Today, we will be continuing with our exploration of Hack the Box (HTB) machines, as seen in previous articles. This walkthrough is of an HTB machine named Wall.
HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform.
Note: Only write-ups of retired HTB machines are allowed. The machine in this article, named Wall, is retired.
Let’s start with this machine.
1. Download the VPN pack for the individual user and use the guidelines to log into the HTB VPN.
2. The “Wall” machine IP is 10.10.10.157.
3. We will adopt the usual methodology of performing penetration testing as we’ve used before. Let’s start with enumeration in order to learn as much about the machine as possible.
4. As usual, we’ll start with the nmap scan to gather more information about the services running on this machine. [CLICK IMAGES TO ENLARGE]
<<nmap -sC -sV -oA Wall 10.10.10.157>>
5. As we can see, ports 22 and 80 are open. Let’s start enumeration on port 80.
6. Below is an Ubuntu landing page.
7. Let’s start to enumerate the directories on this box. We’ll use dirb.
8. One interesting directory is called “monitoring.” Let’s start enumerating the /monitoring endpoint. Below is the authentication dialog that we get for this page.
9. Let’s view the request on Burp and start playing with the request verbs. Changing the request from GET to POST gives us a different page.
10. Rendering the content gives us another URL: /centreon.