HackTheBox - Previse

Previse is a fun Linux box on HackTheBox that has insecure redirect implementation which leaks information on the page. This can then be used to create a new user in the application and get access to backup.zip of it. Backup revels that there is a command injection vulnerability present in the logs fetching feature, which gets us a basic shell. We have a MySQL server running inside the box which has reused credenrials from the backup.zip. We get hashed/salted credentials inside this database and crack it by writing a custom PHP script. We again have a username and password reuse for a SSH user, which gives us a user shell. Listing sudo privilegs we get to know there is a script which we can run as root, that does not mention absolute $PATH for a command being used. Thus can be overriden by $PATH variable set by current USER.

January 8, 2022 · 9 min · 1873 words · Aditya Telange

HackTheBox - BountyHunter

BountyHunter is a fun Linux box on HackTheBox that has XXE injection on a PHP form, which exposes DB credentials. This DB credential is reused as a password for a user on the box. The box also has an internal python3 script which could be run as elevated privileges. This script uses eval by which we get command injection, which leads to superuser access to this box.

November 20, 2021 · 7 min · 1350 words · Aditya Telange

HackTheBox - Explore

Explore is a fun Android box that has an Open Port Vulnerability because of a popular file manager application. This box also has ADB over TCP/IP open over port 5555 which leads to obtaining root privileges.

October 30, 2021 · 4 min · 697 words · Aditya Telange

HackTheBox - Cap

Cap is a fun box where we find a flask web app which lets us download network log, where we find FTP and SSH credentials for user nathan. The box has python which has capability to set UIDs, which lets us access roots shell, when UID is set to 0.

October 2, 2021 · 3 min · 604 words · Aditya Telange

HackTheBox - Knife

Knife is a fun box which uses a PHP version having backdoor, which leads to RCE. The box has a command named knife which lets non-superusers run commanad as root.

August 28, 2021 · 2 min · 407 words · Aditya Telange