Hack the Box

Description Runner is an medium Hack The Box machine that features: Subdomain Enumeration to find a TeamCity instance TeamCity vulnerability CVE-2024-27198 that allows unauthenticated administrative account creation Export of a id_rsa SSH private key from a Linux user by exporting a TeamCity project Enumeration of Linux system to find a Portainer instance Remote Command Execution in TeamCity using a malicious plugin to get access to the database Cracking of a TeamCity password hash to obtain the access to Portainer instance Privilege Escalation via mounting a block device as a volume in a container with Portainer Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.81.22. ...

Description Usage is an easy Hack The Box machine that features: SQL Injection in a Laravel database to obtain credentials of administrator dashboard Insecure File Upload of PHP files in the administrator dashboard (bypass client filter) User pivoting using hardcoded password in a configuration file Privilege Escalation via a 7z archive application executed as root user Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.104.234. ...

Description IClean is a medium Hack The Box machine that features: Cross-Site-Scripting in a contact form (obtains administrator cookie) Python Server Side Template Injection for Command Execution Weak password from an user (reused) obtained from a database with unprotected credentials in hash format Access to privileged files using qpdf tool and its attachments feature Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.235.68. ...

Description WifineticTwo is an medium Hack The Box machine that features: Remote Command Execution in the OpenPLC 3 application Wi-Fi Password Recovery by using WPS protocol and Reaver tool Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.107.4. $ ping -c 3 10.129.107.4 PING 10.129.107.4 (10.129.107.4) 56(84) bytes of data. 64 bytes from 10.129.107.4: icmp_seq=1 ttl=63 time=47.2 ms 64 bytes from 10.129.107.4: icmp_seq=2 ttl=63 time=46.7 ms 64 bytes from 10.129.107.4: icmp_seq=3 ttl=63 time=59.1 ms --- 10.129.107.4 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 46.694/50.990/59.085/5.727 ms The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...

Description Headless is an easy Hack The Box machine that features: Cross Site Scripting (XSS) in a User-Agent field to steal cookies Command Injection in a form Privilege Escalation via a vulnerable script executed with SUDO command Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.248.249. $ ping -c 3 10.129.248.249 PING 10.129.248.249 (10.129.248.249) 56(84) bytes of data. 64 bytes from 10.129.248.249: icmp_seq=1 ttl=63 time=48.2 ms 64 bytes from 10.129.248.249: icmp_seq=2 ttl=63 time=48.7 ms 64 bytes from 10.129.248.249: icmp_seq=3 ttl=63 time=48.4 ms --- 10.129.248.249 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 48.160/48.421/48.714/0.227 ms The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...

Description Perfection is an easy Hack The Box machine that features: Ruby web application Server Side Template Injection (SSTI) Sensitive Data Exposure in a SQLite database Hash cracking using a custom mask Privilege escalation via the password previously recovered and weak permissions Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.144.202. $ ping -c 3 10.129.144.202 PING 10.129.144.202 (10.129.144.202) 56(84) bytes of data. 64 bytes from 10.129.144.202: icmp_seq=1 ttl=63 time=52.2 ms 64 bytes from 10.129.144.202: icmp_seq=2 ttl=63 time=51.6 ms 64 bytes from 10.129.144.202: icmp_seq=3 ttl=63 time=52.1 ms --- 10.129.144.202 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 51.565/51.967/52.210/0.286 ms The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...

Description Jab is a medium Hack The Box machine that features: Anonymous account creation in a Jabber server User enumeration in a Jabber server Windows user enumeration and ASREPRoast attack to obtain a hash and a password Sensitive Data Exposure in a Jabber chat Remote Command Execution using DCOM Exec Privilege Escalation via a password Blowfish hash cracking of an Openfire service Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.106.86. ...

Description Crafty is an easy Hack The Box machine that features: Minecraft 1.16.5 Log4j Remote Command Execution Vulnerability Sensitive Data Exposure in a Minecraft Plugin Privilege Escalation via a Leaked Credential Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.222.13. $ ping -c 3 10.129.222.13 PING 10.129.222.13 (10.129.222.13) 56(84) bytes of data. 64 bytes from 10.129.222.13: icmp_seq=1 ttl=127 time=42.5 ms 64 bytes from 10.129.222.13: icmp_seq=2 ttl=127 time=46.6 ms 64 bytes from 10.129.222.13: icmp_seq=3 ttl=127 time=43.0 ms --- 10.129.222.13 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 42.516/44.063/46.626/1.824 ms The machine is active and with the TTL that equals 127 (128 minus 1 jump) we can assure that it is an Windows machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...

Description Pov is a medium Hack The Box machine that features: Subdomain Enumeration Local File Inclusion in ASP.NET application Remote Command Execution using VIEWSTATE parameter in ASP.NET Sensitive Data Exposure (credentials of other user) in PowerShell format Privilege Escalation via SeDebugPrivilege privilege Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.231.64. $ ping -c 3 10.129.231.64 PING 10.129.231.64 (10.129.231.64) 56(84) bytes of data. 64 bytes from 10.129.231.64: icmp_seq=1 ttl=127 time=95.5 ms 64 bytes from 10.129.231.64: icmp_seq=2 ttl=127 time=53.0 ms 64 bytes from 10.129.231.64: icmp_seq=3 ttl=127 time=75.1 ms --- 10.129.231.64 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 52.970/74.506/95.477/17.358 ms The machine is active and with the TTL that equals 127 (128 minus 1 jump) we can assure that it is an Windows machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...

Description Bizness is an easy Hack The Box machine that features: Vulnerable Apache Ofbiz Authentication Bypass and Remote Command Execution Privilege Escalation via a customized password hash cracking with John The Ripper and Password Reuse Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.251.57. $ ping -c 3 10.129.251.57 PING 10.129.251.57 (10.129.251.57) 56(84) bytes of data. 64 bytes from 10.129.251.57: icmp_seq=1 ttl=63 time=47.1 ms 64 bytes from 10.129.251.57: icmp_seq=2 ttl=63 time=47.3 ms 64 bytes from 10.129.251.57: icmp_seq=3 ttl=63 time=46.3 ms --- 10.129.251.57 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 46.318/46.918/47.312/0.431 ms The machine is active and with the TTL that equals 63 (64 minus 1 jump) we can assure that it is an Unix machine. Now we are going to do a Nmap TCP SYN port scan to check all opened ports. ...