Hack the Box

Description Overwatch is a medium Hack The Box machine that features: SMB Enumeration allows accessing to a public share containing a C# desktop application C# application reverse engineering to find credentials and an exposed service Linked SQL server exploitation by adding a DNS entry pointing to the attacker machine to obtain the MSSQL credentials via the responder application Reused credentials allow access to the machine via WinRM protocol Port Forwarding of the internal port exposed by the C# application Privilege Escalation via Command Injection to the SOAP API exposed by the C# application Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.15.185. ...

Description AirTouch is a medium Hack The Box machine that features: SNMP Enumerating to discover a default password used by an SSH user Access to a machine connected to an internal network with Wi-Fi interfaces WPA2 Pre-Shared Key recovery for connecting to a wireless network Wi-Fi sniffing to recover the cookie of an user of the router web interface Cookie manipulation allows the pivoting from user permission to administration one Web application vulnerable to Insecure File Upload leads to Remote Command Execution in WPA2-PSK router machine Privilege Escalation in the WPA2-PSK machine by reused credentials leads to the discovery of WPA-EAP (Enterprise) certificates, private keys, and a credential of the WPA-EAP router machine Spoofing of the WPA-EAP access point with the discovered certificate leads to the discovery of the credentials of the user that connected to the network, allowing the connection Access to the WPA-EAP by using the previous discovered credentials Privilege Escalation in the WPA-EAP machine by using a found credentials in Hostapd configuration Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.9.3. ...

Description Eighteen is an easy Hack The Box machine that features: Active Directory assumed breach scenario and service enumeration Microsoft SQL server user impersonation to read the web service database Password recovery via cracking a hash found in the MSSQL database User pivoting by password reuse and user enumerating by RID cycling attack Privilege Escalation via the group that the user belongs ability to write in a OU, exploiting dMSA, by using BadSuccessor attack Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.71.55. ...

Description Browsed is a medium Hack The Box machine that features: Upload of malicious Chrome extension to discover internal web pages Use of the Chrome extension to gain access to a local web application with Server Side Request Forgery SSRF of the internal application leads to Command Injection and Remote Command Execution Privilege Escalation by a writable Python cache directory and a Python program executable as root user Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.4.136. ...

Description Conversor is an easy Hack The Box machine that features: XSLT Injection in Python Flask web application leading to machine file writing File Writing in scripts directory leads to Remote Command Execution User Pivoting by recovering the password of the user from a SQLite database Privilege Escalation via needrestart Arbitrary Code Execution Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.21.73. ...

Description Gavel is a medium Hack The Box machine that features: Webpage enumeration to find a Git repository with the source code of the web application Brute force of a login form with a found username to access to the administrator dashboard Remote Command Execution in web application allowing the entering of PHP code entered by the user User Pivoting by password reuse Privilege Escalation via bypassing PHP disallowed functions and the web application vulnerability with commands executed as root user. Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.19.185. ...

Description Bedside is a medium Hack The Box machine that features: Authentication Bypass in pac4j-jwt library by forging an administrator token Password in clear-text found in dashboard leads to password reuse in SSH service Privilege Escalation via an SSH CA configuration allowing to trust any certificate signed by the CA ignoring the username field Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.244.220. ...

Description Expressway is an easy Hack The Box machine that features: IKE IPSec server enumeration and PSK recovery Password Reuse for Linux user Privilege Escalation via a vulnerable SUDO application Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.62.220. $ ping -c 3 10.129.62.220 PING 10.129.62.220 (10.129.62.220) 56(84) bytes of data. 64 bytes from 10.129.62.220: icmp_seq=1 ttl=63 time=48.0 ms 64 bytes from 10.129.62.220: icmp_seq=2 ttl=63 time=48.7 ms 64 bytes from 10.129.62.220: icmp_seq=3 ttl=63 time=47.5 ms --- 10.129.62.220 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 47.508/48.072/48.719/0.497 ms The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...

Description Giveback is a medium Hack The Box machine that features: WordPress plugin blog vulnerable to PHP Object Injection leading to Remote Command Execution in a Kubernetes container Kubernetes Network Enumeration to find another containers Container Pivoting via PHP-CGI Remote Command Execution vulnerability Use of a Kubernetes service account to read secrets containing passwords Password reuse for Linux user allows creating a shell in the host Linux machine Custom Executable password recovery via enumeration Privilege Escalation via a runc command protected with a password found previously Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.188.129. ...

Description Soulmate is an easy Hack The Box machine that features: Subdomain discovery to find a CrushFTP instance CrushFTP Authentication Bypass CrushFTP allows file upload in web server which leads in Remote Command Execution Erlang configuration script leads to user pivoting due to leaked credentials Privilege Escalation via a Erlang (EPMD) daemon running as root user Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.94.109. ...