Remote - HackTheBox
Remote is an easy difficulty Windows machine that features an Umbraco CMS installation. Credentials are found in a world-readable NFS share. Using these, an authenticated Umbraco CMS exploit is leveraged to gain a foothold. A vulnerable TeamViewer version is identified, from which we can gain a password. This password has been reused with the local administrator account. Using psexec with these credentials returns a SYSTEM shell.
EnumerationFirst I check for available open ports.
nmap -p- --mi ...
Access - HackTheBox
Access is an easy difficulty machine, that highlights how machines associated with the physical security of an environment may not themselves be secure. Also highlighted is how accessible FTP/file shares can often lead to getting a foothold or lateral movement. It teaches techniques for identifying and exploiting saved credentials.
EnumerationFirst I check for available open ports.
nmap -p- --min-rate=10000 10.10.10.98
nmap -sC -sV -p21,23,80 10.10.10.98 -oA ./nmap/access
Ports
Service ...
Bastion - HackTheBox
Bastion is an easy level WIndows box which contains a VHD ( Virtual Hard Disk ) image from which credentials can be extracted. After logging in, the software MRemoteNG is found to be installed which stores passwords insecurely, and from which credentials can be extracted.
EnumerationFirst I check for available open ports.
nmap -p- --min-rate=10000 10.10.10.134
nmap -sC -sV -p21,22,80,135,139,445,5985,39517 10.10.10.134 -oA ./nmap/bastion.txt
Ports
Service
22
ssh OpenSSH for_Windows_7.9 ...
vsCTF 2023
We participated in our vsCTF 2023 and we ended up being 1st! It was a day-long CTF but we solved 24 (out of 31) challenges. Some of the challenges were very interesting.
Cant wait to play the next vsCTF event as CyberSpace
WebChallenge → Sanity CheckDescription → you know what to do.
Solution →
We are presented with a website that pretty much running nothing. I tried opening the source code by right click and Ctrl+u. None of them worked
We can view the source code by directly manupulating ...
Cronos - HackTheBox
Cronos is a medium Linux machine that focuses mainly on different vectors for enumeration and also emphasises the risks associated with adding world-writable files to the root crontab. This machine also includes an introductory-level SQL injection vulnerability
EnumerationFirst I check for available open ports.
nmap -sC -sV -A -oG beep beep.htb
Ports
Service
22
ssh OpenSSH 7.2p2 (4Ubuntu2.1)
53
DNS
80
Apache httpd 2.4.18
Next, I did directory brute-forcing but nothing interesting s ...
JWT Lab - Portswigger
All Labs of JWT from Portswigger.
ApprenticeJWT authentication bypass via unverified signatureLet’s login with the given credentials and intercept the request.
Our Extension can automatically detect JSON tokens. Let’s change the user to administrator.
After forwarding the request we can see the username is changed.
Now let’s repeat the process and each time the username needs to be changed.
NOTE → If you don’t want to change your username every time, after intercepting the request se ...
Beep - HackTheBox
Beep has a very large list of running services, which can make it a bit challenging to find the correct entry method. This machine can be overwhelming for some as there are many potential attack vectors. Luckily, there are several methods available for gaining access.
FixesDue to this machine’s age and the outdated TLS version, issues emerge.Before we move on, let’s solve a couple of them.
Firefox
Curl & gobuster-k, –insecure Allow insecure server connections
EnumerationI begin as ...
Shocker - HackTheBox
Shocker, while fairly simple overall, demonstrates the severity of the renowned Shellshock exploit, which affected millions of public-facing servers.
EnumerationAt first, I did a Nmap scan for open ports and services.
nmap -sC -sV -p- 10.10.1.235 -oG shocker
Ports
Service
80
Apache httpd 2.4.18 ((Ubuntu))
2222
OpenSSH 7.2p2 Ubuntu 4ubuntu2.2
I visit the website But there is nothing interesting.
I start enumerating websites using FFUF
ffuf -w /usr/share/dirb/wordlists/small.txt:FUZZ ...
SQLi (UNION) Lab - Portswigger
First 10 Labs of SQLi Lab based on UNION attack.
SQL injection vulnerability in WHERE clause allowing retrieval of hidden dataBy making the statement true we can get all the categories.
Payload → 'OR 1=1-- -
SQL injection vulnerability allowing login bypassIn the login page after typing the username we can just comment the rest of the statement. Which will make the password parameter a comment.
Payload → administrator'-- -
SQL injection UNION attack, determining the number of columns ...
HackTheBox CTF@USF
We participated in our local HTB-hosted USF CTF and we ended up being 1st! It was a day-long CTF but we solved all of the challenges within 4hours. Some of the challenges were very interesting.
Cant wait to play the next USF HTB event as PROTOSEC