https://aegrah.github.io/categories/walkthroughs.htmlRecent content in Walkthroughs on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudSun, 21 Aug 2022 07:00:00 +0200https://aegrah.github.io/post/2022-03-30-timelapse-htb-walkthrough.htmlSun, 21 Aug 2022 07:00:00 +0200https://aegrah.github.io/post/2022-03-30-timelapse-htb-walkthrough.html Welcome back! Today we are going to solve the Timelapse machine from Hack The Box. Timelapse is an easy box which focuses on accesible SMB shares and a lot of hash cracking to get the initial foothold. We then find configuration files that allow us to login to the system as the administrator user. Foothold Let's start off with a basic nmap scan. We use -Pn to skip host discovery, -sC to enumerate services, -sV to enumerate service versions and -oN to write to Nmap readable format.https://aegrah.github.io/post/2022-04-10-undetected-htb-walkthrough.htmlTue, 19 Jul 2022 09:00:00 +0200https://aegrah.github.io/post/2022-04-10-undetected-htb-walkthrough.html Today we will be taking a look at the medium box "Undetected" from Hack The Box. The foothold for the box can be found through a vulnerable php script in a directory that should not be world accessible. The script allows for remote code execution onto the box as the www-data user. We then escalate to user by finding an odd looking backup file which is actually an ELF compiled exploit.https://aegrah.github.io/post/2022-04-07-meta-htb-walkthrough.htmlSun, 12 Jun 2022 13:14:53 +0200https://aegrah.github.io/post/2022-04-07-meta-htb-walkthrough.html Welcome to my Hack The Box walkthrough for the "Meta" box. The box is considered to be of medium difficulty. Meta requires you to perform DNS virtual host enumeration, identify the inner workings of an image upload functionality, and exploit this to get a foothold. We then find a vulnerable version of ImageMagick (which is vulnerable to ImageTragick). We exploit this to get user access. Finally we escalate to root privileges through Neofetch, that is allowed to be executed with root permissions.https://aegrah.github.io/post/2022-04-01-timing-htb-walkthrough.htmlSat, 04 Jun 2022 19:00:00 +0200https://aegrah.github.io/post/2022-04-01-timing-htb-walkthrough.html Today we will be taking a look at Timing from Hack the Box. Timing is considered to be of medium difficulty, and requires the usage of a local file inclusion to eventually find credentials for the box. We then find an application that we can run with sudo permissions, and misuse it to gain root access. Foothold Let's start off by initiating an nmap scan, which will enumerate all services and their versions that are running on the machine.https://aegrah.github.io/post/2022-04-05-unicode-htb-walkthrough.htmlSat, 07 May 2022 21:00:00 +0200https://aegrah.github.io/post/2022-04-05-unicode-htb-walkthrough.html Hello everyone, today we are going to take a look at Unicode from Hack The Box. Unicode is a medium box that involves JWT manipulation, local file inclusion and a custom made application that can be used to access the root flag. Foothold As usual, we start off with an nmap scan to enumerate all ports, services and their versions. 1nmap -sC -sV -p- -oA nmap/initial unicode.htb Which provides us with the following results.https://aegrah.github.io/post/2022-03-31-shibboleth-htb-walkthrough.htmlThu, 31 Mar 2022 11:25:54 +0200https://aegrah.github.io/post/2022-03-31-shibboleth-htb-walkthrough.html Today we will be taking a look at "Shibboleth" from Hack the Box. To get get a foothold onto the box we first exploit the vulnerable-by-design IPMI protocol to obtain an administrator hash for Zabbix, and crack it. Through Zabbix we can execute local commands and obtain a shell. We can then use a recent MariaDB privilege escalation exploit to escalate to the root user. Foothold As always, we start off with a simple nmap scan to enumerate ports, services and version numbers.https://aegrah.github.io/post/2022-03-29-backdoor-htb-walkthrough.htmlTue, 29 Mar 2022 14:19:37 +0200https://aegrah.github.io/post/2022-03-29-backdoor-htb-walkthrough.html Welcome to my walkthrough for the "Backdoor" machine from Hack The Box. Backdoor is considered to be an easy box. We get a foothold onto the box through the exploitation of a vulnerable web service running at an unusual port. We can then escalate privileges through a screen session that was still open, which was running as the root user. Foothold Today I figured it would be nice to get some tea while the scans were running, so therefore I started the box off with an nmap scan on all ports.