10.10.10.13 CRONOS hackthebox machine writeup

CRONOS 10.10.10.13 Write Up

Machine Created by ch4p

Tools Used for Enumeration:

1. nmap
2. nslookup
3. dig

Tools Used for Exploitation:

1. netcat

Steps for primary enumeration:

1. At first we use nmap (Network Mapping tool) to scan the box ip. When we run it we got list of some open ports and services running on those ports. On the cronos box we can see, open port and service are, port port 22 for ssh, port 53 for nameserver and port 80 for apache 2.4.18 http server.
Command used: nmap -A 10.10.10.8

10.10.10.6 POPCORN hackthebox machine writeup

POPCORN 10.10.10.6 Write Up

Machine Created by ch4p

Tools Used for Enumeration:

1. nmap
2. dirb

Tools Used for Exploitation:

1. netcat

Steps for primary enumeration:

1. At first we use nmap (Network Mapping tool) to scan the box ip. When we run it we got list of some open ports and services running on those ports. On the popcorn box we can see, open ports and services are, port 22 for ssh and port 80 for http server.
Command used: nmap -A 10.10.10.6

10.10.10.10 TENTEN hackthebox machine Write Up

Tenten 10.10.10.10 Write Up

Machine Created by ch4p
Machine is retired
Linux OS

Enumeration:

Nmap
WPScan

Exploitation:

StegHide

Steps:

Enumeration and Exploitation:

1. At first we run nmap and nmap showing that the WordPress CMS is used and ssh port is open.
2. So, we use wpscan and it return several vuln. We will find that Job Manager plugin is vuln CVE 2015-6668, where a IDOR vuln is present. So, when we exploit it, we can see a file named HackerAccesGranted. We just download the file and use steghide to extract hidden file within it. We can use blank password to extract. Inside it, there is a hidden ssh key file.
Image file location:
http://10.10.10.10/wp-content/uploads/2017/04/HackerAccessGranted.jpg
command:
steghide extract -sf HackerAccessGranted.jpg
3. We decrypt and find the password in it with john and a python script.
command:
wget https://raw.githubusercontent.com/stricture/hashstack-server-plugin-jtr/master/scrapers/sshng2john.py
python sshng2john.py id_rsa > id_rsa.encrypted
john id_rsa.encrypted --wordlist=/usr/share/wordlists/rockyou.txt
4. Now we can login to ssh with the key and the password and username used as enumerated from WordPress scan.
command:
ssh -i id_rsa takis@10.10.10.10
5. After finding user.txt, we will go for system rooting.
6. When we type sudo -l, it gives result that we can root using '/bin/fuckin'. So, we root using that file.
command:
sudo fuckin cat /root/root.txt

Hint:

Reference:

https://forum.hackthebox.eu/discussion/32/tenten-write-up-by-hkh4cks
https://teck-noobs.blogspot.in/2017/07/htb-tenten-walkthrough.html

Video:

https://www.youtube.com/watch?v=A4U3xiRWfsU

10.10.10.7 BEEP hackthebox machine Write Up

BEEP 10.10.10.7 Write Up

Machine Created by ch4p
Machine is retired

Tools used:

Enumeration:

Nmap
GoBuster
goWapt

Exploitation:

NetCat

Steps: