> For the complete documentation index, see [llms.txt](https://eslam3kl.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eslam3kl.gitbook.io/blog/hack-the-box-machines/popcorn-walkthrough.md).
# PopCorn Walkthrough
Hey Everyone! Today we have the first medium retired machine from Hack The Box, and it’s called **PopCorn**. Before we get started, let’s take a look at its info
It’s a good one and seems like a Real Life challenge.
## **Nmap Scan**
Let’s start our scan with `nmap` scan to know what open ports we have and where we will start our enumeration
`nmap -A -T4 -oG popcorn.gnmap 10.10.10.6 | tee -a nmap`
Good, we have 2 open ports `80 and 22` so let’s start with the website
## **Website Enumeration**
we don’t have any useful information here, so let’s try to brute-force the directories by using `gobuster`
`gobuster dir -u 10.10.10.6 -w /path/to/wordlist -l | tee -a gobuster`
We have `/torrent` directory, let’s check it
good, we have a **Torrent Hoster** webpage. At the end of this page
It depends on `Torrent Hoster` and after searching for it
I’ve found that it’s vulnerable by remount upload vulnerability, let’s check its details
we have the vulnerable link, let’s check if it’s valid in our case or not
It’s valid, but it requires us to be authenticated, so I’ve created an account for me, and you can create one also, it’s easy
## **User flag**
After login as a normal user, we have an upload function
I’ve checked it in more than one way, but it’s not vulnerable, and it accepts only `.torrent` files.
After uploading any test torrent file, I’ve found that I can upload an image as a screenshot related to the torrent file.
Let’s try to exploit it
I’ll upload a file with an extension `.php.png`
And I’ll intercept it and change the extension to `.php`
> You can get this reverse\_shell file from ***pentestermonkey*** github account
and the result is
It works, good
Let’s access the `/upload` directory
We have our file here, we need to open `4444` port using `nc` by typing `nc -lvp 4444` and then open our shell file
We have a shell now, and we can open the user flag
## **Root flag**
I’ve used `linux-exploit-suggester` a script from GitHub to check for any kernel exploits which may lead us to be the root
and the results are
Awesome, we have a bunch of kernel exploits.
You can use anyone of them, and it will work, I’ve select `rds` and after getting it to my box by using `wget` command and open my `kali` as a web server and also compiling it by using `gcc` as you can see, it opens a root shell, and it works :)
And now we have the root flag ❤
**Congrats ❤**
**Stay in touch**
[LinkedIn ](https://www.linkedin.com/in/eslam3kl/)| [GitHub](https://github.com/eslam3kl) | [Twitter](https://twitter.com/eslam3kll)
