Dancing corresponde a la tercera caja de la serie Learn the Basics of Penetration Testing, Para este desafío evaluaremos el protocolo de comunicación SMB (Server Message Block), mismo que proporciona acceso compartido a archivos, impresoras y puertos seriales entre dispositivos finales de red, por lo general SMB se ejecuta en máquinas con sistemas operativos Windows.
Fawn corresponde a la segunda caja de la serie Learn the Basics of Penetration Testing, para la resolución de este objetivo es necesario generar una instancia de máquina a través de openVPN. Fawn explota las vulnerabilidades del Protocolo de Transferencia de Archivos (FTP). Asi que, sigamos y hackeemos la segunda caja de Hack The Box.
Meow es la primera maquina vulnerable, pertenece al punto de partida Tier 0 en las Pruebas de Penetración Nivel 1, para completar esta máquina se debe completar una serie de preguntas, no sin antes conectarnos a la red del objetivo donde podemos elegir entre una conexión Pwnbox o un Red Privada Virtual (VPN), Meow Write Up se realizará mediante el archivo de configuración VPN (.ovpn)
To solve Unbalanced, we’ll find configuration backups files in EncFS and after cracking the password and figuring out how EncFS works, we get the Squid proxy cache manager password that let us discover internal hosts. Proxying through Squid, we then land on a login page that uses Xpath to query an XML backend database. We perform Xpath injection to retrieve the password of each user, then port forward through the SSH shell to reach a Pi-Hole instance, vulnerable to a command injection vulnerability.
Buff is pretty straightforward: Use a public exploit against the Gym Management System, then get RCE. Do some port-forwarding, then use another exploit (buffer overflow against Cloudme Sync) to get Administrator access.
Intense starts with code review of a flask application where we find an SQL injection vulnerability that we exploit with a time-based technique. After retrieving the admin hash, we’ll use a hash length extension attack to append the admin username and hash that we found in the database, while keeping the signature valid, then use a path traversal vulnerability to read the snmp configuration file. With the SNMP read-write community string we can execute commands with the daemon user. To escalate to root, we’ll create an SNMP configuration file with the agentUser set to root, then wait for the SNMP daemon to restart to so we can execute commands as root.
Tabby was an easy box with simple PHP arbitrary file ready, some password cracking, password re-use and abusing LXD group permissions to instantiate a new container as privileged and get root access. I had some trouble finding the tomcat-users.xml file so installed Tomcat locally on my VM and found the proper path for the file.
To solve Fuse, we’ll do some enumeration to gather potential usernames from the print jobs information then build a password list from the strings on the website. After successfully password spraying, we’ll reset the expired password to a new one then use rpcclient to identify a printer service account and find its password in a description field. To priv esc, we’ll use the ability of our user with Printer Operators right to load a malicous kernel driver and get SYSTEM.
Dyplesher was a pretty tough box that took me more than 10 hours to get to the user flag. There’s quite a bit of enumeration required to get to the git repo and then find memcached credentials from the source code. I couldn’t use the memcache module from Metasploit here since it doesn’t support credentials so I wrote my own memcache enumeration script. We then make our way to more creds in Gogs, then craft a malicious Minecraft plugin to get RCE. To get to the first flag we’ll sniff AMQP creds from the loopback interface. To priv esc, we send messages on the RabbitMQ bug and get the server to download and execute a lua script (Cubberite plugin).
Blunder was an easy box for beginners that required bruteforcing the login for a Bludit CMS, then exploiting a known CVE through Metasploit to get remote code execution. The priv esc is a neat little CVE with sudo that allows us to execute commands as root even though the root username is supposed to be blocked.