# PopCorn Walkthrough

Hey Everyone! Today we have the first medium retired machine from Hack The Box, and it’s called **PopCorn**. Before we get started, let’s take a look at its info

<figure><img src="https://cdn-images-1.medium.com/max/800/1*ax0SXSGoySP0LzuyWbMLXg.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://cdn-images-1.medium.com/max/800/1*-P-YvoFhynBA3qSjWB6jyQ.png" alt=""><figcaption></figcaption></figure>

It’s a good one and seems like a Real Life challenge.

## **Nmap Scan**

Let’s start our scan with `nmap` scan to know what open ports we have and where we will start our enumeration

`nmap -A -T4 -oG popcorn.gnmap 10.10.10.6 | tee -a nmap`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*NbXvUMD-pK3G-DRSHMPwEA.png" alt=""><figcaption></figcaption></figure>

Good, we have 2 open ports `80 and 22` so let’s start with the website



## **Website Enumeration**

<figure><img src="https://cdn-images-1.medium.com/max/800/1*UA_AKg4HvXgvvCZ1DznJzg.png" alt=""><figcaption></figcaption></figure>

we don’t have any useful information here, so let’s try to brute-force the directories by using `gobuster`

`gobuster dir -u 10.10.10.6 -w /path/to/wordlist -l | tee -a gobuster`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*swiwQNs8GUUp_J298ZWnzA.png" alt=""><figcaption></figcaption></figure>

We have `/torrent` directory, let’s check it

<figure><img src="https://cdn-images-1.medium.com/max/800/1*PlStGrSpZsVlOiRs3dgUyw.png" alt=""><figcaption></figcaption></figure>

good, we have a **Torrent Hoster** webpage. At the end of this page

<figure><img src="https://cdn-images-1.medium.com/max/800/1*CT9dssUNtxIYzDzikslBCA.png" alt=""><figcaption></figcaption></figure>

It depends on `Torrent Hoster` and after searching for it

<figure><img src="https://cdn-images-1.medium.com/max/800/1*xAhXcf5ghe2P9GJaFlc-vw.png" alt=""><figcaption></figcaption></figure>

I’ve found that it’s vulnerable by remount upload vulnerability, let’s check its details

<figure><img src="https://cdn-images-1.medium.com/max/800/1*inW9NhiQWaCH_pwCvsyzjw.png" alt=""><figcaption></figcaption></figure>

we have the vulnerable link, let’s check if it’s valid in our case or not

<figure><img src="https://cdn-images-1.medium.com/max/800/1*J7miJMOHmDINQR2pQWrdtQ.png" alt=""><figcaption></figcaption></figure>

It’s valid, but it requires us to be authenticated, so I’ve created an account for me, and you can create one also, it’s easy



## **User flag**

After login as a normal user, we have an upload function

<figure><img src="https://cdn-images-1.medium.com/max/800/1*QfVDgKcceevvhD8YtJ4mmg.png" alt=""><figcaption></figcaption></figure>

I’ve checked it in more than one way, but it’s not vulnerable, and it accepts only `.torrent` files.

After uploading any test torrent file, I’ve found that I can upload an image as a screenshot related to the torrent file.

<figure><img src="https://cdn-images-1.medium.com/max/800/1*WUQULFulSZQJ85omhlD-NQ.png" alt=""><figcaption></figcaption></figure>

Let’s try to exploit it

I’ll upload a file with an extension `.php.png`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*xFRf6SpIwB5EAYn5EGzdYQ.png" alt=""><figcaption></figcaption></figure>

And I’ll intercept it and change the extension to `.php`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*MlEN9t5Pbh2e4EbveTQmRA.png" alt=""><figcaption></figcaption></figure>

> You can get this reverse\_shell file from _**pentestermonkey**_ github account

and the result is

<figure><img src="https://cdn-images-1.medium.com/max/800/1*EJFECGzACE57OyVE_py7Aw.png" alt=""><figcaption></figcaption></figure>

It works, good

Let’s access the `/upload` directory

<figure><img src="https://cdn-images-1.medium.com/max/800/1*O_UuUPBGlRk0C1WtfCoqJA.png" alt=""><figcaption></figcaption></figure>

We have our file here, we need to open `4444` port using `nc` by typing `nc -lvp 4444` and then open our shell file

<figure><img src="https://cdn-images-1.medium.com/max/800/1*vmVwNkyilfpURKM7w2FJZQ.png" alt=""><figcaption></figcaption></figure>

We have a shell now, and we can open the user flag



## **Root flag**

I’ve used `linux-exploit-suggester` a script from GitHub to check for any kernel exploits which may lead us to be the root

and the results are

<figure><img src="https://cdn-images-1.medium.com/max/800/1*hY03YelWm5-lP73y3Nki-A.png" alt=""><figcaption></figcaption></figure>

Awesome, we have a bunch of kernel exploits.

You can use anyone of them, and it will work, I’ve select `rds` and after getting it to my box by using `wget` command and open my `kali` as a web server and also compiling it by using `gcc` as you can see, it opens a root shell, and it works :)

<figure><img src="https://cdn-images-1.medium.com/max/800/1*60Unvam9LppYZxu3uSTfLA.png" alt=""><figcaption></figcaption></figure>

And now we have the root flag ❤

**Congrats ❤**



**Stay in touch**

[LinkedIn ](https://www.linkedin.com/in/eslam3kl/)| [GitHub](https://github.com/eslam3kl) | [Twitter](https://twitter.com/eslam3kll)
