Skip to main content

5 posts tagged with "Default Credentials"

Default credentials refer to the pre-set username and password combinations that come with many software applications, devices, and systems. These default credentials are often set by manufacturers or developers to facilitate initial access and configuration. However, using default credentials can compromise security as they are publicly known and easily exploitable by unauthorized users.

View All Tags

THM | Password Attacks

· 27 min read

Red Teaming | Password Attacks | Summary:​

This room is designed to teach about various strategies and techniques used in cracking or guessing passwords. It covers both offline and online methods, including dictionary and brute-force attacks, rule-based attacks, and custom rules.

The room emphasizes password profiling, teaching users how to create effective wordlists using default, weak, leaked, combined, and username sources.

Other topics include keyspace techniques, CUPP (Custom Password Profile), and online attacks targeting FTP, SMTP, SSH, and HTTP login pages. Additionally, it introduces the concept of password spraying attacks.

HTB | Jerry | Write-Up

· 13 min read

Summary:​

We navigate the Hack The Box website, starting by spawning a target machine. Next, we perform reconnaissance on the target to gather initial information. We identify a running webserver and proceed with directory enumeration using gobuster to uncover hidden directories. After discovering a server status login page with default credentials, we log in to gain access to the Manager App website.

Analyzing this app further, we collect the necessary credentials to log in and then identify a file upload vulnerability on the website. We create a malicious payload using msfvenom, which we use to upload and execute a reverse shell on the target machine. With a stable shell established at system level access, we proceed to grab both the user flag and root flag, ultimately achieving System Own status.

Machine Name: Jerry | Difficulty: Easy | OS: Windows

HTB | Unified | Write-Up

· 20 min read

Summary:​

We test connectivity and scan the target, then enumerate its web app and identify vulnerabilities. We find a Log4Shell vulnerability and exploit it using Metasploit to get a reverse shell connection with low-level access. From there, we grab the user flag and use our access to modify the admin credentials in the MongoDB database. We then log in as admin and change the recorded SSH credentials to ones under our control, granting us root privileges. Finally, we obtain the root flag.

Machine Name: Unified | Difficulty: Easy | OS: Linux

HTB | Pennyworth | Write-Up

· 10 min read

Summary:​

This article guides users through completing the Pennyworth machine challenge on Hack The Box. Here we conduct reconnaissance on a Jenkins server, discovering a login page and default credentials, as well as a vulnerable Script Console that can execute Groovy scripts. We exploit this vulnerability to gain access to the system and retrieve a flag located at "/root/flag.txt".

Machine Name: Pennyworth | Difficulty: Easy | OS: Linux

HTB | Preignition | Write-Up

· 7 min read

Summary:​

This walkthrough provides step-by-step guidance on completing the Preignition machine challenge on Hack The Box, a series of tutorials designed to help beginners complete Tier 0 challenges. The guide covers directory brute-forcing techniques, using nmap and gobuster tools, and submitting the root flag.

Machine Name: Preignition | Difficulty: Easy | OS: Linux