Hack The Box

We enumerate valid usernames via the legacy Finger protocol, obtain initial access through weak SSH credentials, harvest password hashes from an exposed shadow backup to crack credentials for lateral movement, and escalate privileges to root by abusing sudo permissions on wget via askpass execution.

We discover an exposed Git repository to inspect backend source code, leverage an arbitrary file read vulnerability in ImageMagick (CVE-2022-44268) to extract an SQLite database containing user credentials, and escalate privileges by exploiting a path traversal flaw in an automated Binwalk scanner (CVE-2022-4510) to obtain a root shell.

On this machine we exploit default credentials in Request Tracker to harvest SSH user credentials from profile comments, recover the KeePass master password from a process crash dump via CVE-2023-32784, and convert an extracted PuTTY private key to achieve root access.

Explore how bad credentials and non-updated software can lead to a compromission of the system.

Explore how to exploit the Eternal-Blue vulnerability.

Explore how to abuse a Mailbox to obtain credentials and to abuse hidden processes to escalate privileges.