ethicalhacker.tech

HackTheBox - Dog Writeup

Wed, 07 May 2025 20:24:00 +0100

This machine is an easy rated Linux machine. This writeup will demonstrate how I was able to run commands in the context of the root user. This box involves reading sensitive data found in an exposed git repository leading to access to an admin user on BackdropCMS. With these privileges we are able to find an exploit that allows us to build a malicious module in the form of a web shell. This is used to gain an initial foothold with a reverse shell. Taking a list of users and reusing the password we have will allow logging in as the user johncusack. After accessing this account and observing the sudo permissions, it is seen that it can run a binary called bee with sudo permission. Using this tool with sudo access allows an attacker to run commands in the context of the root user.

HackTheBox - Administrator Writeup

Mon, 05 May 2025 19:27:25 +0100

This machine is a retired medium rated Windows box. We are given the credentials to a user account that will give us our initial foothold. After our initial scanning we can see the services that are running and we get an easy access point using the olivia account over WinRM. Following on from here, we will need to use SharpHound as a collector for Bloodhound and do some AD enumeration. This will become important as we will need to come back to refer to it several times. In this box we will see the abuse of GenericAll, ForceChangePassword, GenericWrite, Kerberoasting, and DCSync for our AD attack vectors. We will also see some cracking of a password manager file in a psafe3 format. This box required quite a few user pivots before getting to the domain administrator.

HackTheBox - Monitored Writeup

Fri, 26 Jul 2024 16:13:25 +0100

Monitored is a medium rated retired Linux machine on HackTheBox. In this walkthough I demonstrate how I was able to obtain root access to this machine. This box will require you to use SNMP to get credentials for a disabled account. You will then need to abuse the API to get an authentication token. Next, find the right CVE to steal the administrator’s API key. With this key you can start adding users with admin access. Built in functionality can be abused to get a reverse shell. With this reverse shell you can then escalate your privileges by abusing the sudo permissions provided to the user account.

HackTheBox - PermX Writeup

Mon, 08 Jul 2024 08:38:02 +0100

PermX is an easy rated Linux machine from week 12 of HackTheBox season 5 “Anomalies”. In this walkthrough, I will demonstrate how I was able to obtain root access to this machine. This box was a standard easy rated box with a privilege escalation vector that required a bit of thinking. Subdomain enumeration uncovers a Chamilo LMS instance vulnerable to CVE-2023-4226, allowing unauthenticated file upload and a reverse shell as www-data. Linpeas reveals credentials in a Chamilo config file, granting SSH access as mtz. A sudoable script using setfacl is abused via a symbolic link to /etc/sudoers, granting mtz unrestricted sudo and root access.

HackTheBox - Blazorized Writeup

Sun, 07 Jul 2024 09:06:44 +0100

Blazorized was a medium rated Windows machine from week 11 of HackTheBox season 5 “Anomalies”. This rating was later changed to hard when it was retired. In this walkthrough, I will demonstrate how I was able to obtain root access to this machine. This box proved to be quite difficult for me and required very good enumeration.

Blazorized is a machine running Windows and is functioning as a domain controller. On this machine, we find a Blazor .NET WASM application. We are able to obtain a DLL, use AvaloniaILSpy to read the contents of it, and write a Python script to create a “superadmin” JWT and access the admin area of the website. From here we will see that we can abuse a SQL injection vulnerability to gain a reverse shell. We then abuse a WriteSPN privilege to pivot to another user using a Kerberoast attack. We will then pivot into another user account by abusing permissions to write a login script that will trigger a reverse shell. Finally, we will use the abuse a DCSync privilege using mimikatz to dump out the administrator’s NTLM hash and get a shell as the administrator.

DamCTF24 - Writeup

Sun, 07 Apr 2024 22:57:03 +0100

These writeups are for the OSINT challenges I solved while competing in DamCTF 2024 with my team, Bonzi_Brigade. This event took place from 06th April - 08th April. Our team scored 1380 points in total and came 27th out of 207 teams.

asparagus?

Authors: alienfoetus, WholeWheatBagels

Solves: 44

Description: Last spring break, we took a short trip to see these special flowers! Can you find where we were?

Challenge image:

Since the framing of the challenge is the Oregon State University students going on a trip for spring break, I assumed that they would still be in Oregon. I started off by searching for wild purple flowers in Oregon. The ones shown in the screenshot below look to be similar to those found in the provided picture:

UTCTF 2024 - Writeups

Wed, 03 Apr 2024 21:38:20 +0100

These writeups are for the OSINT challenges I solved while competing in UTCTF 2024 with my team, Bonzi_Brigade. This event took place from 30th March - 01st April. Our team scored 4045 points in total and came 135th our of 854 teams.

OSINT 1

Author: mzone (@mzone on discord)

Solves: 202

Description: It seems like companies have document leaks all the time nowadays. I wonder if this company has any. (NOTE: It turns out there’s also an actual company named Kakuu in Japan. The real company is not in scope. Please don’t try and hack them.)

About

Mon, 01 Jan 0001 00:00:00 +0000

Background

Hi, I'm Kyle. I've been interested in computers since I was a teenager, like many others this started with gaming. This led me to programming and networking. What started as curiosity turned into a computer science degree and a cyber security career. In my professional work, I am a member of a Red Team carrying out offensive security engagements. In my spare time, I like to work on my home lab environment, continue to develop my offensive security skills in my home lab or on platforms like HackTheBox, and I still play videogames when time permits.

Kerberoasting

Mon, 01 Jan 0001 00:00:00 +0000

what is it?

Kerberoasting is an Active Directory attack that allows any authenticated domain user to request Kerberos service tickets (TGS) for accounts that have a Service Principal Name (SPN) set. Those tickets are encrypted with the service account’s NTLM hash, meaning they can be taken offline and cracked without any further interaction with the domain controller.

The attack is particularly effective because SPNs are often set on service accounts with weak passwords, and requesting a TGS is a normal, logged operation that blends in with everyday traffic.

Pass the Hash

Mon, 01 Jan 0001 00:00:00 +0000

what is it?

Pass the Hash (PtH) is a technique that uses a captured NTLM hash to authenticate as a user without knowing their plaintext password. Because NTLM authentication uses the hash directly as a credential, an attacker with a valid hash can authenticate to any service that accepts NTLM — SMB, WMI, RDP (in some configs), and more.

requirements

A captured NTLM hash (from mimikatz, secretsdump, or similar)
Network access to the target
Target must accept NTLM authentication (most Windows environments do)

attack steps

1. obtain a hash

1# dump from lsass on a compromised host
2mimikatz # sekurlsa::logonpasswords
3
4# remote dump via impacket
5secretsdump.py domain/user:password@10.0.0.5

2. authenticate with the hash

1# psexec with hash
2psexec.py -hashes :ntlmhash domain/administrator@10.0.0.10
3
4# wmiexec
5wmiexec.py -hashes :ntlmhash domain/administrator@10.0.0.10
6
7# smbclient
8smbclient.py -hashes :ntlmhash domain/administrator@10.0.0.10

detection

Event ID 4624 logon type 3 (network) with NTLM authentication where Kerberos would be expected
Mismatched workstation names or unusual source IPs for privileged accounts

mitigation

Enable Protected Users security group — prevents NTLM auth for member accounts
Disable NTLM where possible via GPO (Network security: Restrict NTLM)
Use Credential Guard to protect lsass from memory reads
Enforce tiered administration to limit where privileged hashes are cached

search

Mon, 01 Jan 0001 00:00:00 +0000