Microsoft office 2016 professional plus configures each time you start free.Transfer or Install Office on a New PC
This account has full sudo rights, providing root access. BountyHunter has a really nice simple XXE vulnerability in a webpage that provides access to files on the host. Check them out, and subscribe on YouTube to get notified as I add more videos. The rest of the box is about Ansible, the automation platform. PivotAPI had so many steps. This user has access to some binaries related to managing a database. In there, another binary that I can use to fetch additional creds.
The first was used to download and run a DLL malware, and the second was the C2 communications of that malware. The malware and the initial downloader user Windows Delta patches to exchange information. There are a lot of templating engines that Express can use, but this one is using Nunchucks. However, AppArmor is blocking the simple exploitation, and will need to be bypassed to get a root shell.
If I can figure out the key to give the decrypter, it will decrypt the files, one of which contains the flag. Explore is the first Android box on HTB. Once I have that, I can check for bytes that produce valid JavaScript, and find the key. The result is some obfuscated JavaScript that comes out to be doing the same thing again, on the second half of the key.
Once I have both halves, I can get the flag or put the key in and get the page to give it to me. With that stream, I can decrypt and get the files, which provide a series of CTF puzzles to get a password which I can give to the binary and get the final flag.
It starts with a giant function that has thousands move instructions setting a single byte at a time into a buffer and then calling it. That buffer is shellcode that loads and calls a DLL. In that DLL, there are a series of checks that cause the program to exit different file name, network connection , before the flag bytes are eventually decoded from a PNG resource in the original binary, and then scrambled into an order only observable in debug.
It has a lot of layer data, but most the layers are not referenced in the manifest. The image does have a single ELF executable in it. Spider was all about classic attacks in unusual places. The last challenge in Flare-On 8 was probably not harder than the ninth one, but it might have been the one I had the most fun attacking. Dynstr was a super neat concept based around a dynamic DNS provider. Monitors starts off with a WordPress blog that is vulnerable to a local file include vulnerability that allows me to read files from system.
Cap provided a chance to exploit two simple yet interesting capabilities. My favorite part about Jarmis was that it is centered around this really neat technology used to fingerprint and identify TLS servers. Pit used SNMP in two different ways.
Sink was an amazing box touching on two major exploitation concepts. It is a qualifier box, meant to be easy and help select the top ten to compete later this month. Schooled starts with a string of exploits to gain more and more privilege in a Moodle instance, eventually leading to a malicious plugin upload that provides a webshell.
This user can run the FreeBSD package manager, pkg, as root, and can also write to the hosts file. Unobtainium was the first box on HackTheBox to play with Kubernetes, a technology for deploying and managing containers. It also has a Electron application to reverse, which allows for multiple exploits against the server, first local file include, then prototype pollution, and finally command injection. Once the competition is over, HTB put it out for all of us to play.
This version happens to be the version that had a backdoor inserted into it when the PHP development servers were hacked in March For root, the user can run knife as root. At the time of release, there was no GTFObins page for knife, so the challenge required reading the docs to find a way to run arbitrary code. That page now exists. Recently, he did an analysis of an email with an HTML attachment which presented as a fake Microsoft login page.
When a victim enters creds, the page would send them to www. John looked at bit at the registration information on the domain, but I wanted to dive a bit deeper, specifically using RiskIQ and Maltego. Proper was a fascinating Windows box with three fascinating stages. I get to play with the eval option for SQLmap, as well as show some manual scripting to do it. The centerpiece is a crazy cross-site scripting attack through a password reset interface using DNS to redirect the admin to a site I control to then have them register an account for me.
Love was a solid easy-difficulty Windows box, with three stages. Argageddon was a box targeted at beginners. The foothold exploit, Drupalgeddon2 has many public exploit scripts that can be used to upload a webshell and run commands. Breadcrumbs starts with a fair amount of web enumeration and working to get little bits of additional access. With both of those cookies, I gain administrator access to the site, and can upload a webshell after bypassing some filtering and Windows Defender.
Atom was a box that involved insecure permissions on an update server, which allowed me to write a malicious payload to that server and get execution when an Electron App tried to update from my host. In Beyond Root, a quick visit back to PrintNightmare.
CVE, or PrintNightmare, is a vulnerability in the Windows Print Spooler that allows for a low priv user to escalate to administrator on a local box or on a remote server. This is especially bad because it is not uncommon for Domain Controllers to have an exposed print spooler, and thus, this exploit can take an attacker from low-priv user to domain admin.
There are a few proof of concept exploits out there, and I wanted to give them a spin an old HackTheBox machine. Ophiuchi presented two interesting attacks. Then there was a somewhat contrived challenge that forced me to generate web assembly or WASM code to get execution of a Bash script.
The password gets me into the admin panel, where I can edit a plugin or write a new plugin to get execution. Tentacle was a box of two halves. The second half was about abusing Kerberos in a Linux environment.
That user can access the KeyTab file, which allows them to administer the domain, and provides root access. In Beyond Root, a dive too deep into the rabbit hole of understanding the KeyTab file. I can also use those passwords to access the admin panel of the Joomla container, where I can then get RCE and a shell.
Tenet provided a very straight-forward deserialization attack to get a foothold and a race-condition attack to get root.
Both are the kinds of attacks seem more commonly on hard- and insane-rated boxes, but at a medium difficult here. From the time I first heard about the command injection vulnerability in msfvenom, I wanted to make a box themed around a novice hacker and try to incorporate it. In Beyond Root, a look at some of the automations I put in place for the box. I can use these groups to exploit the IIS service and how it manages the website running as root with a timing attack that will allow me to slip my own code into the site and execute it.
There I have access to a form that can submit cereal flavor requests. That was made more tricky because the serverside code had logic in place to break payloads generated by YSoSerial. That user has SeImpersonate. There were a couple things to look out for along the way.
This means that tools like gobuster and feroxbuster miss it in their default state. Root is a simple GTFObin in perl. Delivery is a easy-rated box that I found very beginner friendly. The box presents a helpdesk and an instance of Mattermost.
By creating a ticket at the helpdesk, I get an email that I can use to update the ticket. Kotarak was an old box that I had a really fun time replaying for a writeup. It starts with an SSRF that allows me to find additional webservers on ports only listening on localhost.
From there, I can access files from an old Windows pentest to include an ntds. The root flag is actually in a container that is using Wget to request a file every two minutes. I wanted to dive into them and see what was happening under the hood.
And it really is one of the easiest boxes on the platform. The root first blood went in two minutes. Attended was really hard. At the time of writing three days before it retires, just over people have rooted it, making it the least rooted box on HackTheBox. It starts with a phishing exercise where hints betray that the user will open a text file in Vim, opening them to the Vim modelines exploit to get command execution.
I showed how my PHP webshell will show up there, and the index page seems to always be there. Sharp was all about C and. It started with a PortableKanban config. At the time of release, there was no public scripts decrypting the database, so it involved reverse engineering a real. NET binary. NET remoting service with a serialized payload to get shell as user. Toolbox is a machine that released directly into retired as a part of the Containers and Pivoting Track on HackTheBox.
Bucket is a pentest against an Amazon AWS stack. As the name hints at, Laboratory is largely about exploiting a GitLab instance. APT was a clinic in finding little things to exploit in a Windows host. With that hash, I can access the registry and find additional creds that provide WinRM access. Time is a straight forward box with two steps and low enumeration. The first step involves looking at the error code coming off a web application and some Googling to find an associated CVE.
In Beyond Root, I look at the webserver and if I could write a file in the webroot, and also at handling the initial short-lived shell I got from the Systemd timer. That user can doas like sudo on BSD arbitrary commands as root, the password is needed. CrossFit is all about chaining attacks together to get the target to do my bidding. It starts with a cross-site scripting XSS attack against a website. The site detects the attack, and forwards my user agent to the admins to investigation.
An XSS payload in the user-agent will trigger, giving some access there. The first is a remote code execution vulnerability in the HttpFileServer software. I got hung up for a bit not realizing my shell was running in a bit process, causing my kernel exploits to fail. From there I need to break out of a JEA limited PowerShell, find creds to another account, and trick a custom command from that account into reading root.
Sense is a box my notes show I solved almost exactly three years ago. That user shares an SSH key with the next user on the box.
At least not on IPv4. HackTheBox releases a new training product, Academy, in the most HackTheBox way possible - By putting out a vulnerable version of it to hack on.
I can use that to create a serialized payload to submit as an HTTP header or cookie to get execution. Even when it was released there were many ways to own Beep. Looking a the timestamps on my notes, I completed Beep in August , so this writeup will be a mix of those plus new explorations. The box is centered around PBX software.
Feline was another Tomcat box, this time exploiting a neat CVE that allowed me to upload a malcious serialized payload and then trigger it by giving a cookie that points the session to that file. The rest of the box focuses on Salt Stack, an IT automation platform. My foothold shell is on the main host, but Salt is running in a container.
Another box, but this one was a lot of fun. That source allows me to identify a Ruby on Rails deserialization exploit that provides code execution. It is all about building a wordlist to find a specific image file on the site, and then extracting another list from that image using StegHide. Doctor was about attacking a message board-like website. Worker is all about exploiting an Azure DevOps environment.
RopeTwo, much like Rope, was just a lot of binary exploitation. The binary was very limiting on the way I could interact with the heap, which lead to my having to re-write my exploit from scratch several times. This all takes place at the third annual Kringle Con, where the worlds leading security practitioners show up for talks and challenges.
The leet challenges started on day 20, but then followed an additional three hard challenges before the second and final leet one. These were all really good challenges. My favorite was a binary and a PCAP of an attacker exploiting the binary, where I needed to reverse the crypto operations in the binary and the exploit to recover the data that was stolen.
I really liked one that was another polyglot file where an image turned into an HTML page that dropped a Python script which pull out a docker image containing images that contained a flag. Handing it as such allowed me to reverse the code and emulate it to get two flags. Medium continues with another seven challenges over seven days. Hackvent started out early with a -1 day released on 29 November. There were seven easy challenges, including -1, one hidden, and five daily challenges.
My favorite in the group was Chinese Animals, where I spent way more figuring out what was going on after solving than actually solving. Day 25 is an encryption problem using modular arithmetic. The challenge is to find each d. The twist on day 24 is that it takes place on a grid of hexagons, so each tile has six neighbors, and a normal x,y or r,c coordinate system will be very difficult to use.
Today is another game. Today is also the first time this year where I wrote part one, and then completely started over given part two. Both parts came together pretty quickly, though part two had a few places where small mistakes made identifying mistakes difficult. Day 21 was welcome relief after day Day 20 was almost the end of my Advent of Code. I managed to solve part one in 15 minutes, but then part two got me for days.
Another day with a section of convoluted validation rules and a series of items to be validated. It gets slightly more difficult in the second part, where loops are introduced into the rules.
Laser starts without the typical attack paths, offering only SSH and two unusual ports. One of those is a printer, which gives the opportunity to leak data including a print job and the memory with the encryption key for that job. Day 18 is reimplementing a simple math system with addition, multiplication, and parentheses, where the order of operations changes. It was more a case of wrapping your head around the problem and how to organize the data so that you could match keys to values using validity rules and a bunch of examples.
I made a guess that the data might clean up nicely in a certain way, and when it did, it made the second part much easier. Day 15 is a game the elves play, where you have to remember the numbers said in a list, and append the next number based on when it was previously said. It still runs a bit slow in part two, but it works. Part one of day 14 looked to be some basic binary masking and manipulation. But in part two, it got trickier, as now I need to handle Xs in the mask as both 0 and 1, meaning that there would be 2 num X results.
I used a recursive function to generate the list of indexes there. Day 13 is looking at a series of buses that are running on their own time cycles, and trying to find times where the buses arrive in certain patterns. It brings in a somewhat obscure number theory concept called the Chinese Remainder Theorem, which has to do with solving a series of modular linear equations that all equal the same value.
Day 12 is about moving a ship across a coordinate plane using directions and a way point that moves and rotates around the ship. My code gets really ugly today, but it solves. Day 10 is about looking at a list of numbers. Day 9 is two challenges about looking across lists of ints to find pairs or slices with a given sum.
Day 7 gives me a list of bags, and what bags must go into those bags. The two parts are based on looking for what can hold what and how many. Day 6 was another text parsing challenge, breaking the input into groups and then counting across the users within each group. Both parts were similar, with the first counting if any user said yes to a given question, and the latter if every user said yes to a given question.
Python makes this a breeze either way. Unbalanced starts with a Squid proxy and RSync. Looking at the proxy stats, I can find two internal IPs, and guess the existence of a third, which is currently out of order for security fixes.
Day 4 presented another text parsing challenge. In the first part, I just needed to validate if each section contained a specific seven strings, which is easy enough to solve in Python.
For part two, I need to now look at the text following each of these strings, and apply some validation rules. But then I realized I could just write a regex for each validation, and use the same pattern. Advent of code always dives into visual mapping in a way that makes you conceptualize 2D or 3D space and move through it. Day 2 was about processing lines that contained two numbers, a character, and a string which is referred to as a password.
How the numbers and character become a rule is different in parts 1 and 2. There are 25 days to collect 50 stars. For Day 1, the puzzle was basically reading a list of numbers, and looking through them for a pair and a set of three that summed to SneakyMailer starts with web enumeration to find a list of email addresses, which I can use along with SMTP access to send phishing emails. One of the users will click on the link, and return a POST request with their login creds. From there, the exploit script returns an administrator shell.
Intense presented some cool challenges. Tabby was a well designed easy level box that required finding a local file include LFI in a website to leak the credentials for the Tomcat server on that same host.
That user is a member of the lxd group, which allows them to start containers. Just looking at main, it looks like a simple comparison against a static flag. The effectively prevents my debugging the parent for first child, as only one debugger can attach at a time.
It also dropped and installed another DLL, a credential helper. I used kernel debugging to see how the second driver is loaded, and eventually find a password, which I can feed into the credential helper to get the flag.
I spent over two of the six weeks working crackinstaller. Instead of having the decision logic of the computer in the program, it drops an ELF binary to act as the computer, and communicates with it over a unix socket, all of which is possible on Windows with the Windows Subsystem for Linux WSL.
Fuse was all about pulling information out of a printer admin page. RE Crowd was a different kind of reversing challenge. This exploit uses alphanumeric shellcode to run on success. The host then sends another encrypted blob back to the attcker. It really was just a AutoIt script wrapped in a Windows exe.
TKApp was a Tizen mobile application that was made to run on a smart watch. NET dll that drives the application, so I can break it open with dnSpy.
Four variables are initialized through different user actions or different aspects of the files on the watch, and then used to generate a key to decrypt a buffer. In analyzing the VBA, I see more and more hints that something odd is going on. The game was written in Nim lang, and had a lot of complex functions to manage the game.
It was a long way to go, so I patched it to just let me run through blocks and not worry about under vs over. Flare-On 7 got off to an easy start with a Windows executable that was generated with PyGame, and included the Python source. That made this challenge more of a Python source code analysis exercise than a reversing challenge. Initial access requires finding a virtual host with a.
One cracks, providing access to the web dashboard. This user has instructions to send a url over the messaging queue, which will cause the box to download and run a cuberite plugin. Some version enumeration and looking at releases on GitHub shows that this version is vulnerable to a bypass of the bruteforce protections, as well as an upload and execute filter bypass on the PHP site.
Cache rates medium based on number of steps, none of which are particularly challenging. That RCE provides a shell. From there, I can read the current source, and get a password which works for SSH access. Multimaster was a lot of steps, some of which were quite difficult. It truly is a short path to domain admin. Travel was just a great box because it provided a complex and challenging puzzle with new pieces that were fun to explore. JuicyPotato was a go-to exploit whenever I found myself with a Windows shell with SeImpersonatePrivilege, which typically was whenever there was some kind of webserver exploit.
The only exploit on the box was something I remember reading about years ago, where a low level user was allowed to make a privileged Kerberos ticket. The database has domain credentials for a user. Quick was a chance to play with two technologies that I was familiar with, but I had never put hands on with either. In that system, I will exploit an edge side include injection to get execution, and with a bit more work, a shell.
The user path to through the box was relatively easy. Some basic enumeration gives access to a page that will run arbitrary PHP, which provides execution and a shell. People likely rated the box because there was an unintended root using lxd. The intended path was a contrived but interesting pwn challenge that involved three stages of input, the first two exploiting a very short buffer overflow to get access to a longer buffer overflow and eventually a root shell.
Magic has two common steps, a SQLI to bypass login, and a webshell upload with a double extension to bypass filtering. From there I can get a shell, and find creds in the database to switch to user. These scripts are run by root whenever a user logs in. Rooting Joker had three steps. The first was using TFTP to get the Squid Proxy config and creds that allowed access to a webserver listening on localhost that provided a Python console. I also added a cheat sheet since I reference this post too often.
I learned about Chisel from Ippsec, and you can see his using it to solve Reddish in his video. Fatty forced me way out of my comfort zone. The majority of the box was reversing and modifying a Java thick client. First I had to modify the client to get the client to connect. One of the new functions uses serialized objects, which I can exploit using a deserialization attack to get a shell in the container running the server.
Escalation to root attacks a recurring process that is using SCP to copy an archive of log files off the container to the host. I recently ran into a challenge where I was given a Java Jar file that I needed to analyze and patch to exploit.
I was recently talking with some of the folks over at HackTheBox, and they asked my thoughts about Pwnbox. The system is actually quite feature packed. That way, if you should find yourself in need of an attack VM, you have it, and you might even just switch there. This box forced me to gain an understanding, and writing this post cemented that even further. Lazy was a really solid old HackTheBox machine. That access provides an SSH key and a shell.
Cascade was an interesting Windows all about recovering credentials from Windows enumeration. From there, I get a shell and access to a SQLite database and a program that reads and decrypts a password from it.
That password allows access to an account that is a member of the AD Recycle group, which I can use to find a deleted temporary admin account with a password, which still works for the main administrator accoun, providing a shell.
Shrek is another HackTheBox machine that is more a string of challenges as opposed to a box. Credentials for the FTP server are hidden in a chunk of the file at the end. Sauna was a neat chance to play with Windows Active Directory concepts packaged into an easy difficulty box.
Tenten had a lot of the much more CTF-like aspects that were more prevalent in the original HTB machine, like a uploaded hacker image file from which I will extract an SSH private key from it using steganography. I learned a really interesting lesson about wpscan and how to feed it an API key, and got to play with a busted WordPress plugin. Getting a foothold on Book involved identifying and exploiting a few vulnerabilities in a website for a library.
Bank was an pretty straight forward box, though two of the major steps had unintended alternative methods. I can either find creds in a directory of data, or bypass creds all together by looking at the data in the HTTP redirects. ForwardSlash starts with enumeration of a hacked website to identify and exploit at least one of two LFI vulnerabilities directly using filters to base64 encode or using XXE to leak PHP source which includes a password which can be used to get a shell.
Blocky really was an easy box, but did require some discipline when enumerating. PlayerTwo was just a monster of a box. With creds and backup codes, I can log into the site, which has a firmware upload section. The example firmware is signed, but only the first roughly eight thousand bytes.
Some enumeration will lead to a torrent hosting system, where I can upload, and, bypassing filters, get a PHP webshell to run. From there, I will exploit CVE, a vulnerability in the linux authentication system PAM where I can get it to make my current user the owner of any file on the system.
ServMon was an easy Windows box that required two exploits. I can use a directory traversal bug in a NVMS web instance that will allow me to leak those passwords, and use one of them over SSH to get a shell. Endgame XEN is all about owning a small network behind a Citrix virtual desktop environment. For the third week in a row, a Windows box on the easier side of the spectrum with no web server retires.
Monteverde was focused on Azure Active Directory. From there, I can abuse the Azure active directory database to leak the administrator password. Endgame Professional Offensive Operations P. Endgame labs require at least Guru status to attempt though now that P. Next was unique in that it was all about continually increasing SMB access, with a little bit of easy. NET RE thrown in. With access as C. Smith, I can find the debug password for a custom application listening on , and use that to leak another encrypted password.
When this box was first released, there was an error where the first user creds could successfully PSExec.
The attack starts with enumeration of user accounts using Windows RPC, including a list of users and a default password in a comment. That password works for one of the users over WinRM. From there I find the next users creds in a PowerShell transcript file. Grandpa was one of the really early HTB machines. With Metasploit, this box can probably be solved in a few minutes.
Rope was all about binary exploitation. From there, I can use a format string vulnerability to get a shell. Arctic would have been much more interesting if not for the second lag on each HTTP request. There are two different paths to getting a shell, either an unauthenticated file upload, or leaking the login hash, cracking or using it to log in, and then uploading a shell jsp.
Patents was a really tough box, that probably should have been rated insane. In that section, there is a directory traversal vulnerability that allows me to use log poisoning to get execution and a shell in the web docker container. I spent a lot of time trying to get socket reuse shellcode to work, and if I had just tried a reverse shell payload, I would have gotten there a lot sooner. But getting the connection back to me seemed hard.
But I never really looked into how it worked or how I could use it, and it turns out to be super handy and really dead simple. Obscuirt was a medium box that centered on finding bugs in Python implementions of things - a webserver, an encryption scheme, and an SSH client. Two involve an SSH-like script that I can abuse both via a race condition to leak the system hashes and via injection to run a command as root instead of the authed user.
I focused much of my efforts on a section named CovidScammers. It was a really interesting challenge that encompassed forensics, reverseing, programming, fuzzing, and exploitation.
Still, I really enjoyed the challenge and wanted to show the steps up to that point. OpenAdmin provided a straight forward easy box. The database credentials are reused by one of the users. The biggest trick with SolidState was not focusing on the website but rather moving to a vulnerable James mail client. But I will also show how to exploit James using a directory traversal vulnerability to write a bash completion script and then trigger that with a SSH login.
Control was a bit painful for someone not comfortable looking deep at Windows objects and permissions. I can use the webshell to get a shell, and then one of the cracked hashes to pivot to a different user.
Still, there were some really neat attacks. Once I had the users and passwords from the database, password reuse allowed me to SSH as one of the users, and then su to the other. Traverxec was a relatively easy box that involved enumerating and exploiting a less popular webserver, Nostromo. After I put out a Lame write-up yesterday, it was pointed out that I skipped an access path entirely - distcc. Yet another vulnerable service on this box, which, unlike the Samba exploit, provides a shell as a user, providing the opportunity to look for PrivEsc paths.
It does throw one head-fake with a VSFTPd server that is a vulnerable version, but with the box configured to not allow remote exploitation. As www-data, I can access the Restic backup agent as root, and exploit that to get both the root flag and a root ssh key. Sniper involved utilizing a relatively obvious file include vulnerability in a web page to get code execution and then a shell.
The first privesc was a common credential reuse issue. The second involved poisoning a. Most of the time, this is managed by the package management system. When you run apt install x, it may do some of this behind the scenes for you. But there are times when it is really useful to know how to interact with this yourself. Forest is a great example of that. Then I can take advantage of the permissions and accesses of that user to get DCSycn capabilities, allowing me to dump hashes for the administrator user and get a shell as the admin.
Postman was a good mix of easy challenges providing a chance to play with Redis and exploit Webmin. That same password provides access to the Webmin instance, which is running as root, and can be exploited to get a shell. BankRobber was neat because it required exploiting the same exploit twice. I can overwrite that myself to get a shell. Scavenger required a ton of enumeration, and I was able to solve it without ever getting a typical shell. The box is all about enumerating the different sites on the box and using an SQL injection in whois to get them all , and finding one is hacked and a webshell is left behind.
Json involved exploiting a. NET deserialization vulnerability to get initial access, and then going one of three ways to get root. Still, it got patched, and two unintended paths came about as well, and everything turned out ok.
This has now been patched, but I thought it was interesting to see what was configured that allowed this non-admin user to get a shell with PSExec. AI was a really clever box themed after smart speakers like Echo and Google Home.
Player involved a lot of recon, and pulling together pieces to go down multiple different paths to user and root. I can use that information to get credentials where I can SSH, but only with a very limited shell. However, I can use an SSH exploit to get code execution that provides limited and partial file read, which leads to more credentials. Those credentials are good for a Codiad instance running on another of the virtual hosts, which allows me to get a shell as www-data.
It all takes place at the second annual Kringle Con, where the worlds leading security practitioners show up to hear talks and solve puzzles. While last year really started the trend of defensive themed challenges, had a ton of interesting defensive challenges, with hands on with machine learning as well as tools like Splunk and Graylog. Bitlab was a box centered around automation of things, even if the series challenges were each rather unrealistic. It starts with a Gitlab instance where the help link has been changed to give access to javascript encoded credentials.
So I can add a webshell and get access to the box. Craft was a really well designed medium box, with lots of interesting things to poke at, none of which were too difficult. There were only three leet challenges, but they were not trivial, and IOT focused. The hard levels of Hackvent conitnued with more web hacking, reverse engineering, crypto, and an esoteric programming language. In the reversing challenges, there was not only an iPhone debian package, but also a PS4 update file.
The medium levels brought the first reverse enginnering challenges, the first web hacking challenges, some image manipulation, and of course, some obfuscated Perl. Hackvent is a fun CTF, offering challenges that start off quite easy and build to much harder over the course of 24 days, with bonus points for submitting the flag within the first 24 hours for each challenge.
This was the first year I made it past day 12, and I was excited to finish all the challenges with all time bonuses! The first is the easy challenges, days , which provided some basic image forensics, some interesting file types, an esoteric programming language, and two hidden flags. Day 14 is all about stacking requirements and then working them to understand the inputs required to get the output desired.
Like the first Smasher, Smasher2 was focused on exploitation. It starts with finding a vulnerability in a compiled Python module written in C to get access to an API key.
This challenge was awesome. Day 12 asks me to look at moons and calculate their positions based on a simplified gravity between them. My robot will walk around, reading the current color, submitting that to the program, and getting back the color to paint the current square and instructions for where to move next.
This challenge gives me a map of asteroids. More computer work in day 9, this time adding what is kind of a stack pointer and an opcode to adjust that pointer. Now I can add a relative address mode, getting positions relative to the stack pointer. After spending hours on day 7, I finished day 8 in about 15 minutes. It was simply reading in a series of numbers which represented pixels in various layers in an email. Wall presented a series of challenges wrapped around two public exploits.
The first exploit was a CVE in Centreon software. But to find it, I had to take advantage of a misconfigured webserver that only requests authenticatoin on GET requests, allowing POST requests to proceed, which leads to the path to the Centreon install.
Once I have that, I can get a shell on the box. This was a fun challenge, because it seemed really hard at first, but once I figured out how to think about it, it was quite simple. This was the first time I brought out recurrisive programming this year, and it really fit well.
I solved day 4 much faster than day 3, probably because it moved away from spacial reasoning and just into input validation. I always start to struggle when AOC moves into spacial challenges, and this is where the code starts to get a bit ugly. In this challenge, I have to think about two wires moving across a coordinate plane, and look for positions where they intersect.
This puzzle is to implement a little computer with three op codes, add, multiply, and finish. In the second part, I need to brute force those values to find a given target output. This puzzle was basically reading a list of numbers, performing some basic arithmetic, and summing the results.
One of those usernames with one of the original passwords works to get a WinRM session on the Heist. There was something a bit weird going on with Chainsaw from HackTheBox.
I have no idea. Big thanks to jkr for helping me get started in this rabbit hole the good kind , and to h0mbre for his recent blog post about these rootkits. Chainsaw was centered around blockchain and smart contracts, with a bit of InterPlanetary File System thrown in. Networked involved abusing an Apache misconfiguration that allowed me to upload an image containing a webshell with a double extension. With that, I got a shell as www-data, and then did two privescs.
The first abused command injection into a script that was running to clean up the uploads directory. Then I used access to an ifcfg script to get command execution as root. Jarvis provide three steps that were all relatively basic. From there, I have access to the LogStash config, which is misconfigured to allow a execution via a properly configured log as root. Safe was two steps - a relatively simple ROP, followed by cracking a Keepass password database. Ellingson was a really solid hard box.
Once sshed in as margo, I will find a suid binary that I can overflow to get a root shell. The first breaks the privesc from hal to margo, resetting the permissions on the shadow. The second looks like a hint that was disabled, or maybe forgotten.
Writeup was a great easy box. Neither of the steps were hard, but both were interesting. That code has a layer of unpacking based on a binary implementation of tabs and spaces in the doc strings. Once I get to the next layer, I need to calculate the hash of the text segment for the currently running binary, and use that as a key to some equations. Using a solver to solve the system, I can find the input necessary to return the flag.
It was challenging, yet doable and interesting. NET executable. That executable is used to hide information in the low bits of the image. The file given is a demoscene, which is a kind of competition to get the best visual performce out of an executable limited in size. To achieve this, packers are used to compress the binary. In the exe for this challenge, a 3D Flare logo comes up and spins, but the flag is missing. Ghoul was a long box, that involved pioviting between multiple docker containers exploiting things and collecting information to move to the next step.
From there, I can access a third container hosting the self hosted git solution, gogs. That provides access to a git repo that has a password I can use for root on the second container. DNS Chess was really fun. Once I find that, I can get the flag. Overlong was a challenge that could lead to complex rabbit holes, or, with some intelligent guess work, be solved quite quickly.
From the start, with the title and the way that the word overlong was bolded in the prompt, I was looking for an integer to overflow or change in some way. That, plus additional clues, made this one pretty quick work. The first is an authentication bypass that allows me to add an admin user to the CMS.
RCE leads to shell and user. Memecat Battlestation [Shareware Demo Edition] was a really simple challenge that really involed opening a. NET executable in a debugger and reading the correct phrases from the code. It was a good beginner challenge. Kryptos feels different from most insane boxes.
The website gives me that ability to return encrypted webpage content that Kryptos can retrieve. Luke was a recon heavy box. In fact, the entire writeup for Luke could reasonably go into the Recon section. Holiday was a fun, hard, old box. The path to getting a shell involved SQL injection, cross site scripting, and command injection.
The root was a bit simpler, taking advantage of a sudo on node package manager install to install a malicious node package. Bastion was a solid easy box with some simple challenges like mounting a VHD from a file share, and recovering passwords from a password vault program. It starts, somewhat unusually, without a website, but rather with vhd images on an SMB share, that, once mounted, provide access to the registry hive necessary to pull out credentials.
These creds provide the ability to ssh into the host as the user. Once I break out the administrator password, I can ssh in as administrator. OneTwoSeven was a very cleverly designed box. There were lots of steps, some enumeration, all of which was do-able and fun. Users rated Unattended much harder than the Medium rating it was released under. So the trick was knowing when to continue looking and identify the NGINX vulnerability to leak the source code.
From there, it was injecting into some commands being taken from the database to move to the next user. And in the final step, examining an initrd file to get the root password. Helpline was a really difficult box, and it was an even more difficult writeup. It has so many paths, and yet all were difficult in some way.
It was also one that really required Windows as an attack platform to do the intended way. But I wasted a lot of time, looked high and low and could not get it done. I DON'T like registry edits because it's unsafe, not easily repeated--you'll forget what you did--and Windows doesn't really like it either. Worst comes to worst, you reinstall Microsoft Office. So the C: drive remains "unused" for Office. Side note-1a.
I don't know if all these laptops with 32Gb drives integrated into the motherboard are the same, but mine had an unused internal port which allowed me to install a Gb SSD. So I was also able to move the paging file totally off drive C: and unto drive D: which saved me some more space. I was also able to allocate a constant 7GB space to virtual memory. You just need to dismantle the whole thing and take out the port adapter to allow you to use the internal CD drive port.
There is an option there to store your files on a different drive. It works for some programs but not Office. You can even redirect the programs which comply to an external drive. This will save you even more space. This method works great. One tiny issue when launching an Office app, system was throwing an error that application was unable to start, but the app did start even with the error. So I ran an Office repair and everything is perfect.
Thank you for the awesome resolution. Windows 10, 8, 7, and Vista all support symbolic links—also known as symlinks—that point to a file or folder on your system. Symbolic links are basically advanced shortcuts.
This trick can be used for all sorts of things, including syncing any folder with programs like Dropbox, Google Drive, and OneDrive. There are two type of symbolic links: Hard and soft. Soft symbolic links work similarly to a standard shortcut. When you open a soft link to a folder, you will be redirected to the folder where the files are stored. That makes hard symbolic links more useful in most situations. You can create symbolic links using the mklink command in a Command Prompt window as Administrator.
Without any extra options, mklink creates a symbolic link to a file. To get rid of a symbolic link, you can simply delete it like you would any other file or directory. I'm glad to see a clear answer but once again disappointed in Microsoft. My PC is running out of space on the OS drive but has a ton of room on the data drive.
So it only makes sense that MS let me install Office on the only drive with plenty of space. Neither one is SSD. As Microsoft makes changes like this and hiding the local installation versions to promote their wallet leak called I get closer to abandoning the whole family of MS products. What a shame. Submit a feedback to MS complaining about the dis " improvement ". By itself your complaint won't make a difference, but if enough of us complain maybe even MS will hear and respond MS has replied that this is "working as designed", so it is not a "bug" which is what users call it.
PS: I like your characterization of as a " wallet leak ". Descriptive and accurate. Which is why MS loves it Please post a share link to your feedback, back here, so other people who find your question here will be able to vote for your feedback and add their comments to it. New research, published recently in the Journal of Applied Psychology, from the University of British Columbia has found that what you say to customer service employees can determine the quality of service you receive.
For example, personally targeting employees by saying, "Your product is garbage" instead of "This product is garbage," can trigger negative responses from service employees.
Customers need to remember that they're dealing with human beings. Note that it hasn't been possible for years to install Office on another drive than the C: drive. I believe it started with the click-to-run type of installation. You do a normal install, then use this 's era DOS technique that is still part of Windows to trick DOS, and now Windows, into thinking the files are located in the normal place on the C: drive while they are located on some other drive.
Choose where you want to search below Search Search the Community. Search the community and support articles Install, redeem, activate Microsoft and Office Search Community member. I just installed Office to my new PC and it never asked where to install program files. I now have program files on my SSD instead of the datadrive. How can I fix this? This thread is locked. You can follow the question or vote as helpful, but you cannot reply to this thread. I have the same question Report abuse.
Details required :. Cancel Submit. Sabina-F Independent Advisor. Hi Larry, I'm Sabina, an independent advisor. Office can only be installed on the system drive where your operating system is installed. It is not possible to choose a different installation path. To free up disk space, you can decide to save your documents on the secondary drive. Kind regards. How satisfied are you with this reply? Thanks for your feedback, it helps us improve the site.
In reply to Sabina-F's post on November 29,
- Microsoft office 2016 professional plus configures each time you start free
The initial web exploitation in Overgraph was really hard. Late really had two steps. This is relatively simple to find, but getting the fonts correct to exploit the vulnerability is a bit tricky. Still, some trial and error pays off, and results in a shell. The current user has append access to the file, and therefore I can add a malicious line to the script and connect over SSH to get execution as root.
Catch requires finding an API token in an Android application, and using that to leak credentials from a chat server. Those credentials provide access to multiple CVEs in a Cachet instance, providing several different paths to a shell. The intended and most interesting is to inject into a configuration file, setting my host as the redis server, and storing a malicious serialized PHP object in that server to get execution.
RouterSpace was all about dynamic analysis of an Android application. Unfortunately, it was a bit tricky to get setup and working. Undetected follows the path of an attacker against a partially disabled website. Further enumeration finds a malicious Apache module responsbile for downloading and installing a backdoored sshd binary.
Reversing that provides a password I can use to get a root shell. This injection is quite slow, and I think leads to the poor reception for this box overall.
Still, very slow blind SQL injection shows the value in learning to pull out only the bits you need from the DB. The next pivot is wildcard injection in a complied shell script. Meta was all about image processing. Timing starts out with a local file include and a directory traversal that allows me to access the source for the website.
AdmirerToo is all about chaining exploits together. Jail is an old HTB machine that is still really nice to play today. It starts with a buffer overflow in a jail application that can be exploited to get execution. And finally a crypto challenge to get root.
Jail sent me a bit down the rabbit hole on NFS, so some interesting exploration in Beyond Root, including an alternative way to make the jump from frank to adm. Pandora starts off with some SNMP enumeration to find a username and password that can be used to get a shell.
This provides access to a Pandora FMS system on localhost, which has multiple vulnerabilities. I can exploit that same page to get admin and upload a webshell, or exploit another command injection CVE to get execution. Mirai was a RaspberryPi device running PiHole that happens to still have the RaspberryPi default usename and password.
That user can even sudo to root, but there is a bit of a hitch at the end. Brainfuck was one of the first boxes released on HackTheBox. Fulcrum is a release that got a rebuild in NET error messages.
This box has a lot of tunneling, representing a small mixed-OS network on one box. Return was a straight forward box released for the HackTheBox printer track. The account is in the Server Operators group, which allows it to modify, start, and stop services. It builds on the first Backend UHC box, but with some updated vulnerabilities, as well as a couple small repeats from steps that never got played in UHC competition. Search was a classic Active Directory Windows box.
With that initial shell, its a a few hops identified through Bloodhound, including recoving a GMSA password, to get to domain admin. Rabbit was all about enumeration and rabbit holes.
Fighter is a solid old Windows box that requires avoiding AppLocker rules to exploit an SQL injection, hijack a bat script, and exploit the imfamous Capcom driver. I wanted to play with parallelizing that attack, both in Bash and Python. Backdoor starts by finding a WordPress plugin with a directory traversal bug that allows me to read files from the filesystem.
Ariekei is an insane-rated machine released on HackTheBox in , focused around two very well known vulnerabilities, Shellshock and Image Tragic. Toby was a really unique challenge that involved tracing a previous attackers steps and poking a backdoors without full information about how they work. Jeeves was first released in , and I first solved it in I can abuse Jenkins to get execution and remote shell. Backend was all about enumerating and abusing an API, first to get access to the Swagger docs, then to get admin access, and then debug access.
From there it allows execution of commands, which provides a shell on the box. Tally is a difficult Windows Machine from Egre55, who likes to make boxes with multiple paths for each step. The box starts with a lot of enumeration, starting with a SharePoint instance that leaks creds for FTP. With FTP access, there are two paths to root. Alternatively, I can spot a Firefox installer and a note saying that certain HTML pages on the FTP server will be visited regularly, and craft a malicious page to exploit that browser.
Overflow starts with a padding oracle attack on a cookie for a website. As admin, I get access to a logs panel with an SQL injection, where I can dump the db and crack the password to log into the CMS as well as a new virtual host with job adds. The next user is regularly running a script that pulls from another domain.
The steps themselves are not that hard, but the difficulty comes with the firewall that only allows ICMP out. The rest of the steps are also not hard on their own, just difficult to work through my ICMP shell. Inception was one of the first boxes on HTB that used containers. Shibboleth starts with a static website and not much else. Some credential reuse pivots to the next user. In Beyond Root, a video reversing the shared object file I used in that root exploit, as well as generating my own in C.
This one has another Laravel website. Most of the scripts to exploit Dirty Pipe modify the passwd file, but this box has pam-wordle installed, so you much play a silly game of tech-based Wordle to auth. The first is to get read access to files using the open file descriptors. The alternative path is to crash the program and read the content from the crashdump. Stacked was really hard. The foothold involved identifying XSS in a referer header that landed in an mail application that I could not see.
From root in the container, I can get full access to the host filesystem and a shell. Ransom was a UHC qualifier box, targeting the easy to medium range. It has three basic steps.
Devzat is centered around a chat over SSH tool called Devzat. This user has access to the source for a new version of Devzat.
Those keys get access to lambda functions which contain a secret that is reused as the secret for the signing of JWT tokens on the site.
Hancliffe starts with a uri parsing vulnerability that provides access to an internal instance of Nuxeo, which is vulnerable to a Java server-side template injection that leads to RCE.
First a password change, then abusing logon scripts, and finally some group privileges. Drive released as part of the HackTheBox printer exploitation track. That password works to connect to WinRM, providing a foothold to Driver. GoodGames has some basic web vulnerabilities. Bolt was all about exploiting various websites with different bits of information collected along the way. SteamCloud just presents a bunch of Kubernetes-related ports. But I also have access to the Kubelet running on one of the nodes which is the same host , and that gives access to the pods running on that node.
From there, I can spawn a new pod, mounting the host file system into it, and get full access to the host. In Beyond root, looking at a couple unintended paths. Fluster starts out with a coming soon webpage and a squid proxy.
In Beyond root, an exploration into Squid and NGINX configs, and a look at full recreating the database based on the files from the remote volume. It was a fun forensics challenge. Horizonatll was built around vulnerabilities in two web frameworks. From there, I can do a deserialization attack to get execution as root. Anubis starts simply enough, with a ASP injection leading to code execution in a Windows Docker container.
That account provides SMB access, where I find Jamovi files, one of which has been accessed recently. The website on Forge has an server-side request forgery SSRF vulnerability that I can use to access the admin site, available only from localhost. But to do that, I have to bypass a deny list of terms in the given URL. The user is able to run a Python script as root, and because of how this script uses PDB the Python debugger , I can exploit the crash to get a shell as root.
When I sign up for an account, there are eight real challenges to play across four different categories. On solving one, I can submit a write-up link, which the admin will click. This link is vulnerable to reverse-tab-nabbing, a neat exploit where the writeup opens in a new window, but it can get the original window to redirect to a site of my choosing.
This years challenge conference included 14 talks from leaders in information security , including a late entry from the elf, Professor Qwerty Petabyte, covering Log4j. As usual, the challenges were interesting and set up in such a way that it was very beginner friendly, with lots of hints and talks to ensure that you learned something while solving. This year I was only able to complete 14 of the 24 days of challenges, but it was still a good time.
I learned something about how web clients handle content lengths, how to obfuscate JavaScript for a golf competition, and exploited some neat crypto to sign commands for a server.
