Login

Register

Login

Register

#cybersecurity | #hackerspace |

Hack the Box (HTB) machines walkthrough series — Wall


Today, we will be continuing with our exploration of Hack the Box (HTB) machines, as seen in previous articles. This walkthrough is of an HTB machine named Wall.

HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform.

The walkthrough

Note: Only write-ups of retired HTB machines are allowed. The machine in this article, named Wall, is retired.

Let’s start with this machine.

1. Download the VPN pack for the individual user and use the guidelines to log into the HTB VPN.

2. The “Wall” machine IP is 10.10.10.157.

3. We will adopt the usual methodology of performing penetration testing as we’ve used before. Let’s start with enumeration in order to learn as much about the machine as possible.

4. As usual, we’ll start with the nmap scan to gather more information about the services running on this machine. [CLICK IMAGES TO ENLARGE]
<<nmap -sC -sV -oA Wall 10.10.10.157>>

5. As we can see, ports 22 and 80 are open. Let’s start enumeration on port 80.

6. Below is an Ubuntu landing page.

https://securityboulevard.com/

7. Let’s start to enumerate the directories on this box. We’ll use dirb.
<<dirb http://10.10.10.157>>

https://securityboulevard.com/

8. One interesting directory is called “monitoring.” Let’s start enumerating the /monitoring endpoint. Below is the authentication dialog that we get for this page.

https://securityboulevard.com/

9. Let’s view the request on Burp and start playing with the request verbs. Changing the request from GET to POST gives us a different page.

https://securityboulevard.com/

10. Rendering the content gives us another URL: /centreon.

https://securityboulevard.com/

(Read more…)



Source link

Leave a Reply

Shqip Shqip አማርኛ አማርኛ العربية العربية English English Français Français Deutsch Deutsch Português Português Русский Русский Español Español

National Cyber Security Consulting App

 https://apps.apple.com/us/app/id1521390354

https://play.google.com/store/apps/details?id=nationalcybersecuritycom.wpapp


NATIONAL CYBER SECURITY RADIO
[spreaker type=player resource="show_id=4560538" width="100%" height="550px" theme="light" playlist="show" playlist-continuous="true" autoplay="false" live-autoplay="false" chapters-image="true" episode-image-position="left" hide-logo="false" hide-likes="false" hide-comments="false" hide-sharing="false" hide-download="true"]
HACKER FOR HIRE MURDERS
 [spreaker type=player resource="show_id=4569966" width="100%" height="350px" theme="light" playlist="show" playlist-continuous="true" autoplay="false" live-autoplay="false" chapters-image="true" episode-image-position="left" hide-logo="false" hide-likes="false" hide-comments="false" hide-sharing="false" hide-download="true"]

ALEXA “OPEN NATIONAL CYBER SECURITY RADIO”

National Cyber Security Radio (Podcast) is now available for Alexa.  If you don't have an Alexa device, you can download the Alexa App for free for Google and Apple devices.   

nationalcybersecurity.com

FREE
VIEW