Hack The Box Challenge Series
Three
Hack The Box Challenge Series
Three
Embedded Files
Three
As we progress through Hack The Box challenge series and continue our journey to pawn the machines, our current challenge is named as three.
we press the pawn machine button and get the IP address of our target machine.
Just like any other target, we start by performing NMAP scan.
our results are as followed:
As evident from nmap scan, this IP address is running a website and one port is open for SSH connection.
Looks like we are going to get SSH access to the server.
bb
The email found on the website is mail@thetoppers.htb showing that the connected domain is thetoppers.htb.
Since its another domain, which is not appearing through normal browser search, we will try to access it through adding a manual DNS entry into /etc/hosts/ file.
Command: echo '10.129.153.65 thetoppers.htb' | sudo tee -a /etc/hosts
The above command is running two command simultaneously through pipeline |.
tee is showing that we are telling the terminal to make insertion to the END of file(/etc/hosts).
-a is telling it to append the inserted text (neither over-writing nor deleting the previous text in the file).
Now the ip address resolves to the DNS address we inserted to /etc/hosts file as shown in the following snapshot.
Now that we have a domain, its time to enumerate its subdomains.
Subdomains can be enumerated through Gobuster(vhost mode), sublist3r, Wfuzz, feroxbuster, Fuff or any other tool that be found through a simple simple google/chatgpt search (hey Google, give me tools list to find subdomains of a website/domain and their usage commands).
in case of any tool, we will need a pre-compliled list of words for fuzzing purpose.
Here i'm downloading the latest lists through seclists.
Command: sudo apt install seclists
or we can get it cloned through Git
Command: git clone https://github.com/danielmiessler/SecLists.git
For a better usage, i'm moving this folder to /opt/ directory.
Here, the following snippet is from attack machine, the above ones showing installations of Seclists were from my personal VM, so IP address or path can vary slightly. Our objective is to get every things on our hands.
khtm, khllass
no actual results
perhaps we have to find S3 buckets by just hit and trial because no subdomain search resulted in s2 bucket. so i will manually enter the address into my address bar to see the results.
But to see the results, we will also have to enter this entry into /etc/hosts file.
Traversing to cmd= cat /var/www/flag.txt
Page updated
Google Sites
Report abuse