{"id":218,"date":"2025-07-24T18:56:00","date_gmt":"2025-07-24T18:56:00","guid":{"rendered":"https:\/\/thecyberstaff.com\/?p=218"},"modified":"2025-12-28T19:32:41","modified_gmt":"2025-12-28T19:32:41","slug":"help-hackthebox-lab","status":"publish","type":"post","link":"https:\/\/thecyberstaff.com\/?p=218","title":{"rendered":"Help- Hackthebox lab"},"content":{"rendered":"\n<p class=\"has-text-align-center\">I got stuck on this assessment because the target machine was not accepting the reverse shell. It turned out that I needed to set my attack box to the same time as the target machine, once that was completed, everything worked!<\/p>\n\n\n\n<p class=\"has-text-align-center\">I started the assessment with my new poet scanning script that scans all TCP and the top UDP ports.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"771\" height=\"531\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250719110344.png\" alt=\"\" class=\"wp-image-430\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250719110344.png 771w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250719110344-300x207.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250719110344-768x529.png 768w\" sizes=\"auto, (max-width: 771px) 100vw, 771px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">Enumerating the web servers I found the hostname help.htb. I added that to my \/etc\/hosts file.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"442\" height=\"150\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250719110657.png\" alt=\"\" class=\"wp-image-431\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250719110657.png 442w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250719110657-300x102.png 300w\" sizes=\"auto, (max-width: 442px) 100vw, 442px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">When targeting the webserver on port 80, I found this HelpDeskZ application.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1009\" height=\"641\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094656.png\" alt=\"\" class=\"wp-image-432\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094656.png 1009w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094656-300x191.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094656-768x488.png 768w\" sizes=\"auto, (max-width: 1009px) 100vw, 1009px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"810\" height=\"295\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094824.png\" alt=\"\" class=\"wp-image-433\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094824.png 810w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094824-300x109.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094824-768x280.png 768w\" sizes=\"auto, (max-width: 810px) 100vw, 810px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">The README file for this application provided a version and I found a couple of exploits when searching the version in searchsploit.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"301\" height=\"172\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094911.png\" alt=\"\" class=\"wp-image-434\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"646\" height=\"166\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094932.png\" alt=\"\" class=\"wp-image-435\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094932.png 646w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724094932-300x77.png 300w\" sizes=\"auto, (max-width: 646px) 100vw, 646px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">This is where I got stuck and did a ton of troubleshooting, I ended up proxying the app in Burp Suite and getting the time of the app. I changed my time on my attack box to the same time and got the exploit working after uploading a PHP reverse shell into the new ticket function.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"681\" height=\"79\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724102320.png\" alt=\"\" class=\"wp-image-436\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724102320.png 681w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724102320-300x35.png 300w\" sizes=\"auto, (max-width: 681px) 100vw, 681px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1021\" height=\"203\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724102338.png\" alt=\"\" class=\"wp-image-437\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724102338.png 1021w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724102338-300x60.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724102338-768x153.png 768w\" sizes=\"auto, (max-width: 1021px) 100vw, 1021px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">With a regular user shell, I began looking for ways to escalate my privileges. I found an old kernel version and looked for local privilege escalation exploits.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"684\" height=\"222\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724124744.png\" alt=\"\" class=\"wp-image-438\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724124744.png 684w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724124744-300x97.png 300w\" sizes=\"auto, (max-width: 684px) 100vw, 684px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">I moved the exploit over to the target machine and compiled it. I ran the exploit and got a root shell!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"445\" height=\"184\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724125102.png\" alt=\"\" class=\"wp-image-439\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724125102.png 445w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/07\/Pasted-image-20250724125102-300x124.png 300w\" sizes=\"auto, (max-width: 445px) 100vw, 445px\" \/><\/figure>\n\n\n\n<p>This lab shows the importance of using strong up to date software to protect against intrusions.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I got stuck on this assessment because the target machine was not accepting the reverse shell. It turned out that I needed to set my attack box to the same time as the target machine, once that was completed, everything worked! I started the assessment with my new poet scanning [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":219,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-218","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-pentesting"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=218"}],"version-history":[{"count":2,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/218\/revisions"}],"predecessor-version":[{"id":440,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/218\/revisions\/440"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/media\/219"}],"wp:attachment":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}