Hack The Box: ScriptKiddie(Linux)

Lets start our hacking with nmap scan as usual.

nmap scan

We can see that port 22 and 5000 are open and on 5000 we have a webpage.

Lets take a look at the webpage.

There are three parts of the webpage. First one is a normal nmap scan. It shows nothing new for us to explore.

nmap section of the webpage

Next is the payload section, which can create payloads. It has something interesting. One is venom and other is the part where we can upload a file.

payloads section of the webpage

The last section is sploits where any input containing probably alphanumeric characters isn’t allowed. And we get only one message if we try any sort of injection attack. But it is used to search for common vulnerabilities.

sploits section of the webpage

We can try searching for venom here ,given nothing else was useful, directory busting leads to nothing.

venom search

Here we get to know its a metasploit framework and after searching we can find a POC for this which makes an apk file, that we can upload in the payloads section to get a reverse shell. But this POC needs a payload which we can change to bash reverse shell one liner.

running the python POC

After running the POC we got the apk file saved which we can upload in the payloads section of the website. But before hitting the generate button make sure we have netcat listener on.

We got the shell as user kid . Its easy to get the user flag here.

netcat listener

There is also pwn user and there is a shell script which is performing nmap scan against the hackers file.

searching for potential privilege escalation route

We have write permissions for this file. So we can change the contents of this file.

We inject a bash one liner to get a reverse shell on port 445.

injecting bash one liner

Before entering the above command we need to make sure we have netcat listener on port 445.We get a shell as pwn user. And we try to examine sudo rights and find one command with sudo rights.

netcat listener

We run the command with sudo and it works.Now we need to find the root flag.

So we first use /bin/bash to be able to get a shell and then we can easily get the root flag.

Got the root flag

We got the root flag and there was one more way of doing this which is using the ssh keys, we can find that we just have authorized_key in the .ssh folder for kid user and we could use ssh-keygen on our local machine to generate a public key and save it in the authorized_key folder and then use ssh to login.But weused that method before so learning a new method was better.

Happy Hacking!!!!