Hack The Box Walkthroughs

Lets start our hacking with nmap scan as usual. nmap scan We can see that port 22 and 5000 are open and on 5000 we have a webpage. Lets take a look at the webpage. There are three parts of the webpage. First one is a normal nmap scan. It shows nothing new for us to explore. nmap section of the webpage Next is the payload section, which can create payloads. It has something interesting. One is venom and other is the part where we can upload a file. payloads section of the webpage The last section is sploits where any input containing probably alphanumeric characters isn’t allowed. And we get only one message if we try any sort of injection attack. But it is used to search for common vulnerabilities. sploits section of the webpage We can try searching for venom here ,given nothing else was useful, directory busting leads to nothing. venom search Here we get to know its a metasploit framework and after searching we can find a  POC  for this which makes an apk file, that we can up...

  The nmap scan had some obvious findings. nmap scan Since the nmap scan is pointing out CVE-2004–2687, we can do some research on it. The  CVE-2004–2687  has an exploit and POC is given with it ,which we can easily use to get a shell as Daemon. First we need to download the exploit. After that we need to follow the format given in the comments to run the exploit. There was one issue running this exploit ,that the comments somehow were creating problem and they were to be removed before running the exploit but that varies from system to system. We also need to make sure on our attacking machine we have a listener. running the exploit We run the exploit in one terminal window and open a listener on the other one to get a shell. netcat listener Since username is Daemon we need to work on privilege escalation. We can read the user.txt file in this session only and get the first flag but the root.txt file will not show the output. ssh key We try to find a way for privilege es...

  Lets start with an nmap scan nmap scan Although there are multiple vulnerabilities in ssh but then if port 80 is given that should be the first thing we explore. We need to add horizontall.htb in our /etc/hosts file with the ip address of the website ,so that it works. After that we just need to type the ip address in our browser. horizontall.htb This web page has nothing, even the buttons are of no use. So the next thing should be directory busting but that leads us nowhere. We need to rather find the subdomains. wfuzz for subdomain hunting We found one subdomain and going there shows us nothing but a text . Welcome page We only know its an API , so we do directory busting on this. dirb for directory busting Now here we found a couple of pages but one of the page stands out which is a login page. login page We can try the default username and password for strapi which are admin:admin but they don’t work. Even for forgot password we need email and we don’t have any information re...