hackthebox - The Random Adventure That Is Life (RATIL)

The Random Adventure That Is Life (RATIL)

Sign in Subscribe

hackthebox

A collection of 27 posts

Hack The Box: GreenHorn

Hack The Box: GreenHorn

Initial Recon NMAP The service on port 3000 seems interesting. Web Port - 80 Clicking on admin at the bottom takes you to a login page that indicates the system is running pluc 4.7.18. Which is vulnerable to an RCE. Pluck v4.7.18 - Remote Code Execution

Hack The Box: Cicada

Initial Recon NMAP SMB SMB is exposed so let's try some common attacks there, including RID Brute forcing to find some valid users. * john.smoulder * sarah.dantella * michael.wrightson * david.orelious * Dev Support * emily.oscars These might be good users to start a brute force attack with. We

Hack The Box: PermX

Hack The Box: PermX

Initial Recon NMAP Web Port PermX Appears to be an eLearning Platform but does not load properly due to apparently Burp proxying the traffic. Disabling Burp lets the site load normally. Reviewing all the linked pages doesn't provide much other than the business model and some team member

Hack The Box: Sightless

Hack The Box: Sightless

Recon NMAP Interesting things: * FTP -ProFTPD * SSH * Web server at sightless.htb Web Server Did some virtual host brute forcing that did not turn up anything new. Directory scanning I found the icones directory. This just 403s, not useful. The page has a link to http://sqlpad.sightless.htb/ SQLPad

Hack The Box: Editorial

Hack The Box: Editorial

Recon NMAP Web Port The web page appears to be a book review site. The "Publish with us" page allows for some info entry and a file upload. The "About" page includes and additional domain tiempoarriba.htb Initial Access Upload Page The "Cover URL"

Hack The Box: BoardLight

Hack The Box: BoardLight

I just wanted a quick win, so I decided to go for one of the easy boxes today. Recon My initial scan reveals just SSH and a web site open. As expected, we have a website with some clues and functionality to test. * Email: [email protected] * Newsletter signup * Request

SolarLab

Recon Ooohhh, a Windows machine! The website is for an instant messaging app called SolarLab IM. Things to try from here: * Web app exploration * Subdomain brute * Path brute * Functionality * Host * SMB user/pass brute force * Interesting port 6791 Web App Exploration Potential usernames from employee names: * Alexander Knight * Claudia Springer

Hack The Box: Intuition

Hack The Box: Intuition

This is a big of a slog and rambling run through of this challenge. This one was hard for me due to the high number of avenues required to be investigated for root. There were red herrings and many necessary paths to explore. Recon Looks like the web service on

Hack The Box Sherlocks: CrownJewel2

Hack The Box Sherlocks: CrownJewel2

If you have not yet set up an environment for viewing logs, I suggest you check out my writeup on that process. I needed to use most of the hints on this one because I have not worked in a Windows domain environment for a while, but it was fun

Log Viewing Environment Setup

Log Viewing Environment Setup

I just discovered Hack The Box Sherlocks; defensive challenges that generally involve some sort of log analysis. To get ready to tackle these challenges, I needed an environment to parse and view the logs. For the easiest process, I decided to go with Security Onion. I have not used SO

Hack The Box: Sau

Hack The Box: Sau

Enumeration Port 80 doesn't give me anything but port 55555 reveals what looks like a Python-based web app. The application appears to be some sort of app to inspect HTTP requests that are sent to the application. There is a function to enter a master token that allows

Hack The Box: Keeper

Hack The Box: Keeper

Enumeration As always, start off with an NMAP Scan Just 80 and 22 open today. We will start by enumerating the web app. To make some of this work easier, I am going to add keeper.htb and tickets.keeper.htb to my hosts file. Navigating to the linked site

Hack the Box: Inject

Hack the Box: Inject

Enumeration Browsing to the webpage on port 8080 lands at a "Zodd Cloud" product page. There seems to be signup and sign in functionality that will be worth exploring. None of the links work except signup, which lands at an Under Construction page. Oh, but there is an

Hack the Box: Busqueda

Hack the Box: Busqueda

Initial Recon Conduct typical initial portscan └─$ nmap 10.10.11.208 Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-26 11:13 EDT Nmap scan report for 10.10.11.208 Host is up (0.089s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open

Hack The Box: Precious

Hack The Box: Precious

Initial Enumeration A simple NMAP scan to just get the lay of the land initially. Only two ports appear to be open. SSH appears to allow for password auth, and the web port hosts a page that allegedly converts pages to PDFs. Brute forcing additional pages on the web server

Hack The Box: Previse

Hack The Box: Previse

NMAP shows that ports 80 and 22 are open. The site at port 80 is a login page to a File Storage site. Running GoBuster against the site reveals several additional pages that although they redirect back to the main login page, do indeed have content as well. Specifically: * accounts.

Return To Hack The Box - BountyHunter

Return To Hack The Box - BountyHunter

After a several year hiatus from Hack The Box, I decided to jump back in and take a look. Here is the write-up for Bounty Hunter BountyHunter Initial nmap scan indicates ports 22 and 80 are open. Browsing the page on port 80, there is a "Portal" section

Hack The Box: Irked

Hack The Box: Irked

Irked: Retired If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. Enumeration My initial enumeration returned a handful of ports. From port

Hack The Box: Jerry

Hack The Box: Jerry

Jerry: Retired 17 November 2018 If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. This box was almost too easy. This is

Hack The Box: DevOops

Hack The Box: DevOops

DevOops: Retired 13 October 2018 If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. Been a while since I had time to

Hack The Box - Bashed

Hack The Box - Bashed

Bashed: Retired 28 April 2018 If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. Bashed was one of the easier boxes on

Hack The Box - Sense

Hack The Box - Sense

Sense: Retired 24 March 2018 If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. Sense was an easier box but the initial

Hack The Box - Mirai

Hack The Box - Mirai

Mirai: Retired 10 Feb 2018 If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. Mirai was certainly one of the easier boxes

Hack The Box - Solidstate

Hack The Box - Solidstate

SolidState: Retired 27 Jan 2018 If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. Solidstate was extremely similar to another training box

Hack The Box - Blocky

Hack The Box - Blocky

Blocky: Retired 9 Dec 2017 If you are interested in learning more about penetration testing, Hack the Box is a great way to get your feet wet in a legal and well built environment. Head over to hackthebox.eu to get started. Blocky has been the easiest box for me