Writeup: HackTheBox Beep - Without Metasploit (OSCP Prep)
Tags: security, webdev, hacking
Published: 2020-12-01 01:17:37

#**Beep HackTheBox Write Up**

Hello all and welcome back! Apologies for the long delay, between COVID and work things have been kind of picking up. But I am trying to pick things back up while also doing a WebDev Bootcamp.

**Difficulty level: Easy**
*Time to complete: 30mins*

I will start off by running a **Nmap Scan** to see services running and for the ports.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/f8gxf6ywqocwa3re2ww2.png)

Some background on what I am doing here. 
-sV = version detection scan
-sC = runs default scripts
-v  = verbose
-Pn = checks to see if the host is alive
-p- = scans all ports
-A = detailed information on scripts 
-T4 = speed things up

Alright so after sometime I get some results from my scan.

The main things that standout to me are the following:
 *22 TCP Open SSH*
 *80 TCP Open Http*

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/myjolat8nb69kzud30dd.png)

The reason why these two ports are really interesting to me is that you if you ever worked as an System Administrator, you've come across Open SSH ports that allowed you to get into your systems. Also with an Open Http means there is a website there so its just a little more visually appealing for me lol.

So being that port 80 is open I am going to checkout the site to see what it looks like.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/abs9wsgd79zg49q32u9n.png)

Nothing too interesting here so I spin up *Dirbuster*. Which is a multi-threaded Java application to brute force directories and file names on web/app servers.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/vw016llpyevpuptsknk5.png)

But after going to a few of these sites I quickly realize that I don't have access to the sites.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/zd6ooaktbtzp1hhd854m.png)

But one thing to highlight is the text at the bottom of the sign-in page that showed *Elastix*. Some quick googling and also searching *SearchSploit*

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/zvkmonbd67k3ikbdpi3e.png)

I come across the following Exploit 37637 which I will get a little further details on. Exploit-DB is a great resource to learn more about Exploits that you want to run. But you should always read the code before running and test them out to make sure its not making a call back to some Bad actor or someone is giving you a Rick-Roll.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/b111e6edcnfa7diqixtq.png)

This attack vector allows for us to view files and execute local scripts in the context of the web server process.

We should focus on the following line from the exploit. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/c13ru51pbruo52v3fyaw.png)

Now copy and paste this at the end of Web address.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/yl2bajp05i4wfobn1lxk.png)

After hitting *Enter* once you put that text in the search bar you will get the following output. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/n7bupk2hkimiaax0pe9b.png)


Right-click and click *View Page Source*. The output should now be beautified so that its easier to read. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/odvzcuww2iqf2h8vlro4.png)

So I will try to login into the SSH server with the password that I found from the dump.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/xq3fd4im6okmuborpqbs.png)

Boom, we are able to get in!

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/9d8bdlolbkpuwro1o1cp.png)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/igep8jgga92icrmvk3i6.png)

Thank you so much for coming to my Ted talk!