Skip to main content

11 posts tagged with "Anonymous/Guest Access"

Anonymous or guest access refers to the ability of unauthenticated users to access a network, system, or resource without logging in with valid credentials, often for limited purposes such as browsing public areas or accessing specific shared resources.

View All Tags

HTB | Netmon | Write-Up

· 16 min read

Summary:​

We navigate the Hack The Box website starting by spawning a target machine. Next, we perform reconnaissance on the target to gather initial information and identify an FTP server running on it. We use anonymous authentication to access the FTP share, then enumerate the files available on this share.

Continuing our investigation, we access the NETMON configuration files and extract user credentials from them. Modifying these credentials to suit our needs, we proceed to access the PRTG Network Monitor web interface. Utilizing Metasploit's capabilities, we exploit CVE-2018-9276 to gain shell access with the "LocalSystem" account, thereby achieving system level access. With this access in hand, we grab both the user flag and root flag, ultimately declaring System Own status once these tasks are accomplished.

Machine Name: Netmon | Difficulty: Easy | OS: Windows

HTB | Vaccine | Write-Up

· 23 min read

Summary:​

We test connectivity and scan the target, then use anonymous FTP access to download and crack a zip archive using John the Ripper. Analyzing the source code and exploiting a hardcoded hash gives us web app access via compromised credentials.

We identify an SQL injection vulnerability, gain control, and upgrade to a reverse shell with low-privileged access. As we enumerate the machine, we find privilege escalation opportunities and exploit SUDO vulnerabilities to gain root access, ultimately obtaining both user and root flags.

Machine Name: Vaccine | Difficulty: Easy | OS: Linux

HTB | Archetype | Write-Up

· 19 min read

Summary:​

This article guides users through completing the Archetype machine challenge on Hack The Box. We exploit vulnerabilities on a Microsoft SQL Server by enumerating SMB shares, finding clear text credentials, and using Impacket to authenticate and gain an authorized connection. We then escalate privileges and download Netcat to establish a reverse shell, grab the user flag, and eventually use Impacket's psexec tool to gain admin access and retrieve the root flag before terminating the connection.

Machine Name: Archetype | Difficulty: Easy | OS: Windows

HTB | Three | Write-Up

· 14 min read

Summary:​

This article guides users through completing the Three machine challenge on Hack The Box. This is a web hacking challenge that involves exploiting vulnerabilities in an S3 bucket and executing a reverse shell on the target machine. The goal is to retrieve the "flag" file from the target machine.

Machine Name: Three | Difficulty: Easy | OS: Linux

HTB | Crocodile | Write-Up

· 8 min read

Summary:​

This walkthrough provides help solving the Crocodile machine on Hack The Box. The guide covers various topics, including Nmap scanning, service version identification, FTP login procedures, and directory brute force using Gobuster.

Machine Name: Crocodile | Difficulty: Easy | OS: Linux

HTB | Synced | Write-Up

· 5 min read

Summary:​

This walkthrough provides help with solving the Synced machine challenge on Hack The Box, focusing on tasks related to rsync and its usage on the target machine. Key takeaways include understanding the default port for rsync (873), using anonymous authentication, and listing shares and files with the correct options.

Machine Name: Synced | Difficulty: Easy | OS: Linux

HTB | Mongod | Write-Up

· 7 min read

Summary:​

This walkthrough guides beginners through completing the Mongod machine challenge on Hack The Box, covering essential steps and commands to solve Tier 0 challenges, including interacting with MongoDB and managing databases. It provides step-by-step instructions on how to connect to the target machine, use nmap and other tools, and submit the root flag.

Machine Name: Mongod | Difficulty: Easy | OS: Linux

HTB | Redeemer | Write-Up

· 12 min read

Summary:​

This article guides users through completing the Redeemer machine challenge on Hack The Box. Through a series of tasks, users are guided in connecting to the target machine via pwnbox, identifying open TCP ports, determining service versions, understanding Redis database types, using command-line utilities for interaction, and obtaining flags.

Machine Name: Redeemer | Difficulty: Easy | OS: Linux

HTB | Dancing | Write-Up

· 10 min read

Summary:​

This article guides users through completing the Dancing machine challenge on Hack The Box. It covers tasks related to SMB, such as listing shares, accessing shares with a blank password, and downloading files using the SMB shell. The final step is to find and submit the root flag.

Machine Name: Dancing | Difficulty: Easy | OS: Windows