> For the complete documentation index, see [llms.txt](https://eslam3kl.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eslam3kl.gitbook.io/blog/hack-the-box-machines/hack-the-box-writeup.md). # Hack The Box — WriteUP Hack The Box — WriteUP walkthrough #### Hack The Box — WriteUp Hey folks, today we have one of **HackTheBox** machines “**WriteUP**” which seems like CTF challenges and depends on CVE’s exploitation. It has more than trick, let’s take a look at its info

**`Nmap` Scan** As usual, we start our scan with `nmap` to get top open ports, service running and more `nmap -A -T4 -oG writeup.gnmap 10.10.10.138`

We have only 2 open ports `80/22` and the services which running on them is not vulnerable, so the start point will be on the website

so there’s nothing here and also after using `dirsearch and gobuster` there’s nothing useful returned from them, so I tried `/machine_name` directory which will be `/writeup` as one of CTF techniques which used at many challenges, and it works, we have directory called `/writeup`

After checking its source code trying to find the used CMS if there’s or any keyword for something vulnerable

**User Flag** I’ve found something called `CMS Made Simple` and after searching for CVE’s related to this type

We have a bunch of vulnerabilities related to it, let’s try to use `SQLi` exploit by using `-m` option and exploit path to get it into our directory as you can see here

So after running it, you will have username `jkr` and hashed password (pass and salt) After searching for a method to crack it, I’ve found that `hashcat` can crack it by using `-m 10` or `-m 20`

I’ll put the pass and the salt into one file separated by `pass:salt` like this

let’s use `hashcat` `hashcat -m 20 -a 0 hash /path/to/wordlist —-force`

The results…

It works and we have the password `raykayjay9` Let’s try to login to ssh using this creds

That’s good, we have the user flag **Root flag** We have some steps to find a way in escaping to root account 1. Enumerate all the files and directories to find any file which led us to password or any other secrets 2. Using `LinPEAS.sh` to perform multiple tasks and get back the important files 3. Use `PsPy` to check the processes I’ve done the first 2 steps and found nothing important, so after downloading `PsPy` to my vulnerable machine and executing it, I’ve found something execute after every login process

It executes `run-parts` file.

At every time `jkr` login to the system, the file `run-parts` executes, so I’ve created this file to contain the reverse shell and logged in as `jkr` to let it executes

and the results

It works :) **Congrats ❤**