Capture the flag (CTF)

Hack the Box (HTB) machines walkthrough series — Aragog

Today, we will be continuing with our exploration of Hack the Box (HTB) machines, as seen in previous articles. This walkthrough is of an HTB machine named Aragog.

HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

The walkthrough

Note: Only write-ups of retired HTB machines are allowed. The machine in this article, named Aragog, is retired.

Let’s start with this machine.

1. Download the VPN pack for the individual user and use the guidelines to log into the  HTB VPN.

2. The Aragog machine IP is 10.10.10.78.

3. We’ll use the same methodology of performing penetration testing as we’ve used before. Let’s start with enumeration in order to learn more about the machine.

4. As usual, let’s start with the nmap scan to gather more information about the services running on this machine. [CLICK IMAGES TO ENLARGE]
<<nmap -sC -sV -oA Aragog 10.10.10.78>>

5. Only port 21 and 22 are visible from the initial nmap scan.

6. Let’s start the enumeration with port 21. Getting into port 21 via anonymous, we can see that there is a test.txt file. Let’s download the file to the system.

<<ftp 10.10.10.78>>

<<ls>>

<<get test.txt>>

7. It looks the file defines a subnet mask. It will be interesting to see if this will be used in further investigation.

8. Browsing the machine over port 80 reveals the default Apache page.

9. Let’s start directory enumeration with gobuster.
<<gobuster -u http://10.10.10.78 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 20 -x php>>

10. As a result, we found some interesting directories, such as user and hosts.

11. Browsing the file hosts reveals the following output which aligns with the subnet range identified earlier.

12. Let’s fire up Burp Suite, change the verb and submit the above-identified file. Change the subnet range to identify the difference.

13. OK, so things like this are prone to XML-xxe injection. Using that as the attack vector, we can collect all the usernames from the system.

14. Let’s start looking to see if some of them have the key also present. It does indeed look like user named “floran” does.

15. Let’s copy the key and log into the box as floran. Bingo! We are now in the box.

16. We browse to grab the user.txt file.

17. Let’s start privilege escalation. Initial enumeration reveals a directory which was not found with gobuster. Browse that directory and we are presented with a WordPress site.

18. Browsing the site, it looks like user “Cliff” is doing some regular roundabouts at the site.

19. Since the dev_wiki which is holding this WordPress is editable by all users, let’s see if we can inject the wp-login.php page so that when Cliff visits our exploit, it gets executed and we get a reverse shell. The exploit is very simple: it just prints the request variable for the user (as shown below) and writes them into the lhm.txt file.

20. After some time, the expected activity happened and the lhm.txt file has an admin password.

21. It turns out that the same password can be used for escalating to root as well.

22. We end by enumerating to grab root.txt file.

So this is a straightforward machine with a very interesting initial foothold and then escalating the privileges due to overly permissive directories and password reuse.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

We will continue this series on interesting HTB machines.