Posts
-
Facts is a simple box themed around whitebox testing an open-source CMS. The foothold involves exploiting a mass assignment vulnerability to escalate privileges to admin within the CMS, then finding an AWS key in the settings to access an S3 bucket and retrieve an SSH key. At the time of release there’s no public PoC available, so the exploit payload has to be manually derived from the CMS’ source code. In the process of doing so, I also discovered an old path traversal CVE was insufficiently patched, making it possible to directly read the SSH key without escalation. For root it’s just a simple GTFOBins exploit.
-
Overwatch is pretty straightforward and evolves around attacking a simple .NET monitoring application. It starts with finding a .NET binary in an open SMB share, decompiling it gives credentials to access MSSQL. There’s a linked server configured but it points to a non-existing host, I’ll perform ADIDNS poisoning to capture another set of credentials, which can be used to get a shell via WinRM. From here, I’ll discover the monitoring app running locally with admin privileges, and identify from the decompiled source code that it’s vulnerable to OS command injection.
-
HackNet is all about exploiting a Django application. It starts with a server-side template injection in the username. While getting RCE directly is not possible, it does allow leaking internal context variables, which includes credentials that can be reused for SSH login. Once on the box, I’ll find the Django cache directory is world-writable, which enables a deserialization attack to get to another user. From there, I’ll find private keys to decrypt several GPG-encrypted database dumps, one of which contains the root password.
-
Every now and then I’ll go back and do an old box on HTB, it serves as a nice break from all the Windows/AD headscratchers that’s been released recently. It’s also interesting to see how much the boxes have changed over the years. While the current boxes have much more realistic scenarios and often feature newly discovered vulnerabilities, older ones are more CTF-like and full of rabbit holes. Friendzone was released in February 2019, so the box is themed around Valentines with lots of trolls. It starts with finding credentials in an open SMB share and discovering a subdomain via DNS zone transfer. The subdomain hosts an admin portal vulnerable to LFI, which can be exploited to get a shell. Privilege escalation involves a simple Python module hijack.
-
Voleur translates to “thief” in French, which is a fitting name for this box as it’s all about “stealing” information and secrets everywhere. It starts with finding an Excel file in SMB containing credentials for several users, one of which has permissions to restore a deleted user account. That account has access to a home directory backup containing DPAPI credentials, which kicks off a chain of lateral movement and pillaging, eventually leading to recovering an
ntds.ditbackup and dumping the admin hash. -
Recently I’ve been doing more Proving Grounds in preparation for my OSCP exam later this year. These boxes certainly have a different “flavour” than HTB ones, often containing many different applications and services running simultaneously. OffSec also loves chaining multiple applications together in an exploit chain. Finding a vulnerability in an app often does not lead to a foothold directly, but instead is used to attack or enumerate other services. Medjed is a good example of this, with the foothold exploit leveraging several seemingly unrelated web apps. While not too difficult, it’s very easy to get stuck without thorough enumeration.
-
Ghost is the toughest box I’ve faced so far, it took me weeks to complete (and much longer to create this writeup). It involves exploiting and pivoting between several interconnected web apps, Linux containers and an AD forest environment. Many AD services and attacks are still new to me, so I often found myself getting stuck. This is especially true for ticket-based attacks, understanding the entire flow and interaction can be quite a head-scratcher.
-
This box is unique in that it focuses entirely on Active Directory. Unlike typical boxes in HTB, there’s no web application to look at, and domain credentials are provided from the very start. This setup simulates real-world penetration tests in a Windows/Active Directory environment, and provides an excellent opportunity for practicing AD enumeration and attacks using tools like BloodHound and Impacket scripts.
-
Yummy feels more CTF-like compared to recent HTB boxes. Foothold involves a rather complex attack chain combining path traversal, JWT forging, SQL injection and multiple cron job abuses. Once on the box, I’ll exploit Mercurial and abuse sudo rights to get a root shell.
-
Cicada is a nice easy box for practicing Windows enumeration and attacks. Foothold involves using
netexec,ldapdomaindumpand Impacket scripts to retrieve multiple sets of credentials from SMB and LDAP, and eventually getting a shell with WinRM. Once on the box, I’ll abuse the Backup Operators group membership to retrieventds.ditand extract the admin hash for an elevated shell. -
Happy new year! It’s been a while since I last posted, as life got in the way. I’m hoping to get back to posting more regularly this year. This machine is centred around abusing passwords. It starts with a public SMB share exposing a password-harvested excel file, one of which can be used to log in to the employee portal. The web app uses a vulnerable library to generate PDF files, which can also be abused to get a shell. Privilege escalation is all about enumerating OpenFire and once again abusing some stored credentials.
-
Headless is a simple and straightforward machine, which is a nice change of pace with the recent releases. The foothold involves cross-site scripting, an attack vector often overlooked in HTB boxes. I’ll exploit it to steal an admin cookie and access a dashboard page, which is vulnerable to OS command injection. Privesc is simply abusing an insecure bash script ran in sudo.
-
Personally, Crafty is one of my least favourite box recently due to its instability. It involves exploiting a Log4J vulnerability in a Minecraft server. While this might seem straightforward, the exploit messes up the Minecraft process, giving you only one chance. If you made a mistake in the payload or somehow lost the shell, you’ll have to reset the box and do everything again. This is particularly annoying on shared servers where everyone is constantly attempting resets, and is reflected by its low user rating.
-
The attack path for Pov is actually pretty straightforward, with no major rabbit holes. However, each step of the attack chain presents different sorts of obstacles, and requires a fair amount of research and debugging to overcome them. It starts with discovering the web server’s machine key through an LFI vulnerability, which can be used to exploit ASP.NET’s insecure ViewState deserialization for a shell. From here, I’ll find PSCredential to move to another user, and exploit
SeDebugPrivilegeto escalate to SYSTEM. -
First released in 2017, Brainfuck is one of the earlier HTB boxes. The difficulty is rated as insane, but by today’s standard, it’s probably just hard or even medium. It involves a WordPress privilege escalation exploit, interacting with mail protocols, and attacking two encryption algorithms. Escalating to root wasn’t in the intended path, but since the box is 7 years old now, there’s 2 ways to obtain a root shell.
-
The name “Bizness” provided a major hint that the box is themed around Apache OFBiz, which had a critical RCE exploit published around the time of release. This is probably also the reason why the user flag got blooded in less than 2 minutes! The root part involves reversing a password hash found in a database dump.
-
CozyHosting is pretty straightforward. It starts with stealing a session cookie from a misconfigured Sprint Boot server. With this, I can access an admin panel and find an endpoint that’s vulnerable to OS command injection. For root, it’s simply a GTFOBins exploit.
-
This is an interesting box themed around .NET projects. The web application clones a user-provided git repository and attempts to build the project. Here, the
PreBuildEventproperty in MSBuild can be abused for running malicious OS commands and gaining a foothold on the box. For privilege escalation, I’ll recover default privileges for a service account, then exploitSeImpersonatePrivilegewith a Potato attack. -
Flight is a challenging Windows machine involving lots of steps, but once rooted, you’ll find out that it’s just repeating the same few exploits in different scenarios. I learned a lot from this box, as it involves several exploit techniques I’ve never seen before.
-
This is a really fun box that isn’t too difficult to solve. As the name implies, it involves exploiting common mistakes developers make, for both user and root. The funny thing is that the box creator also made one of these rookie devops mistakes, which introduced an unintended attack path and made the box a whole lot easier.
-
Curling is one of the older boxes on HTB, initially released in 2018. The box is very CTF-like, but requires nothing more than clever enumeration to complete. It starts with finding an exposed password that can be used to log in to Joomla as admin, then uploading a web shell using the admin’s privileges. Once on the box, I’ll recover a password for another user by reverting a hex dump and unzipping multiple layers of compression. For root, there’s a cron job running
curlthat can be hijacked. -
Inject is a relatively simple Linux box starting with a directory traversal vulnerability that leaks credentials and dependencies used by the Spring Boot web app, one of which can be exploited for RCE. For privesc, there’s a cron job running Ansible playbook that can be abused.
-
Timelapse is a simple Windows box that emphasizes on the importance of enumeration. In fact, the box can be rooted entirely through diligent recon, without relying on any exploits. It starts with accessing an open SMB share and finding an encrypted PFX file, which I’ll crack using
johnand use it to login to the box. From there, I’ll find credentials in a PowerShell history file, which helps me move to another user that can read the Administrator password via LAPS. -
Photobomb is an easy Linux box involving some basic web exploitation. It starts with finding credentials in a JavaScript file, which I’ll use to access an image gallery. There’s a command injection vulnerability in the image download function, which can be abused to get a shell. Privesc involves exploiting an insecure script that can be run as
sudo.
