Jump to content
CyberKid

Hack the Box: Poison Walkthrough

Recommended Posts

CyberKid

Hello everyone and welcome to yet another CTF challenge from hack the box, called ‘Poison,’ which is available online for those who want to increase their skill in penetration testing and black box testing. Poison is a retired vulnerable lab presented by Hack the Box for making online penetration testing practice suitable to your experience level; they have a large collection of vulnerable labs as challenges, ranging from beginner to expert level.

Level: Easy

Task: Find user.txt and root.txt in victim’s machine

Methodology:

  1. Port scanning
  2. Using LFI to find username
  3. Gaining encrypted password file using LFI
  4. Decrypting password file
  5. Logging in to SSH using decrypted password
  6. Transferring ZIP file and extracting to find a secret file
  7. Discovery of VNC on machine
  8. VNC tunneling over SSH to get root shell
  9. Grabbing flag

Let’s get started then!

Since, these labs have a static IP, the IP address for poison is 10.10.10.84.  Let us scan the VM with the most popular port scanning tool, nmap.

nmap -A 10.10.10.84
1
nmap -A 10.10.10.84

 1.png?w=687&ssl=1

From the result above we found two working ports on the VM, port 22 and 80 which are universal default ports for SSH and HTTP.

We immediately headed over to the webpage.

2.png?w=687&ssl=1

It was crystal clear only by reading that there was an LFI vulnerability involved. We tested it by inputting /etc/passwd in the scriptname section.

3.png?w=687&ssl=1

Which led us to the following output

4.png?w=687&ssl=1

From here we found that the username was “charix.” But before moving on to that part we tried all the scriptnames one by one given in the previous webpage.

It was going all monotonous until we found an interesting text file in the “listfiles.php” script.

5.png?w=687&ssl=1

 

 

The listfiles.php was a script that enumerated an array of the files

6.png?w=687&ssl=1

We found an interesting file called pwdbackup.txt. On opening it by the same process we found an encrypted password.

7.png?w=687&ssl=1

But it wasn’t a normal encryption, the password was encrypted 13 times. Just by looking we could tell that it was base64 encoding. So, we copied the password in a notepad file and removed the spaces between the password’s lines (present by default) and wrote the following command to decrypt it:

cat decode | base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 –d
1
cat decode | base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 -d| base64 d

 8.png?w=687&ssl=1

Voila! The password was found to be Charix!2#4%6&8(0

A complete logical shot in the dark was that it was the password to secure shell of the victim. So, we tried logging in to SSH.

ssh charix@10.10.10.84 ls
1
2
ssh charix@10.10.10.84
ls

 9.png?w=687&ssl=1

 And just like that we were logged in! We found the first flag (user.txt) and another file called secret.zip

We tried unzipping it on the spot but it didn’t work. So, instead we transferred the file to our system using scp (complete article here)

scp charix@10.10.10.84:secret.zip /root/Desktop/ cd Desktop unzip secret.zip
1
2
3
scp charix@10.10.10.84:secret.zip /root/Desktop/
cd Desktop
unzip secret.zip

 10.png?w=687&ssl=1

 We got a file “secret” which could be the password of another service.

We were far from convinced that no other service was running so we scanned the victim using socat. (To read more: https://packages.debian.org/sid/sockstat)

sockstat -4 -l
1
sockstat -4 -l

11.png?w=687&ssl=1

Port number 5901 and 5908 were open which clearly are the port numbers for VNC! This could be way in.

We followed the SSH tunneling methodology (refer here)

ssh -L 5901:127.0.0.1:5901 charix@10.10.10.84
1
ssh -L 5901:127.0.0.1:5901 charix@10.10.10.84

 12.png?w=687&ssl=1

IT will open up a shell. In a new terminal write:

vncviewer -passwd secret 127.0.0.1:5901
1
vncviewer -passwd secret 127.0.0.1:5901

 13.png?w=687&ssl=1

 We saw authentication successful tag!

What was left now but to:

ls cat root.txt
1
2
ls
cat root.txt

And this is how we owned the poison VM. Hope you enjoyed because we surely did!

14.png?w=687&ssl=1

 

Share this post


Link to post
Share on other sites

Δημιουργήστε ένα λογαριασμό ή συνδεθείτε προκειμένου να το δείτε

Πρέπει να είστε μέλος για να μπορέσετε να αφήσετε κάποιο σχόλιο

Δημιουργία λογαριασμού

Κάντε μια δωρεάν εγγραφή στην κοινότητά μας. Η εγγραφές μας είναι εύκολες.!

Εγγραφή τώρα

Σύνδεση

Εάν έχετε ήδη λογαριασμό σε αυτό το Forum; Συνδεθείτε εδώ.

Συνδεθείτε τώρα

  • Μηνύματα

    • vn5socks.net
      LIVE ~ 118.139.176.242:1197 | 0.047 | Unknown | Unknown | Unknown | Singapore | Checked at vn5socks.net
      LIVE ~ 97.74.230.16:36446 | 0.198 | Scottsdale | AZ | 85260 | United States | Checked at vn5socks.net
      LIVE ~ 192.169.218.61:16003 | 0.187 | Unknown | Unknown | Unknown | Unknown | Checked at vn5socks.net
      LIVE ~ 118.126.117.146:27011 | 0.17 | Shanghai | 23 | Unknown | China | Checked at vn5socks.net
      LIVE ~ 50.62.35.225:53638 | 0.227 | Scottsdale | AZ | 85260 | United States | Checked at vn5socks.net
      LIVE ~ 107.170.7.132:47810 | 0.25 | Unknown | Unknown | Unknown | Unknown | Checked at vn5socks.net
      LIVE ~ 165.227.113.239:2018 | 0.232 | Santa Cruz | CA | 95060 | United States | Checked at vn5socks.net
      LIVE ~ 80.211.146.160:5636 | 0.276 | Unknown | Unknown | Unknown | Denmark | Checked at vn5socks.net
      LIVE ~ 200.37.7.75:9999 | 0.347 | Lima | 15 | Unknown | Peru | Checked at vn5socks.net
      LIVE ~ 165.227.52.169:2018 | 0.188 | Santa Cruz | CA | 95060 | United States | Checked at vn5socks.net
      LIVE ~ 45.55.169.78:64486 | 0.259 | Unknown | Unknown | Unknown | Unknown | Checked at vn5socks.net
      LIVE ~ 45.55.169.78:19556 | 0.259 | Unknown | Unknown | Unknown | Unknown | Checked at vn5socks.net
      LIVE ~ 104.168.127.225:2018 | 0.283 | Unknown | Unknown | Unknown | Unknown | Checked at vn5socks.net
      LIVE ~ 162.243.14.144:2182 | 0.241 | Unknown | Unknown | Unknown | Unknown | Checked at vn5socks.net
      LIVE ~ 45.55.169.78:9467 | 0.264 | Unknown | Unknown | Unknown | Unknown | Checked at vn5socks.net
      LIVE ~ 216.187.82.76:1922 | 0.276 | Unknown | Unknown | Unknown | Canada | Checked at vn5socks.net
      LIVE ~ 50.63.13.254:37554 | 0.221 | Scottsdale | AZ | 85260 | United States | Checked at vn5socks.net
      LIVE ~ 97.74.230.16:44951 | 0.195 | Scottsdale | AZ | 85260 | United States | Checked at vn5socks.net
    • tisocks
      SOCKS Proxy List by Tisocks.net
      If you Need Socks5 , Please visit service and add fund via PM , BTC WMZ , WEX . Thanks all!!
      Add fund : https://tisocks.net/addfund
      Check socks5 Online here : https://checksocks5.com
      LIVE | 192.169.232.12:9295 | 0.234 | SOCKS5 | Arizona | 85260 | ip-192-169-232-12.ip.secureserver.net | United States | Checked at https://tisocks.net
      LIVE | 192.169.250.198:40759 | 0.232 | SOCKS5 | Arizona | 85260 | ip-192-169-250-198.ip.secureserver.net | United States | Checked at https://tisocks.net
      LIVE | 181.225.99.251:9999 | 0.355 | SOCKS5 | Unknow | Unknow | azteca-comunicaciones.com | Colombia | Checked at https://tisocks.net
      LIVE | 132.148.129.183:33814 | 0.331 | SOCKS5 | Arizona | 85260 | ip-132-148-129-183.ip.secureserver.net | United States | Checked at https://tisocks.net
      LIVE | 84.21.102.89:9999 | 0.505 | SOCKS5 | Vysocina | 592 42 | cl084021102089.unet.cz | Czech Republic | Checked at https://tisocks.net
      LIVE | 46.151.104.160:9999 | 0.526 | SOCKS5 | Moskva | 141342 | 46-151-104-160.telecombis.ru | Russian Federation | Checked at https://tisocks.net
      LIVE | 195.123.210.73:443 | 0.51 | SOCKS5 | Unknow | Unknow | kostelvania.uaserver2 | Latvia | Checked at https://tisocks.net
      LIVE | 109.106.136.6:9999 | 0.554 | SOCKS5 | Voronezh | 394000 | N/A | Russian Federation | Checked at https://tisocks.net
      LIVE | 88.203.36.209:9999 | 0.516 | SOCKS5 | Unknow | QRM | c36-209.i05-10.onvol.net | Malta | Checked at https://tisocks.net
      LIVE | 165.98.96.126:9999 | 0.395 | SOCKS5 | Managua | Unknow | ip-96-126.amnet.com.ni | Nicaragua | Checked at https://tisocks.net
      LIVE | 185.156.232.228:9999 | 0.556 | SOCKS5 | Puglia | 71011 | N/A | Italy | Checked at https://tisocks.net
      LIVE | 206.223.246.71:42599 | 0.094 | SOCKS5 | Unknow | Unknow | | Unknow | Checked at https://tisocks.net
      LIVE | 202.61.121.145:9999 | 1.025 | SOCKS5 | Tamil Nadu | 601301 | N/A | India | Checked at https://tisocks.net
      LIVE | 178.32.207.56:55678 | 0.235 | SOCKS5 | Texas | 79022 | N/A | United States | Checked at https://tisocks.net
      LIVE | 157.119.225.225:9999 | 1.09 | SOCKS5 | Rajasthan | 321001 | N/A | India | Checked at https://tisocks.net
       
    • shopsocks5.com
      [Shopsocks5.com] Service Socks5 Cheap
      Payment Instantly Perfectmoney, Bitcoin, Wmtransfer, BTC-E ( Please click Buy Socks )
      Check Socks Online  http://shopsocks5.com/check/




        Live | 45.55.169.78:19556 | United States | New York | NY | 10118 | Checked at Shopsocks5.com Live | 80.211.146.160:5636 | Denmark | Unknown | Unknown | Unknown | Checked at Shopsocks5.com Live | 97.74.230.16:44951 | United States | Scottsdale | AZ | 85260 | Checked at Shopsocks5.com Live | 118.139.176.242:1197 | Singapore | Singapore | 00 | Unknown | Checked at Shopsocks5.com Live | 45.55.169.78:64486 | United States | New York | NY | 10118 | Checked at Shopsocks5.com Live | 222.165.225.245:18959 | Indonesia | Jakarta | 04 | Unknown | Checked at Shopsocks5.com Live | 216.187.82.76:1922 | United States | New York | NY | 10004 | Checked at Shopsocks5.com Live | 97.74.230.16:36446 | United States | Scottsdale | AZ | 85260 | Checked at Shopsocks5.com Live | 107.170.254.167:40370 | United States | San Francisco | CA | 94101 | Checked at Shopsocks5.com Live | 60.248.223.190:3021 | Taiwan | Unknown | Unknown | Unknown | Checked at Shopsocks5.com Live | 109.104.79.203:14541 | United Kingdom | Unknown | Unknown | Unknown | Checked at Shopsocks5.com Live | 125.227.69.220:3265 | Taiwan | Unknown | Unknown | Unknown | Checked at Shopsocks5.com Live | 116.212.152.103:60595 | Cambodia | Phnom Penh | 11 | Unknown | Checked at Shopsocks5.com Live | 185.222.202.130:3128 | Unknown | Unknown | Unknown | Unknown | Checked at Shopsocks5.com Live | 138.68.67.164:10800 | United States | Wilmington | DE | 19880 | Checked at Shopsocks5.com Live | 69.12.65.105:8912 | United States | Los Angeles | CA | 90014 | Checked at Shopsocks5.com
    • Black
      Δεν λειτουργεί το link, μήπως τα έχει κάποιος? Ευχαριστώ.  
    • dionysos
      ΣΑΡΑΝΤΑ ΠΡΑΓΜΑΤΑ ΠΟΥ ΘΕΛΩ ΝΑ ΣΟΥ ΠΩ ΑΛΙΣ ΚΑΙΠΕΡΣ - KUIPERS ALICE


      Η ΚΟΡΥΦΑΙΑ ΣΥΜΒΟΥΛΗ: ΟΡΙΣΜΕΝΑ ΜΥΣΤΙΚΑ ΕΙΝΑΙ ΑΔΥΝΑΤΟΝ ΝΑ ΤΑ ΚΡΑΤΗΣΕΙΣ Η Έιμι φαίνεται να έχει την τέλεια ζωή: γονείς που την καταλαβαίνουν, ένα καυτό αγόρι και την καλύτερη κολλητή. Κρατάει και μια διαδικτυακή στήλη με συμβουλές προς τους εφήβους προκειμένου να πάρουν τον έλεγχο της ζωής τους. Όταν όμως στο σχολείο κάνει την εμφάνισή του ένας σούπερ τύπος, η Έιμι είναι ανίκανη να ακολουθήσει τις ίδιες τις συμβουλές της. Ο Πιτ είναι το κλασικό «κακό» αγόρι. Είναι όλα όσα δεν είναι η Έιμι: άγριος, χωρίς φιλοδοξίες και λίγο επικίνδυνος. Και παρόλο που η Έιμι τα συνειδητοποιεί όλα αυτά, δεν μπορεί να κρατηθεί μακριά του. Και όσο πιο πολύ κολλάει μαζί του, τόσο περισσότερο ραγίζει η σχέση της με τον Γκρίφιν. Ένα λάθος, μια στιγμιαία απώλεια ελέγχου αρκεί για να καταστρέψει για πάντα το μέλλον της…


      Συγγραφέας: Kuipers Alice
      Ξενόγλωσσος Τίτλος: 40 THINGS I WANT TO TELL YOU
      Εκδότης: Ψυχογιός
      Γλώσσα: ελληνικά
      Μεταφραστής: ΜΠΟΥΜΠΟΥΡΗ ΡΑΝΙΑ
      Έτος Έκδοσης: 2013
      Σελίδες: 181
      Μορφή αρχείου: pdf
      Μέγεθος αρχείου zip: 12.0MB



      [hide] http://www.easybytez.com/zx4tabedntb3 [/hide]

Footer title

This content can be configured within your theme settings in your ACP. You can add any HTML including images, paragraphs and lists.

Footer title

This is an example of a list.

Footer title

This content can be configured within your theme settings in your ACP. You can add any HTML including images, paragraphs and lists.

Footer title

This content can be configured within your theme settings in your ACP. You can add any HTML including images, paragraphs and lists.

×