https://app.hackthebox.com/machines/Base?sort_by=created_at&sort_type=desc

10.129.6.102

Task 1 – Which two TCP ports are open on the remote host?

Scanned the machine with nmap. 

A: 22,80

Task 2 – What is the relative path on the webserver for the login page?

Navigated to a web browser to check out the webserver.

Login option top right.

A: /login/login.php

Task 3 – How many files are present in the ‘/login’ directory?

Went back a directory on the site.

A: 3

Task 4 – What is the file extension of a swap file?

A: .swp

Task 5 – Which PHP function is being used in the backend code to compare the user submitted username and password to the valid username and password?

Downloaded the file and read through it.

Here’s a more readable code using codebeautify.

A: strcmp()

Task 6 – In which directory are the uploaded files stored?

I checked /uploads but nothing there. I checked robots.txt and ran a simple dirb, that found assets and forms and I clicked around those but couldn’t find anything. Ran a more indepth gobuster.

While doing this I wanted to check the other files in /login but didn’t see anything in there. Poked more around the website, found some possible accounts/users.

Gobuster scan finished but nothing there either. Only other port we found earlier was SSH so I tried some default and basic credentials on the login but couldn’t find much. At this point I wasn’t sure, so I referred to the write up for this task.

So I should’ve read over the code closer and also realized it was backwards.

This line of code is vulnerable. Essentially we can add [] to convert the variables into arrays then it would compare to that. Further explanation is here https://www.youtube.com/watch?v=idC5SAsKhlE

We can use this to successfully log in.

And this is where we can see an option to upload.

I was able to successfully uploaded a test.txt but no further information again. Turns out my gobuster wordlist was bad earlier.

A: /_uploaded

Task 7 – Which user exists on the remote host with a home directory?

With this new information we can probably get a php shell on the device. Downloaded a php shell from revshells, uploaded it to the website and called it. After trying a lot of shells, only webshells worked.

Ran ls /home and I see a john. I was also able to see the user.txt on his desktop but not actually able to read it.

A: john

Task 8 – What is the password for the user present on the system?

At this point I was stuck, and had to refer to the writeup again. We can get an actual reverse shell from this point but the problem is that it’s being encoded so we can change the GET request to a POST request. We can apparently do this with Burpsuite. We can intercept a request, right click and ‘Change request method’. I tried following along and copying the new request in Burp but it was not working so I stepped back in the writeup to follow earlier steps as my webshell is different. That ended up giving me a shell.

I was getting double input and output in the string so I ran “stty raw -echo”. Next as we are www-data we need to find creds. As there is a webserver, we can look in some config files.

A: thisisagoodpassword

Task 9 – What is the full path to the command that the user john can run as user root on the remote host?

Since we know john exists on the device we can try using that password for him.

Task 9 – What is the full path to the command that the user john can run as user root on the remote host?

Ran sudo -l.

A: /usr/bin/find

Task 10 – What action can the find command use to execute commands?

Checked GTFO bins and its exec. Used the shell command.

A: exec

Submit user flag –

Got this earlier when we were in johns account in /home/john.

A: f54846c258f3b4612f78a819573d158e

Submit root flag – 

A: 51709519ea18ab37dd6fc58096bea949

GG

https://app.hackthebox.com/machines/Oopsie?sort_by=created_at&sort_type=desc

10.129.3.226

Task 1 – With what kind of tool can intercept web traffic?

We need to intercept the traffic with a proxy.

A: proxy

Task 2 – What is the path to the directory on the webserver that returns a login page?

Scanned the machine.

We see SSH and a webserver. Let’s check out the webserver.

I clicked around and checked robots.txt. At the bottom of the page there is a contact section with admin@megacorp.com. That may be of help later. Checking source code I don’t see much so let’s directory bust. I’ll use a basic scan with dirb first to see if it picks anything simple up.

Scan provided this.

I tested each directory but none seem to return anything useful. There were all denied permissions. This time I’ll try gobuster with a more extensive wordlist.

At the same time I was looking through the source code again and realized I missed something important.

A: /cdn-cgi/login

Task 3 – What can be modified in Firefox to get access to the upload page?

We were given a possible username, but there is a Login as Guest option we can check out first as bruteforcing isn’t typically convenient.

We have an Uploads page inside here but we don’t yet have access..

It also shows our information, so we can maybe use cookies here.

A: cookie

Task 4 – What is the access ID of the admin user?

In the URL I noticed that there is a possible IDOR vulnerability. I changed id to 1 and we see the admin.

A: 34322

Task 5 – On uploading a file, what directory does that file appear in on the server?

Changing our cookie with that id, we get access to upload.

We can assume this as with our earlier directory busting, we saw /uploads.

A: uploads

Task 6 – What is the file that contains the password that is shared with the robert user?

The webserver uses PHP, so lets create a PHP shell to see what we can get. I got a PHP revshell from revshells.com. Originally it didn’t work but I think what happened is I also needed to add a Brand name.

We get a response on netcat.

The shell is ugly so using my notes we can upgrade it.

When I started typing it was showing in the terminal twice so I finished the rest of my command. These screenshot looks confusing but the code is.

“”export TERM=xterm

   stty raw -echo; fg

   stty rows 24 columns 80””

I decided to cd around in the user that the Task was referring to. I found the user.txt flag which we will need later. f2c74ee8db7983851ab2a96a44eb7981

I couldn’t find anything else so lets just get linPEAS on the target. I tried using curl and running it on the machine but that was dumb as this target machine likely doesn’t have internet. Downloading to the attacker machine.

Then served up a httpserver but then had trouble downloading it to the machine. Looks like www-data does not have that permission. Going back to manual enumeration, maybe the webserver has credentials stored. In /var/www/html/cdn-cgi/login/db.php I found other possible users.

Looking at the starred out answer, I tried db.php but I’m a bit confused as I’m only seeing users but I also checked other files in there and found a password in index.php

After a lot of confusion, I realized M3g4C0rpUs3r! is actually the password to robert.

A: db.php

Task 7 – What executible is run with the option “-group bugtracker” to identify all files owned by the bugtracker group?

Oopsie, they spelled executable wrong in the question. Anyways, I had to google this and it’s find.

A: find

Task 8 – Regardless of which user starts running the bugtracker executable, what’s user privileges will use to run?

So, ‘sudo -l’ is not accessible to robert, but robert is in a group bugtracker.

In /usr/bin there is bugtracker and it has a suid bit.

A: root

Task 9 – What SUID stands for?

I have notes on this and understand it conceptually but didn’t know what it stood for so I googled this too. I kept getting Set User ID but that didn’t work. Ended up finding the answer here https://linuxopsys.com/suid-bit-in-linux

A: Set owner User ID

Task 10 – What is the name of the executable being called in an insecure manner?

When we run the command, it looks like it’s just reading files with cat.

A: cat

Submit user flag:

We found that earlier during Task 6.

A: f2c74ee8db7983851ab2a96a44eb7981

Submit root flag:

At this point I wasn’t sure of how we would take complete control of the machine with this vulnerability so I referred to the write up.

Since bugtracker is calling cat, but not specifying where is it coming from it seems like we can take advantage of that. 

If we create a new file in /tmp named cat with the content /bin/sh and give it executive privileges.

You can ignored the failed chmod command. Then we can make it so bugtracker actually calls this cat instead of the normal cat using environment variables.

Now if we run it we have root.

A: af13b0bee69f8a877c3faf667f7beacf

GG

https://app.hackthebox.com/machines/Tactics?sort_by=created_at&sort_type=desc

10.129.1.116

Task 1 – Which Nmap switch can we use to enumerate machines when our ping ICMP packets are blocked by the Windows firewall?

Previous knowledge. Nmap also will remind you of this if your scans come back with no results.

A: -Pn

Task 2 – What does the 3-letter acronym SMB stand for?

This service is a goldmine for CTFs from as much as I have seen so far.

A: Server Message Block

Task 3 – What port does SMB use to operate at?

A: 445

Task 4 – What command line argument do you give to smbclient to list available shares?

I remember this as list. -L

A: -L

Task 5 – What character at the end of a share name indicates it’s an administrative share?

Common Windows knowledge.

A: $

Task 6 – Which Administrative share is accessible on the box that allows users to view the whole file system?

Let’s get to hacking the box. Our nmap provide that 445 is on the machine.

Now let’s list the SMB shares. As this is a Windows device and we have no previous credentials, lets see if we can list anything with Administrator, and we can.

A: C$

Task 7 – What command can we use to download the files we find on the SMB Share?

Once you connect to a share you can download files using “get”.

A: get

Task 8 – Which tool that is part of the Impacket collection can be used to get an interactive shell on the system?

Had previous notes on this but have yet to use it often. 

A: psexec.py

Submit Flag:

Using my note’s formatting we can get a shell with this tool.

Poked around the system, ended up in Desktop and found the flag.

A: f751c19eda8f61ce81827e6930a1f40c

GG