HackTheBox - Lame - Walkthrough

Key Takeaways

[Music] hey guys hackers Floyd here back again with another video and welcome to the long-awaited and highly requested hack the box series and yeah welcome so a few things I want to point out before we actually move forward with today's video and one of them is one of the reasons why I'm doing this is because you guys requested to do this as I mentioned for a channel or an engaged community like the way we have right over here I always prefer using Vaughn up because it is a well it offers a solution where you guys can go and try it out for yourself whereas with hack the box I actually have to make videos of machines that are already retired and for some people you really do not want to pay for the VIP subscription and that's not for everyone but a lot of you have actually told me this and that's why I also you know went with vulnerable but for those of you requesting me to use hack the box as well here it is and as I've mentioned before and I mention again the purpose of my CTF videos on this channel is not to show both my skills or to sort of go through the machine as quickly as possible it is to explain some of the concepts you know to this or you know to presently show you these solutions behind problems or to show you the exploits for certain vulnerabilities and to essentially teach you something that's the purpose of my CTF videos so do not take them as me sort of showing my skill I really am NOT interested in that because as I am as I've mentioned before CTF challenges are a good way to learn you know how to use tools and how to essentially get into the mindset of a breaker or person who you essentially tinkers with everything it really is not a representative of your skills in the real world because in the real world you're dealing with very different environments but with that being said enough of my blabbering and let's get started so I'm starting off with the oldest one and I'm just going to go through them chronologically or you guys can actually post which one you wanted I run a poll on Twitter and this was the first one that you guys recommended and the name is lame alright so I do not think I've done this actually had to create a new account so that I get the VIP subscription and we're gonna get started so I've already run an nmap scan here and I'm just gonna run it for you sorry that is the actual VPN connection let me just open up a terminal here so that we can get started with the CTF challenge so I'm going to be going through this semi life I don't know if I've gone through this box before but we'll see what happens anyway so let's get started here let me just change to my desktop here and let me just catch the results here so the name of the box is lame and if we go through the results my scan was very simple it was a you know banner grabbing scan with the default scripts set to enabled and an aggressive scan and as you can see here we have a port 21 which is FTP and that's running vs FTP t-that is already a vulnerable service it looks like anonymous FTP is allowed so we'll also check that out in a second and we'll see if we can do anything although I doubt it because there is no web server running as far as I've seen we have an SSH port running here which is running which is running a non vulnerable service I'm pretty sure of that OpenSSH has a very few vulnerable services so that also is something that comes with the experience knowing that and we have Samba here which does look like it is running a vulnerable version of vulnerable software version here so we'll also check that out and that is net buyers of course so we'll check that out in a second so let's start off with I need you can see right over here we get the default script results in regards to the to the to the SMB sorry and that as we know is running samba and you have the Samba software version right over here all right so that's pretty much it for the results in regards to nmap if we take a look at the anonymous FTP login first that should yield what exactly is going on here so FTP 10.10 point 10 point 3 and we're logging in alone anonymously so anonymous and I'm just going to enter and login is successful alright so let me just list the files in here we don't get anything here let me just list all files is the current working directory can I go a step back here sorry actually miss type two that I can echo step back no it looks like we are currently in the root directory and there are no other directories yes so it looks like we are locked in to this directory I'm not sure what it is although as I mentioned this would not be very useful but we'll come to see what that is all right so yeah we'll come back to this in a second if we need it well actually I want to go through the results before actually clear that up so so we are running vs FTP D 2.3 where is it let me just see if I can find it sorry there it is up here you have V s tftpd 2.3.4 and I know that is vulnerable through a Metasploit exploit which I'll show you right now if we use such Floyd which is what I recommend a lot because it's just awesome vs FTB 2.3.4 and I search for that you can see we have a backdoor command execution right over here with a Metasploit so MSF DB start let's start the Metasploit database yeah and I will start up the Metasploit console MSF console and we'll search for that exploit so that is V SFTP D 2.3.4 and we'll just give this a second for it to start the Metasploit framework apologies if my virtual machine appears slow so coming back to the whole hack the box are ideas that had with von up they are essentially out there to teach people and I just wanted to put that out there so you guys understand the difference between my channel and others all right so let us search for this right now so search for vsf DB d sorry v SF TBD 2.3.4 3.4 and we hit enter and here it is right over here so let's see if this exploit does work that will be extremely easy so if that works then that's great for us this box I presume is quite easy but we'll get to see that right now so we can get to set the Aros right over here so let's do that right now ah roast is sorry ah roast is 10.10 point point three and I'm going to enter and hopefully you already know the Metasploit syntax this is very basic in terms of using Metasploit as you probably would have seen the commands I'm using our basic the use sets etc so now I'm just going to exploit or you can hit run depending on what you want to do you can also set the port which as we know FTP is configured correctly on this machine so I'm just going to exploit and that's if this exploit is successful we'll give that a few seconds to send the payload to the service here or to the specific port running on the machine we'll give that a second here for some reason it's paused here and there we are so we got the banner here which is telling us I don't think we do we need to enter password so I'm just going to enter which is probably prompting for the login for V SFTP D which means there is a miss configuration error here so yeah exploit completed notation was created that's where let me just run that one more time I think if we login with well it's logged in user three three one alright yeah so it is in a locked-in environment so this exploit I am pretty sure will not work but let's try that one more time anonymous let's see if that works I doubt it really because as you can see the user is specified as something very very different it's user three three one so I thought that's gonna work yeah so that it definitely did not work so let me just stop that right over here and we'll go back and we'll exit from Metasploit the Metasploit framework here of the Metasploit console so I'm just gonna clear this up and let us just explore the results one more time here and let's look at the other services as I mentioned OpenSSH does not seem to have anything vulnerable over there when we talk about Samba I'm pretty sure this is vulnerable so let's perform a search plate for that so we're looking for Samba version 3.0 point 20 let me just copy that right over here and we'll run that search deployed command sorry so exploit and we'll paste that in there and yeah we have the site redirect that's really for web apps as you can see PHP PHP PHP wants more we have a denial-of-service and finally we have one that we're looking for over here and we have a heap overflow I'm pretty sure this one is the one that works that is the username map script which is with Metasploit so let's actually try this right now and we'll search for that as well so yeah it looks like this box is going to be a Metasploit based box and again yeah it looks like it's gonna be an easy one so let's just try this right now and we'll start on Metasploit console apologies if I'm not using Terminator or T bucks I will get that set up I just set up this a virtual machine all right so let's search for this right now so search for sambhar 3.0 point two zero and we're just gonna hit enter right now so just give me a second there and we donate enter and we're looking for the user map script right over here and there it is right over here which as you can see the rank is excellent and yeah this pretty this is a pretty old exploit and we've seen this actually before on Metasploit a ball one I believe no Metasploit able to if I'm not wrong we have seen this is sort of the same configuration so yeah this is really weird I didn't expect this to be the case but anyway it looks like a common configuration for many CTF challenges online so let's use this exploit here hopefully this one works so we're just gonna show the options here I'm gonna set our host here set our hosts and we're gonna set it to 1000 point 10.10 0.3 and gonna enter the port was set correctly and that is we have a net bias running over there so yeah over port 139 so we're just gonna leave that as it is and where it is gonna exploit and I'm gonna hit enter and we're just going to give that a few seconds to run the exploit and yeah it looks like it was able to send it so started the reverse TCP double Handler on my local IP which is provided to me by hack the Box accepted the first client connection second command echo it looks like it sent it the other we are writing socket a and write it into socket be reading so we are receiving and we got what appears to be the Michelle I'm not mistaken let me just see if I can actually hit ya there we are so we do have a shell so let me just let me just see if I can get a shell yeah it does look like it has Python over here which is excellent fantastic so we do have Python oh yeah there we are so we did get a shell here through Python which is awesome so let me just hit ID and as you can see we are root so yeah we do not have to perform any privilege escalation so quite an easy box what is our current working directory so let us go and get the flags which for hack the box our root and I'm not sure the other one is but I know it's usually found in home let me just see where the home is so see the macos i believe it looks like the FTP directory was locked into there which is interesting but we already have got an exploit so I'll also be looking at whether we can exploit it through FTP which is also quite interesting so we look at that yeah user dot txt and root dot txt so let me just print out the user here so you guys can actually see that it does work user dot txt and we call the user there let's go back home and the directory is not set oh yeah we have to go step back and step back here because we are using Python sorry step back and step back here and we should be back to the home sorry to the root directory so CD root and I'm just going to enter oops sorry about that CD root apologies if I'm miss typing some of the commands my keyboard is quite away from me and we have the root dot txt file right over here so we're just gonna look at the root dot txt and that should give us access there and voila so yeah that was a very very very simple box apologies for that if you guys were expecting something advanced although I am starting chronologically and you can also record recommend to me the ones you want to see the next one that you guys recommended to me was Valentine and they were a few others that were Windows boxes so I'll be taking a look at those ones but that's pretty much gonna be it for this video guys let me know if I made any mistakes or if I missed anything I would really like to know what you guys think given that you've done this box or if you haven't already you can go ahead and get this VIP subscription and you can try it out for yourself that being said the volunteer is going to continue i'm going to start and continue the python and shell scripting series as well as the exploit development series which is something i've been working on for a while now that being said that's going to be it for this video guys thank you so much for watching and I'll be seeing you in the next video peace [Music]