Hong

Hackthebox - Legacy

📅 May 3, 2022 · ☕ 2 min read · 👤 Hong

Legacy is a fairly straightforward beginner-level machine which demonstrates the potential security risks of SMB on Windows. Only one publicly available exploit is required to obtain administrator access.

Hackthebox - Jarvis

📅 Apr 30, 2022 · ☕ 11 min read · 👤 Hong

Jarvis is a medium difficulty Linux box running a web server, which has DoS and brute force protection enabled. A page is found to be vulnerable to SQL injection, which requires manual exploitation. This service allows the writing of a shell to the web root for the foothold. The www user is allowed to execute a script as another user, and the script is vulnerable to command injection. On further enumeration, systemctl is found to have the SUID bit set, which is leveraged to gain a root shell.

Hackthebox - Networked

📅 Apr 26, 2022 · ☕ 4 min read · 👤 Hong

Networked is an Easy difficulty Linux box vulnerable to file upload bypass, leading to code execution. Due to improper sanitization, a crontab running as the user can be exploited to achieve command execution. The user has privileges to execute a network configuration script, which can be leveraged to execute commands as root.

Hackthebox - Friendzone

📅 Apr 23, 2022 · ☕ 12 min read · 👤 Hong

FriendZone is an easy difficulty Linux box which needs fair amount enumeration. By doing a zone transfer vhosts are discovered. There are open shares on samba which provides credentials for an admin panel. From there, an LFI is found which is leveraged to get RCE. A cron is found running which uses a writable module, making it vulnerable to hijacking.

Hackthebox - Irked

📅 Apr 18, 2022 · ☕ 6 min read · 👤 Hong

Irked is a pretty simple and straight-forward box which requires basic enumeration skills. It shows the need to scan all ports on machines and to investigate any out of the place binaries found while enumerating a system.

Hackthebox - Swagshop

📅 Apr 13, 2022 · ☕ 11 min read · 👤 Hong

SwagShop is an easy difficulty linux box running an old version of Magento. The version is vulnerable to SQLi and RCE leading to a shell. The www user can use vim in the context of root which can abused to execute commands.

Hackthebox - Tartarsauce

📅 Apr 13, 2022 · ☕ 9 min read · 👤 Hong

TartarSauce is a fairly challenging box that highlights the importance of a broad remote enumeration instead of focusing on obvious but potentially less fruitful attack vectors. It features a quite realistic privilege escalation requiring abuses of the tar command. Attention to detail when reviewing tool output is beneficial when attempting this machine.

Hackthebox - Sunday

📅 Apr 11, 2022 · ☕ 16 min read · 👤 Hong

Sunday is a fairly simple machine, however it uses fairly old software and can be a bit unpredictable at times. It mainly focuses on exploiting the Finger service as well as the use of weak credentials.