on the correct path.

I’m in.

And we’re already root. Started to navigate around to look for the flags. Found a user john.

Submit User Flag –

A: e69af0e4f443de7e36876fda4ec7644f

Submit Root Flag –

A: 993442d258b0e0ec917cae9e695d5713

GG
Cap writeup

https://app.hackthebox.com/machines/Cap?sort_by=created_at&sort_type=desc

10.129.1.105

Scanned the machine.

Checked out the webserver.

It already logged me in with a Nathan account. There is also some commands being ran on the site that show network information.

The options of the dropdown on Nathan seems to not do anything.

Before I do more looking into that I want to check ftp. Searchsploit only shows a DoS.

Looks like no anonymous.

We do have a possible username nathan though. I’m going to run brute forces in the background on ssh and ftp.

While those go, I’ll also check directory bust the website to see if there’s anything fun there. Someone in HTB discord mentioned feroxbuster might be better than gobuster so I’ll try using that.

While those run I came back to the website. So the website runs commands obviously which might be interesting. I don’t think I can upload anywhere at this point to run a shell. One of the options on the webpage is “Security Snapshot (5 Second PCAP + Analysis)” and it actually looks like we can download a file.

I downloaded those PCAP files to take a look. Nothing was in that file but it actually looks like the website is vulnerable by the URL. I changed that a few times and when I got to 0 there was information in the value column, so this pcap file might have something.

It does have content.

I searched for any strings containing pass and it looks like I actually found something.

Followed that TCP stream.

This explains the automatic login. I SSH’d to the server with those creds and it actually worked.

Submit User Flag –

A: cf154a82b4e92d314d126a54ce7535b8

Submit Root Flag –

I can’t get in to root which I expected. I can’t run sudo -l, no bash history, tried finding password files. There was nothing dumb easy so I’ll get linpeas on the machine. Opened a httpserver and transferred linpeas.sh to the machine.

Sifting through the results I see pkexec may be vulnerable.

That failed so I continued to look further and I found this, and this checks out considering the room is called Cap.

I’m not exactly familiar with it, so I did some googling and found this https://medium.com/@forgecode/linux-privilege-escalation-via-cap-setuid-gaining-root-with-python-ecca7cab716e

This got us root!

Submit Root Flag –

A: 8b3c1083857c50284715c78f7d6f0542

GG
Lame writeup

https://app.hackthebox.com/machines/1?sort_by=created_at&sort_type=desc

10.129.1.103

Scanned the machine.

I saw ftp was open lets check if allows anonymous. Looks like it does but nothing is in there.

Nmap part finished.

Checked out the SMB instead.

Looks like tmp might be interesting. There’s a bunch of random files in there that I’m not getting any thoughts right away.

Started to download files to check out what they are.

The other files looked like I couldn’t download them. Will keep this stuff in the back of my head but I think this is a rabbit hole. Started searchsploiting versions and the ftp server looks interesting.

Opened up metasploit.

That didn’t work though.

SSH doesn’t look interesting. The only thing remaining that may be of user is port 3632. Not familiar with this port so I checked out hacktricks https://book.hacktricks.wiki/en/network-services-pentesting/3632-pentesting-distcc.html

Looks like I might be able to use a metasploit module.

I messed up RHOSTS, set that properly but it failed.

Nmap says its vulnerable though.

I ran searchsploit on the SMB version as I hadn’t done that and theres a lot of results.

Realized I missed a 0, reran searchsploit to narrow results as that’s a lot to sift through.

There’s a metasploit module. Let’s try that.

That worked.

I could upgrade the shell but not going to bother at this point.

Submit User Flag –

A: 8c00826f7186351b20251036e2c06c7e

Submit Root Flag –

A: 55f231e377ee99dacbcaedf46aa33891

GG
Blue writeup

https://app.hackthebox.com/machines/51?sort_by=created_at&sort_type=desc

10.129.1.101

Scanned the machine.

Also from the name of the machine and ports I can make a really good guess that this would be an EternalBlue machine.

Started up metasploit, searched ms17_010 with is eternal blue. Let’s use a checker first as best practice instead of just firing an exploit.

It’s likely vulnerable. Let’s exploit.

We’re in.

And we’re already root. Looked around for the flags and I saw a user on the device.

Submit User Flag –

A: 74fb11bbe7091ed73c98fdefa8f0cc87

Submit Root Flag –

A: bf59850502778a791dc921473c73cd87

GG
Jerry writeup

https://app.hackthebox.com/machines/144?sort_by=created_at&sort_type=desc

10.129.136.9

Scanned the machine.

Checked out the webserver.

Searchsploited the Apache version but nothing specific to that. Did a bit of googling but no exploits popping up right away. Ran gobuster, /manager has a login page.

Tried using the default credentials found on this page tomcat:s3cret and I actually got in.

I had some notes to upload a jsp shell and since we have credentials I wanted to try that. Started up msfconsole.

Unfortunately this failed. Also in previous screenshot I missed setting the shell “set shell cmd”. There may be another option while being logged into /manager as I see a WAR file but can’t recall how to take advantage of this so I did a bit of research. I mean this might be obvious but I’m not really familiar with .WAR files, but that’s what it accepts. Tomcat uses java so I created a shell that I attempted to use in my Metasploit exploit using msfvenom (with the help of revshells).

Set up a handler.

Uploaded the war file and it responded with a Message: OK

And now I can see it on the page.

That didn’t work. I’m wondering if it’s because I used tun0 when creating the shell so I tried using my IP address instead. I undeployed the original shell, rewrote the payload with the IP, uploaded it and called it then and got a shell.

And right away I’m actually root.

Navigated around the box to find the flags and they can both be found on the Administrator desktop.

Submit User Flag –

A: 7004dbcef0f854e0fb401875f26ebd00

Submit Root Flag –

A: 04a8b36e1545a455393d067e772fe90e

GG
Shocker writeup

https://app.hackthebox.com/machines/108?sort_by=created_at&sort_type=desc

I’m first going to attempt Adventure Mode for these machines going forward unless I get stuck, then will move to Guided Mode. Additionally, instead of using the pwnbox from Hackthebox I’m now going to start to use my own machine so I am more prepped for PNPT with tools on my device.

10.129.1.88

Since I’m using my own device I wanted to start using rustscan. Doesn’t look like this is on Kali rolling so I downloaded that first. Unzipped it and confirmed download.

Now onto the box.

Scanned the machine with rust scan and running nmap switches against open ports.

Port 80 and 2222 is open. Let’s check out the webserver as 2222 looks like ssh. We get a silly little webpage there.

I don’t see anything in source code or robots.txt. I downloaded the image as the image might have something useful and also started a directory busting scan with dirb.

I always just use dirb for low hanging fruit. I’m not sure if this is efficient or if I should just run an indepth directory busting scan but I think over time I’ll find patterns. I ran exiftool on the image but it’s definitely and image and nothing import looks to be here.

Dirb found nothing.

Kicked off gobuster instead but that didn’t find anything.

Ran binwalk on the image but found nothing.

Tried checking for possible subdomains but that also did not find anything.

I tried some default credentials on SSH but also was unable to find anything there. Something MUST be on the webserver. Since cgi-bin/ was the only possibly interesting directory I found earlier I tried to see if there were files and turns out there was.

Checking that file out it’s an uptime script.

I recall seeing something like this on my eJPT exam with shellshock. Started up msfconsole.

Searched for shellshock. I’m pretty confident this is what the machine wants us to do especially given the name of the box but best practice lets just use a scanner first.

Played with setting some options and it does appear it is vulnerable after sending the exploit.

Moved to the exploit and set my options there.

Ran it and it looks like we successfully got on!

Looks like our account is just shelly. I tried upgrading the shell automatically but no luck.

Lets just run shell and see what we can find with Linux local enumeration. Looking for low hanging fruit, I ran sudo -l and perl showed up. Checked GTFObins and we can get root off of it.

Then we can get our flags.

Submit User Flag –

A: 7d9e07b9c792f4bbd02217823789d38c

Submit Root Flag –

A: 7f447f9333d441f207a9cb5a671c111b

GG
Starting point finished

I completed all the starting point machines on Hack The Box. Time to start cooking on the real machines!

GG
Base writeup

https://app.hackthebox.com/machines/Base?sort_by=created_at&sort_type=desc

10.129.6.102

Task 1 – Which two TCP ports are open on the remote host?

Scanned the machine with nmap.

A: 22,80

Task 2 – What is the relative path on the webserver for the login page?

Navigated to a web browser to check out the webserver.

Login option top right.

A: /login/login.php

Task 3 – How many files are present in the ‘/login’ directory?

Went back a directory on the site.

A: 3

Task 4 – What is the file extension of a swap file?

A: .swp

Task 5 – Which PHP function is being used in the backend code to compare the user submitted username and password to the valid username and password?

Downloaded the file and read through it.

Here’s a more readable code using codebeautify.

A: strcmp()

Task 6 – In which directory are the uploaded files stored?

I checked /uploads but nothing there. I checked robots.txt and ran a simple dirb, that found assets and forms and I clicked around those but couldn’t find anything. Ran a more indepth gobuster.

While doing this I wanted to check the other files in /login but didn’t see anything in there. Poked more around the website, found some possible accounts/users.

Gobuster scan finished but nothing there either. Only other port we found earlier was SSH so I tried some default and basic credentials on the login but couldn’t find much. At this point I wasn’t sure, so I referred to the write up for this task.

So I should’ve read over the code closer and also realized it was backwards.

This line of code is vulnerable. Essentially we can add [] to convert the variables into arrays then it would compare to that. Further explanation is here https://www.youtube.com/watch?v=idC5SAsKhlE

We can use this to successfully log in.

And this is where we can see an option to upload.

I was able to successfully uploaded a test.txt but no further information again. Turns out my gobuster wordlist was bad earlier.

A: /_uploaded

Task 7 – Which user exists on the remote host with a home directory?

With this new information we can probably get a php shell on the device. Downloaded a php shell from revshells, uploaded it to the website and called it. After trying a lot of shells, only webshells worked.

Ran ls /home and I see a john. I was also able to see the user.txt on his desktop but not actually able to read it.

A: john

Task 8 – What is the password for the user present on the system?

At this point I was stuck, and had to refer to the writeup again. We can get an actual reverse shell from this point but the problem is that it’s being encoded so we can change the GET request to a POST request. We can apparently do this with Burpsuite. We can intercept a request, right click and ‘Change request method’. I tried following along and copying the new request in Burp but it was not working so I stepped back in the writeup to follow earlier steps as my webshell is different. That ended up giving me a shell.

I was getting double input and output in the string so I ran “stty raw -echo”. Next as we are www-data we need to find creds. As there is a webserver, we can look in some config files.

A: thisisagoodpassword

Task 9 – What is the full path to the command that the user john can run as user root on the remote host?

Since we know john exists on the device we can try using that password for him.

Task 9 – What is the full path to the command that the user john can run as user root on the remote host?

Ran sudo -l.

A: /usr/bin/find

Task 10 – What action can the find command use to execute commands?

Checked GTFO bins and its exec. Used the shell command.

A: exec

Submit user flag –

Got this earlier when we were in johns account in /home/john.

A: f54846c258f3b4612f78a819573d158e

Submit root flag –

A: 51709519ea18ab37dd6fc58096bea949

GG
Markup writeup

https://app.hackthebox.com/machines/Markup?sort_by=created_at&sort_type=desc

10.129.6.59

Task 1 – What version of Apache is running on the target’s port 80?

Scanned the machine with nmap.

I recall I could just be more efficient and use rustscan for this. I’ll start doing this in the future.

A: 2.4.41

Task 2 – What username:password combination logs in successfully?

Navigated to the webpage, checked robots.txt and source code but didn’t see much. Tried a few default/simple credentials and admin:password worked.

A: admin:password

Task 3 – What is the word at the top of the page that accepts user input?

Clicked around and Order has input forms.

A: Order

Task 4 – What XML version is used on the target?

Looked at the source code and on line 94 we see version.

A: 1.0

Task 5 – What does the XXE / XEE attack acronym stand for?

If you don’t know this just google it.

A: XML External Entity

Task 6 – What username can we find on the webpage’s HTML code?

Line 8

A: Daniel

Task 7 – What is the file located in the Log-Management folder on the target?

So I had once done a Tryhackme room that taught XXE but I don’t exactly recall how to use it but let’s open Burpsuite. I grabbed a request from the Order web page and forwarded it to repeater. For a while I was attempting to input “”<!DOCTYPE foo [<!ELEMENT foo ANY >\<!ENTITY xxe SYSTEM “file:///etc/passwd” >]>”” and tested in each form added “”&xxe”” into different fields but I don’t really have the understanding of the concept down, I was basically just bruteforcing a command I found in my notes. I understand enough that XML is a language, and its being used on the page so some payload should be able to possibly allow us to see files that we shouldn’t be able to see.

I referred to the writeup for this part after a while. So first, I’m just dumb- this is a Windows machine so obviously /etc/passwd doesn’t even exist on the device. I was close with the command otherwise but I also had an additional part of the command. This is what we actually need.

Since daniel is a possible use on the machine we can look around his directory. We can find a ssh key.

I was having some issues, then realized that I also copied the ‘Your order for’ in the key. Make sure you remove that part. Then we get access to daniel.

Navigating to Log-Management we see a file.

A: job.bat

Task 8 – What executable is mentioned in the file mentioned before?

A: wevtutil.exe

Submit user flag:

Got this earlier when I first had access to daniel’s account.

A: 032d2fc8952a8c24e39c8f0ee9918ef7

Submit root flag –

We can see that we have access to the file as daniel is a part of Users.

We can likely get a shell off of this. Downloaded netcat for windows on the victim machine, over wrote the file then set up a listener.

And then we get a response and get admin.

Then we navigate to the Administrator desktop and root.txt is there.

A: f574a3e7650cebd8c39784299cb570f8

GG

kami@kali:~$ journalctl

Categories