Socket is a medium linux machine featuring qreader executable file. Using the string command will get the pyc file, then we can convert from pyc to python file. Interact using websocket and find sql injection vulnerabilities. To get root privileges, we can use the build-installer script. spec is intended to fulfill the root user.

Pollution is a hardbox from hackthebox. Where in doing penetration testing we can find information in the form of text files and this information is encrypted using base64. the contents of the file contains the token of the administrator. the system has XXE vulnerability, where we can get the /etc/passwd file using Out-of-Band technique. to get access rights to the system we can use php-filter-chain. to get user victor, we can exploit it using php-fpm or fastcgi. The root user can be found by using the vulnerability of the pollution prototype at address 127.0.0.1 using port 3000 or pollutio...

PC is easy machine from hackthebox. in the initial foothold we can interact on port 50051 which is gRPC. we can use grpcui to get a good interface. then followed by registering the user using the login method. after logging in using the credentials we created, we can use get-info by filling in our id and token. capture the request and name the file pc.req. drop it into sqlmap so it does the rest. to get root privileges, there is a cve on the pyload. The content-length header has a big impact on the application pyload.

only for you on a medium linux machine that resembles a ctf which can be said to have no real life vulnerabilities. in enumeration process we can get beta as sub domain and get source code. do our analysis determine LFI vulnerabilities in this domain. take the app.py file on the domain only4you.htb will get the RCE vulnerability, where attackers can send requests using the POST method and email, subject, messages as parameters. After getting shell access, we see an application running on localhost using port 3000 and 8001. Doing port forwarding will find neo4j on port 8001, we can get a val...

Monitor Two is an easy machine from hackthebox. In carrying out the enumeration process from the target, we can identify the out-dated version of cacti. by exploiting, we can easily access the server. to get to marcus, we can find the entrypoint.sh file with the user and password information for the database. to get root privileges, we can use the docker service to exploit it. because that version of docker has a vulnerability of CVE-2021-41091

Inject is a very fun easy linux machine from hackthebox . in our case we were faced with a file upload which turned out to be only rabbit holes. by using the img parameter we can find LFI vulnerabilities. from this vulnerability we can find pom.xml file which contains system information of application using spring-cloud-function-web with version 3.2.2. Then when we arrive at the system shell, we can identify the password for user phil which is useful for getting root privileges on the system. The process to reach our root user only needs to upload the malicious playbook.yml, and after that ...

Format is a medium linux engine featuring the microblog app. where we can make our own application. but this is a vulnerability for the system, the attacker is able to carry out an LFI attack to Remote Command Execution by making the attacker a pro user on the application’s microblog. in obtaining root privileges, we can take advantage of the SUID binaries license with a vulnerability in the format() function in python. By combining a third party redis application to create a new user. With this we can become root on the box format system.

Cerberus is the Hard machine from hackthebox. In doing the enumeration we can find vulnerabilities on the icinga website, namely the LFI vulnerability. In this process we can get a username and password, this is needed at the time of exploitation. after successfully getting the shell, we are met with firejail. it takes two sessions to proceed to the next stage. Pivoting is needed to take port 5985 namely winrm. The ManageEngine application runs on localhost using port 9251, double pivoting is required to gain root privileges. The ManageEngine application was found to have the CVE-2022-47966...

Busqueda is an easy engine from hackthebox. In carrying out the enumeration process from the target, we can identify the version of the application, namely searchor 2.4.0, where in that version there is an Arbitrary Code Execution vulnerability. to get root privileges, we need to be able to get the user from svc in the .git/config directory. the next step is to execute sudo using system-checkup.py with malicious file-checkup.sh

Tentacle is a Hard linux machine featuring a Squid proxy server. Bypassing Squid proxy authentication reveals a host which is making use of a vulnerable OpenSMTPD service. Initial foothold can be achieved by the exploitation of it. A SMTP client configuration file discloses a password which assists in generating a valid Kerberos ticket. This ticket then can be used to move laterally. Finally a cronjob can be exploited to escalate to another user who has privileges to add root user to Kerberos principals. This gives us a root shell.