Writeups Archive
Security research, CTF machine walkthroughs, and red teaming notes.
Escape
Escape is a Medium difficulty Windows Active Directory machine that starts with an SMB share that guest authenticated users can download a sensitive PDF file. Inside the PDF file temporary credentials are available for accessing an MSSQL service running on the machine. An attacker is able to force the MSSQL service to authenticate to his machine and capture the hash. It turns out that the service is running under a user account and the hash is crackable. Having a valid set of credentials an attacker is able to get command execution on the machine using WinRM. Enumerating the machine, a log file reveals the credentials for the user ryan.cooper. Further enumeration of the machine, reveals that a Certificate Authority is present and one certificate template is vulnerable to the ESC1 attack, meaning that users who are legible to use this template can request certificates for any other user on the domain including Domain Administrators. Thus, by exploiting the ESC1 vulnerability, an attacker is able to obtain a valid certificate for the Administrator account and then use it to get the hash of the administrator user.
Authority
Authority is a medium-difficulty Windows machine that highlights the dangers of misconfigurations, password reuse, storing credentials on shares, and demonstrates how default settings in Active Directory (such as the ability for all domain users to add up to 10 computers to the domain) can be combined with other issues (vulnerable AD CS certificate templates) to take over a domain.
Administrator
Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the michael account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user olivia has GenericAll permissions over michael, allowing us to reset his password. With access as michael, it is revealed that he can force a password change on the user benjamin, whose password is reset. This grants access to FTP where a backup.psafe3 file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user emily. Further enumeration shows that emily has GenericWrite permissions over the user ethan, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for ethan, who is found to have DCSync rights ultimately allowing retrieval of the Administrator account hash and full domain compromise.
.jpg)
Certified
Certified is a medium-difficulty Windows machine designed around an assumed breach scenario, where credentials for a low-privileged user are provided. To gain access to the management_svc account, ACLs (Access Control Lists) over privileged objects are enumerated leading us to discover that judith.mader which has the write owner ACL over management group, management group has GenericWrite over the management_svc account where we can finally authenticate to the target using WinRM obtaining the user flag. Exploitation of the Active Directory Certificate Service (ADCS) is required to get access to the Administrator account by abusing shadow credentials and ESC9.
Sauna
Sauna demonstrates a chain of Active Directory misconfigurations: employee names exposed on a public website enabled ASREPRoasting, which yielded a foothold. Weak service account naming in autologon credentials, combined with excessive DCSync permissions, led directly to domain compromise. Each step relied on information left in plain sight, proving that AD security depends on securing every layer.
Return
Return is an easy difficulty Windows machine featuring a network printer administration panel that stores LDAP credentials. These credentials can be captured by inputting a malicious LDAP server which allows obtaining foothold on the server through the WinRM service. User found to be part of a privilege group which further exploited to gain system access.
Timelapse
Timelapse is an Easy Windows machine, which involves accessing a publicly accessible SMB share that contains a zip file. This zip file requires a password which can be cracked by using John. Extracting the zip file outputs a password encrypted PFX file, which can be cracked with John as well, by converting the PFX file to a hash format readable by John.
.png)
Support
Support is an Easy difficulty Windows machine that features an SMB share that allows anonymous authentication. After connecting to the share, an executable file is discovered that is used to query the machine's LDAP server for available users.
Explore
This port is used by by ES File Explorer file manger application. We can also see a known vulnerability for this application, in which an attacker is able to execute arbitrary commands to the host. searching the metasploit framework reveals a module for this vulnerability:
BoardLight
BoardLight is an easy difficulty Linux machine that features a `Dolibarr` instance vulnerable to [CVE-2023-30253](https://nvd.nist.gov/vuln/detail/CVE-2023-30253).
Cicada
Cicada is an easy-difficult Windows machine that focuses on beginner Active Directory enumeration and exploitation. In this machine, players will enumerate the domain, identify users, navigate shares, uncover plaintext passwords stored in files, execute a password spray, and use the SeBackupPrivilege to achieve full system compromise.
EscapeTwo
EscapeTwo is an easy difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. We leverage these credentials to access a file share containing a corrupted Excel document.
SteamCloud
SteamCloud is an easy difficulty machine. The port scan reveals that it has a bunch of Kubernetes specific ports open. We cannot not enumerate the Kubernetes API because it requires authentication.
TwoMillion
TwoMillion is an Easy difficulty Linux box that was released to celebrate reaching 2 million users on HackTheBox. The box features an old version of the HackTheBox platform that includes the old hackable invite code.
Driver
Driver is an easy Windows machine that focuses on printer exploitation. Enumeration of the machine reveals that a web server is listening on port 80, along with SMB on port 445 and WinRM on port 5985
Paper
Paper is an easy Linux machine that features an Apache server on ports 80 and 443, which are serving the HTTP and HTTPS versions of a website respectively. The website on port 80 returns a default server webpage but the HTTP response header reveals a hidden domain. This hidden domain is running a WordPress blog
Sau
`Sau` is an Easy Difficulty Linux machine that features a `Request Baskets` instance that is vulnerable to Server-Side Request Forgery (SSRF) via `[CVE-2023-27163](<https://nvd.nist.gov/vuln/detail/CVE-2023-27163>)`. Leveraging the vulnerability we are to gain access to a `Maltrail` instance that is vulnerable to Unauthenticated OS Command Injection, which allows us to gain a reverse shell on the machine as `puma`. A `sudo` misconfiguration is then exploited to gain a `root` shell.
Devvortex
Devvortex is an easy-difficulty Linux machine that features a Joomla CMS that is vulnerable to information disclosure. Accessing the service's configuration file reveals plaintext credentials that lead to Administrative access to the Joomla instance. With administrative access, the Joomla template is modified to include malicious PHP code and gain a shell. After gaining a shell and enumerating the database contents, hashed credentials are obtained, which are cracked and lead to SSH access to the machine. Post-exploitation enumeration reveals that the user is allowed to run apport-cli as root, which is leveraged to obtain a root shell.
Lacasa Del Papel
LaCasaDePapel is an easy difficulty Linux box, which is running a backdoored vsftpd server. The backdoored port is running a PHP shell with disabled_functions. This is used to read a CA certificate, from which a client certificate can be created. The HTTPS page is vulnerable to LFI, leading to exposure of SSH keys. A configuration file can be hijacked to gain code execution as root.
Pentesterlab _ Serialize Badge
Pentesterlab serialization vulnerabilities badge walkthrough
Reverse Engineering I
The Hack The Box Reverse Engineering track focuses on dissecting and understanding compiled software to analyze its behavior, uncover vulnerabilities, and develop problem-solving skills in low-level security research.
Squashed
Squashed is an Easy Difficulty Linux machine that features a combination of both identifying and leveraging misconfigurations in NFS shares through impersonating users. Additionally, the box incorporates the enumeration of an X11 display into the privilege escalation by having the attacker take a screenshot of the current Desktop.
Watersnake
As the United Nations of Zenium and the Board of Arodor engage in a fierce competition to establish a colony on Mars using Vitalium. State hackers from UNZ identify an exposed instance of the critical facility water management software, Watersnakev3, in one of Arodor's main water treatment plants. The objective is to gain control over the water supply, and weaken the Arodor's infrastructure.
Access
We can issue SQL queries with the mdb-sql tool and look for credentials in the auth_user table
Active Directory Hardening
The domain acts as a core unit regarding the logical structure of the active directory It initially stores all the critical information about the objects that belong to the domain only.
active
Active directory, kerberos and impacket
Dealing with computer data
Computer software communicates with each other by exchanged variously-formatted data via various communication channels. Learning about this concurrently with learning about security concepts can be overwhelming, and thus, this module tries to prepare you for the latter by covering the former.
Directory Traversal
Directory traversal also known as file path traversal is a web vulnerability that allows an attacker to read arbitrary files on the server that is running an application.
FriendZone
easy machine based on OS command injection and Python library hijacking
Linux Hardening
Linux System provides a reliable and robust alternative to closed-source systems, such as MS Windows Server and UNIX.
Linux Luminarium
CSE365 ASU Linux Module
Mastering Wireshark with Pentesterlab's PCAP
pentesterlab wireshark module step by step
Pentesterlab Essential
Pentersterlab introductory essential module to web vulnerabilities
Pentesterlab UNIX module
Introduction to UNIX by pentesterlab
Tabby
Exploiting tomcat LFI to read default credentials, the using msfvenom to upload a malicious .war file
WEB APPLICATION PENTESTING CHECKLIST
Checklist for testing web applications
White from pentesterlab
The white badge covers a wide range of web vulnerabilities to give people a view of what kind of issues can be found in web application.
cap
After we download the capture file, we open it in a packet analysis tool, such as Wireshark. To help hunt for interesting information, we open the “Statistics” menu, and launch the Protocol Hierarchy window. In it, we see there are FTP packets that were captured.
silo
A general guide to attacking the service can be found [here](https://book.hacktricks.xyz/pentesting/1521-1522-1529-pentesting-oracle-listener). We will use odat to do this task. In Kali, it can be installed with apt. We can also check the GitHub [repo](https://github.com/quentinhardy/odat) if we need more up-to-date version
Blue
CVE-2017-0143, The associated ransomware attack, dubbed "WannaCry", is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed "EternalBlue") has been made available on the internet through the Shadowbrokers dump on April 14th, 2017
Bounty Hunter
XXE Injection, EVAl Injection, Bounty Hunting
GoodGames
Flask application this would be a good time to test the form for Server Side Template Injection. After changing our username to {{7*7}} we see that our username has been changed to 49 and our SSTI payload was executed.
Jerry
Apache Tomcat/Coyote JSP engine
Lame
VSFTPD v2.3.4 Backdoor Command Execution
Netmon
Paessler PRTG bandwidth monitor
Remote
POC, FTP, Anonymous login, ExploitDB
Active Directory Attack Fundamentals
A deep dive into AD enumeration, Kerberoasting, Pass-the-Hash and lateral movement techniques.