Hack the Box

Description Silentium is an easy Hack The Box machine that features: Subdomain Enumeration to discover Flowise web application Flowise Unauthenticated Password Reset and Account Takeover Flowise Authenticated Remote Command Execution leads to a Docker container Reused Linux credentials from a Docker container environment variables Privilege Escalation via Command Execution in Gogs with a Git hook Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.32.14. ...

Description Helix is a medium Hack The Box machine that features: Subdomain Enumeration to find an Apache NiFi web application Remote Command Execution in NiFi via a H2 driver User Pivoting via a backup SSH private key Privilege Escalation via an OPC UA server variable writing to enter into maintenance mode and spawn a root shell Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.48.7. ...

Description Kobold is an easy Hack The Box machine that features: Subdomain Enumeration to find a MCPJam Inspector instance MCPJam Inspector Remote Command Execution to get a Linux Shell Privilege Escalation by pivoting to docker group using a SUID newgrp command and the ability to mount /root folder Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.15.112. ...

Description Logging is a medium Hack The Box machine that features: Active Directory initial reconnaissance via an assumed breach scenario SMB Enumeration leads to the discovery of credentials in a log saved in a shared folder User Pivoting via the GenericWrite permissions and the Shadow Credentials attack, allowing to have remote permission to the machine User Pivoting by using DLL Hijacking technique over a service executed by another user Privilege Escalation with a rogue WSUS server and malicious updates, with the injection of DNS values and the generation of a TLS certificate trusted by the domain Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.40.79. ...

Description CCTV is an easy Hack The Box machine that features: ZoneMinder CCTV Blind SQL Injection allows the recovery of an user credential Password Reuse from ZoneMinder credential to Linux User Privilege Escalation via motionEye Command Injection vulnerability Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.2.141. $ ping -c 3 10.129.2.141 PING 10.129.2.141 (10.129.2.141) 56(84) bytes of data. 64 bytes from 10.129.2.141: icmp_seq=1 ttl=63 time=48.1 ms 64 bytes from 10.129.2.141: icmp_seq=2 ttl=63 time=48.7 ms 64 bytes from 10.129.2.141: icmp_seq=3 ttl=63 time=47.2 ms --- 10.129.2.141 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 47.161/47.973/48.657/0.617 ms The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...

Description DevArea is a medium Hack The Box machine that features: Unauthenticated FTP server allows the download of a .jar file allowing reverse engineering and the enumeration of a HTTP SOAP Apache CXF Server Apache CXF Server Side Request Forgery allowing to read machine files, including Hoverfly service file with credentials Hoverfly Authenticated Remote Command Execution allow access to the remote machine Privilege Escalation via a script allowed to run as root user that runs a replaceable shell binary Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.22.170. ...

Description WingData is an easy Hack The Box machine that features: Wing FTP Server Unauthenticated Remote Command Execution vulnerability Linux user Pivoting via cracking of a salted hash of Wing FTP Server Privilege Escalation via Python Tarfile Realpath Overflow Vulnerability allowing Arbitrary File Write Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.4.106. ...

Description Fireflow is a medium Hack The Box machine that features: LangFlow web application Remote Command Execution User Pivoting by using credentials found in LangFlow environment file Command Execution in a MCP Kubernetes container using a vulnerable web application (to JWT algorithm mismatch and tool creation) Privilege Escalation via a misconfigured Kubernetes cluster with nodes/proxy permission allowing to read all files from privileged containers Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.85.165. ...

Description Nexus is an easy Hack The Box machine that features: Git repository enumeration to find credentials in Git history Krayin web application Remote Command Execution User Pivoting by using reused Krayin credentials Privilege Escalation via an unsanitized os.path.join function in a Gitea Python script Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.85.169. ...

Description Orion is an easy Hack The Box machine that features: Craft CMS Remote Command Execution User Pivoting by using a reused credential cracked from Craft CMS database Privilege Escalation via an Authentication Bypass vulnerability in Telnet Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.244.146. $ ping -c 3 10.129.244.146 PING 10.129.244.146 (10.129.244.146) 56(84) bytes of data. 64 bytes from 10.129.244.146: icmp_seq=1 ttl=63 time=82.9 ms 64 bytes from 10.129.244.146: icmp_seq=2 ttl=63 time=47.1 ms 64 bytes from 10.129.244.146: icmp_seq=3 ttl=63 time=47.5 ms --- 10.129.244.146 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 47.103/59.173/82.884/16.766 ms The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...