{"id":203,"date":"2025-06-29T18:47:00","date_gmt":"2025-06-29T18:47:00","guid":{"rendered":"https:\/\/thecyberstaff.com\/?p=203"},"modified":"2025-12-28T19:50:55","modified_gmt":"2025-12-28T19:50:55","slug":"busqueda-hackthebox-lab-2","status":"publish","type":"post","link":"https:\/\/thecyberstaff.com\/?p=203","title":{"rendered":"Busqueda- Hackthebox lab"},"content":{"rendered":"\n<p>I started this one with an nmap scan for both TCP and UDP ports.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"770\" height=\"296\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628153242.png\" alt=\"\" class=\"wp-image-502\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628153242.png 770w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628153242-300x115.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628153242-768x295.png 768w\" sizes=\"auto, (max-width: 770px) 100vw, 770px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"510\" height=\"173\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154521.png\" alt=\"\" class=\"wp-image-503\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154521.png 510w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154521-300x102.png 300w\" sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><\/figure>\n\n\n\n<p>With the Nmap results, I started enumerating port 80.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"496\" height=\"297\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154721.png\" alt=\"\" class=\"wp-image-504\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154721.png 496w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154721-300x180.png 300w\" sizes=\"auto, (max-width: 496px) 100vw, 496px\" \/><\/figure>\n\n\n\n<p>With this error, I am able to enumerate the website domain name and input that information into my \/etc\/hosts file so my local machine and resolve the hostname.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"443\" height=\"210\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154948.png\" alt=\"\" class=\"wp-image-505\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154948.png 443w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628154948-300x142.png 300w\" sizes=\"auto, (max-width: 443px) 100vw, 443px\" \/><\/figure>\n\n\n\n<p>With the name resolution set up, I can get to the website. It is a website that is designed to send searches to multiple search engines and other sites.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"766\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155234-1024x766.png\" alt=\"\" class=\"wp-image-506\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155234-1024x766.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155234-300x224.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155234-768x574.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155234-1536x1148.png 1536w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155234.png 1775w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I use the Wappalyzer web browser extension to enumerate the tech stack and versions, I also see the Searcher 4.4.0 version in the bottom of the main page.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"496\" height=\"544\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155343.png\" alt=\"\" class=\"wp-image-507\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155343.png 496w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628155343-274x300.png 274w\" sizes=\"auto, (max-width: 496px) 100vw, 496px\" \/><\/figure>\n\n\n\n<p>I run Nikto and Gobuster to enumerate the site more and do some directory discovery.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"725\" height=\"343\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628174126.png\" alt=\"\" class=\"wp-image-508\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628174126.png 725w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628174126-300x142.png 300w\" sizes=\"auto, (max-width: 725px) 100vw, 725px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"628\" height=\"361\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628174338.png\" alt=\"\" class=\"wp-image-509\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628174338.png 628w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628174338-300x172.png 300w\" sizes=\"auto, (max-width: 628px) 100vw, 628px\" \/><\/figure>\n\n\n\n<p>I did not see much from these results, I decided to check into the versions to see if I can identify any vulnerabilities or exploits. The exploits below looked promising.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"425\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628185746-1024x425.png\" alt=\"\" class=\"wp-image-510\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628185746-1024x425.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628185746-300x125.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628185746-768x319.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628185746.png 1038w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I decided to try the first result.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"660\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190215-1024x660.png\" alt=\"\" class=\"wp-image-511\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190215-1024x660.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190215-300x193.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190215-768x495.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190215.png 1279w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I ran the exploit and got a reverse shell!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"705\" height=\"116\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190334.png\" alt=\"\" class=\"wp-image-512\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190334.png 705w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190334-300x49.png 300w\" sizes=\"auto, (max-width: 705px) 100vw, 705px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"641\" height=\"129\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190411.png\" alt=\"\" class=\"wp-image-513\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190411.png 641w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628190411-300x60.png 300w\" sizes=\"auto, (max-width: 641px) 100vw, 641px\" \/><\/figure>\n\n\n\n<p>While searching the system, I found the git config below with a password.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"709\" height=\"209\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628194456.png\" alt=\"\" class=\"wp-image-514\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628194456.png 709w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628194456-300x88.png 300w\" sizes=\"auto, (max-width: 709px) 100vw, 709px\" \/><\/figure>\n\n\n\n<p>I used this password to ssh into the box.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"601\" height=\"725\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628194649.png\" alt=\"\" class=\"wp-image-515\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628194649.png 601w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628194649-249x300.png 249w\" sizes=\"auto, (max-width: 601px) 100vw, 601px\" \/><\/figure>\n\n\n\n<p>I ran a check to see if the user has any sudo privileges.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1018\" height=\"116\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628202846.png\" alt=\"\" class=\"wp-image-516\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628202846.png 1018w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628202846-300x34.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628202846-768x88.png 768w\" sizes=\"auto, (max-width: 1018px) 100vw, 1018px\" \/><\/figure>\n\n\n\n<p>I found out that the system-checkup.py script looks for the full-checkup.sh script when running the full-checkup command.<\/p>\n\n\n\n<p>I moved to the \/tmp directory and created a new system-checkup.sh file and made it executable, I put a reverse shell in this bash script pointing back at my machine.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"392\" height=\"125\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628203027.png\" alt=\"\" class=\"wp-image-518\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628203027.png 392w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628203027-300x96.png 300w\" sizes=\"auto, (max-width: 392px) 100vw, 392px\" \/><\/figure>\n\n\n\n<p>I ran the system-checkup.py script from the \/tmp directory and it used the full-checkup.py file that I created.<\/p>\n\n\n\n<p>The reverse shell came back as root!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"489\" height=\"120\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628203143.png\" alt=\"\" class=\"wp-image-519\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628203143.png 489w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/06\/Pasted-image-20250628203143-300x74.png 300w\" sizes=\"auto, (max-width: 489px) 100vw, 489px\" \/><\/figure>\n\n\n\n<p>This concludes the Busqueta machine from Hackthebox. This one shows the importance of keeping software up to date and protecting it against public exploits.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I started this one with an nmap scan for both TCP and UDP ports. With the Nmap results, I started enumerating port 80. With this error, I am able to enumerate the website domain name and input that information into my \/etc\/hosts file so my local machine and resolve the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":204,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-203","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-pentesting"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=203"}],"version-history":[{"count":2,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/203\/revisions"}],"predecessor-version":[{"id":520,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/203\/revisions\/520"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/media\/204"}],"wp:attachment":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}