(HTB) Tenten Walkthrough


Name: Tenten
IP : 10.10.10.10
OS – linux
VM Author: ch4p
Writeup Author: Teck_K2

Nmap result


In the target system only port 22 and 80 is open let's try to open it


It’s a job portal site and powered by WordPress
Let's try to find the version detail
IN the /readme.html it’s showing me the version which is 4.7


Now as we now it’s a WordPress site now we will use wpscan
It will start enumerating users
We got only 1 user


One of them is admin we will focus on him only
Now we know the username we can try to bruteforce the password
After several hours I got no result


Let’s enumerate plugins



We got 2 plugins installed


As we can see one is akismet which is up to date and the second one is job-manger which is also up to date but one version of job manager which is 0.7.25 seems outdated and insecure.

Let find out some exploit for that.
I find this link in the wpscan description
If you can’t understand what’s going on the above blog which I shared above then look at this


We will use hackbar to fuzz file/directories as you can see the url mentioned /8/ in the end that we need to fuzz

So copy that link and remove 8
http://10.10.10.10/index.php/jobs/apply/

Now click on + button which is on the left side of SQL


Now as you click that it will ask you for to enter string type 1 and hit OK
Now it will load
http://10.10.10.10/index.php/jobs/apply/2/

Now look at the Title


Click on it, it’s not that useful now click on the +
at
http://10.10.10.10/index.php/jobs/apply/3/

It’s showing  

 But if you focus on the URL it's now showing the id parameter =3



Now try to fuzz this maybe we could find anything useful
Our motive is to find the location where our resume has been uploaded
Again copy this in the hackbar and start from 1
While you are + keep looking at the url maybe something interesting came up


At the id=13 I saw something interesting which may be a file which is under application


Now move on
At the id=15 I got my file name which I have uploaded my file name was ten.txt


As you can see in the ulr it’s showing me the name of my file which is ten
We are doing this because we want to learn how this plugin works
Now we can google this how job manager plugin stores data and in which location
By doing some search in google I got to know that the plugin stores the data in this form
Ip/wp-content/uploads/year/month/filename.extension


So in our case the destination would be
As you can see I can see the file content which I have uploaded
In my case the id is =13 maybe in your case the id could be different keep finding until you find your file name.
Now try to access filename which we got earlier (hackeraccessgranted)
I tried with so many possible months and year and extensions then finally I found the file.


So let’s try to access this


It’s a jpg file that could be stegnography pic
Let’s find out.
We will use steghide to extract the data


If the tool is not preinstalled in your kali you can download it by using
#apt-get install steghide
And type # steghide extract –sf filename


Now steghide has extracted the jpg content in a file named id_rsa which is our gateway to access the SSH.
Let’s try to open this by using another tool named ss2john to check if there is any hidden password or not and yes we found the password hash in it.

 # ssh2john filename


Now copy the output for ssh2john to a new text file pass or you can name it anything
So to crack this SSH password hash we will use john

 As you can see John was so fast it cracked the password in just 01 sec.
We got the password for ssh login now try to login with name which we enumerate in the wpscan which is takis


# ssh –i id_rsa takis@10.10.10.10
And type the password which we got which is = superpassword
If you get some error like this  


Try to give the file a 400 permision

Now we got the ssh login

We have a limited user access so we need to do privilege escalation
Try to find the user flag first and upload it.
We got the user flag

Now try to find any exploit to perform (privesc)
Or we can do it in simple way
Remember before trying any exploit first go for the classic way of priv esc which we can do manually.

# Sudo –l will give us the folders/file which we have access and in which we don’t need any password.

By typing # sudo /bin/fuckin su
We got the root access

Now you can access root directory and read the flag.
 .


 ~Enjoy Hacking and stay NOOB

TeckK2 Guru

Rank: 934 2 63

hackthebox.com

Comments

Post a Comment

Popular posts from this blog

(HTB) October Walkthrough

Image
Name: October IP : 10.10.10.16 OS – Linux VM Author: ch4p Writeup Author: Teck_K2 Nmap result Port 80 is open, Let’s access the web page By accessing the web I got to know that the target machine is using October CMS which is an open source self-hosted CMS platform based on the Laravel PHP framework. In the account section we can Signup and access the app but it is of no use. Now run the dirb and nikto tool and google some available exploit on October CMS Unfortunately I coundn’t find anything useful in the google and Nikto result but I found something useful. But In the Dirb result I found something useful which is /backend page with code:302 which means it will redirect us to somewhere else. Let’s open this in the browser. By accessing the link I got redirected to the Administrative area. Now we have the login page in front of us, we can do bruteforce attack, SQL-injection, etc.. Let’s try some manual brute-forcing. Let's try with (admin:password) It’s sh...
Read more

(HTB) Arctic Walkthrough

Image
Name: Arctic IP : 10.10.10.11 OS – Windows VM Author: ch4p Writeup Author: Teck_K2 Nmap result First, try to find the exploit which is available for the particular services running on the target machine, I tried to find but couldn't find any exploit regarding MSRPC no we will jump to FMTP In the Port :8500 We can see there are two directories try to open both in new tabs Now Open all the subdirectories maybe we could find something interesting I n the sub-directory /cfdocs I found there is a cold fusing version 8 running If you see error something like this then don't worry because ColdFusion only allow 2 person at a time and if someone didn't sign out it will keep his session open, So just reset the machine and you are good to go. This blog maybe be helpful to understand cold fusion https://jumpespjump.blogspot.co.uk/2014/03/attacking-adobe-coldfusion.html In the above blog as describe to get the password hash didn’t work for...
Read more