HTB Linux on Aditya Telange

HackTheBox (HTB) - Photobomb

Sat, 11 Feb 2023 21:40:09 +0530

Photobomb is a fun box on Hackthebox where we initially get hardcoded credentials in a Javascript file, which we can use to authenticate with basic auth to access the image resizing tool, which has command injection leading to us getting a reverse shell. After getting initial access as user wizard, we see a cleanup.sh script which can be run as root. We then abuse the redirection operator > clobbering the /etc/passwd file to escalate our privileges by adding user wizard to group root.

HackTheBox (HTB) - Lame

Fri, 03 Jun 2022 19:27:57 +0530

Lame is the 1st box on HackTheBox which requires only one exploit in Samba to obtain root access. We also explore other ways during we reach to superuser’s shell.

HackTheBox (HTB) - Horizontall

Sat, 05 Feb 2022 22:27:57 +0530

Horizontall is a fun box which has an API, vulnerable to Improper Access Control and RCE. The box is running a laravel service which is vulnerable to RCE which lets us run commanad as root.

HackTheBox (HTB) - Forge

Sat, 22 Jan 2022 21:27:29 +0530

Box Info

Name: Forge
OS: Linux
Difficulty: Medium
IP: 10.10.11.111
Points: 30
Machine Creator: NoobHacker9999

Introduction

Forge is a fun box on Hackthebox that has a File Upload functionality which is vulnerable to SSRF. This exposes the internal Admin panel and lets us read files with internal FTP service, which includes SSH key pair of the user.

Listing the available commands we can run as a superuser, we have a python script which opens a socket connection. This calls PDB with an exception occurs, with which we get a shell as root.

HackTheBox (HTB) - Previse

Sat, 08 Jan 2022 20:35:33 +0530

Previse is a fun Linux box on HackTheBox that has insecure redirect implementation which leaks information on the page. This can then be used to create a new user in the application and get access to backup.zip of it. Backup revels that there is a command injection vulnerability present in the logs fetching feature, which gets us a basic shell. We have a MySQL server running inside the box which has reused credenrials from the backup.zip. We get hashed/salted credentials inside this database and crack it by writing a custom PHP script. We again have a username and password reuse for a SSH user, which gives us a user shell. Listing sudo privilegs we get to know there is a script which we can run as root, that does not mention absolute $PATH for a command being used. Thus can be overriden by $PATH variable set by current USER.

HackTheBox (HTB) - BountyHunter

Sat, 20 Nov 2021 20:55:26 +0530

BountyHunter is a fun Linux box on HackTheBox that has XXE injection on a PHP form, which exposes DB credentials. This DB credential is reused as a password for a user on the box. The box also has an internal python3 script which could be run as elevated privileges. This script uses eval by which we get command injection, which leads to superuser access to this box.

HackTheBox (HTB) - Cap

Sat, 02 Oct 2021 00:00:00 +0530

Cap is a fun box where we find a flask web app which lets us download network log, where we find FTP and SSH credentials for user nathan. The box has python which has capability to set UIDs, which lets us access roots shell, when UID is set to 0.

HackTheBox (HTB) - Pit

Sat, 25 Sep 2021 00:00:00 +0530

Pit is a fun box where SNMP Data reveals that seeddms instance is running, which is vulnerable to RCE. The box has CentOS’s Cockpit Web Console on port 9090, which uses reused password from DB credentials. This gives access to user shell. LinPeas reveals there is a monitoring service, which runs bash scripts in a particular directory. Chaining this with SNMPwalk gives us root.

HackTheBox (HTB) - Knife

Sat, 28 Aug 2021 00:00:00 +0530

Knife is a fun box which uses a PHP version having backdoor, which leads to RCE. The box has a command named knife which lets non-superusers run commanad as root.

HackTheBox (HTB) - Tenet

Sat, 12 Jun 2021 00:00:00 +0530

Tenet is a fun box where we find a backup of a staging PHP file which loads external code via deserialization, which leads to code-execution and a reverse shell. This leads to access to a script which the non-sudoer user can run to add ssh-key for getting root shell.

HackTheBox (HTB) - Ready

Sat, 15 May 2021 00:00:00 +0530

Ready is a fun box which is using an outdated GitLab community version. Which apparently has an exploit which gives RCE to authenticated users. This RCE gives access to docker container in which gitlab instance is running, and we have to breakout the container to escalate our privilages to get own root!