Preignition

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 0 Machine: Preignition Released: 30/09/2021

MACHINE SYNOPSIS

Preignition is a very easy Linux machine which explores beginner enumeration and directory fuzzing of web applications. Upon finding a vulnerable Admin login endpoint, the web app showcases the dangers of improper configuration and default credentials.

Preparations

Several methods exist for connecting to the target machine. Throughout this walkthrough, we use the provided pwnbox.

Once connected, we spawn the target machine.

Additionally – though not required – we can set a local variable (available only in the current shell) containing the target host’s IP address. Once set, we access it by prepending $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can remove this variable with the unset command when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: Directory Brute-forcing is a technique used to check a lot of paths on a web server to find hidden pages. Which is another name for this? (i) Local File Inclusion, (ii) dir busting, (iii) hash cracking.

dir busting

Directory brute-forcing, also known as directory busting or dir busting, systematically enumerates server paths to discover hidden or unlinked resources.

Task-2

Question: What switch do we use for nmap’s scan to specify that we want to perform version detection

-sV

We consult Nmap’s help documentation to identify the appropriate option.

user@kali:~$ nmap --help
...
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
...

Task-3

Question: What does Nmap report is the service identified as running on port 80/tcp?

http

We run a default Nmap scan against the target machine.

user@kali:~$ nmap $rhost 
...
PORT   STATE SERVICE
80/tcp open  http
...
user@kali:~$

Task-4

Question: What server name and version of service is running on port 80/tcp?

nginx 1.14.2

Next, we run nmap with the options identified in Task-2.

user@kali:~$ nmap -sV -p 80 $rhost 
...
PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.14.2
...
user@kali:~$

Task-5

Question: What switch do we use to specify to Gobuster we want to perform dir busting specifically?

dir

We consult Gobuster’s help documentation to determine the correct command.

user@kali:~$ gobuster --help
Usage:
  gobuster [command]

Available Commands:
  dir         Uses directory/file enumeration mode
  dns         Uses DNS subdomain enumeration mode
...
user@kali:~$

Task-6

Question: When using gobuster to dir bust, what switch do we add to make sure it finds PHP pages?

-x php

We examine the help documentation for Gobuster’s directory enumeration mode.

user@kali:~$ gobuster dir --help
Uses directory/file enumeration mode

Usage:
  gobuster dir [flags]

Flags:
...
  -x, --extensions string               File extension(s) to search for
  -r, --follow-redirect                 Follow redirects
...
user@kali:~$

Task-7

Question: What page is found during our dir busting activities?

admin.php

We use the -u flag to specify the target URL and the -w flag to specify the wordlist for directory enumeration.

One commonly used wordlist is located at /usr/share/wordlists/dirb/common.txt, though this may require installation of the Seclists package.

user@kali:~$ gobuster dir -x php -w /usr/share/wordlists/dirb/common.txt -u $rhost
...
/admin.php            (Status: 200) [Size: 999]
/admin.php            (Status: 200) [Size: 999]
...
user@kali:~$

Task-8

Question: What is the HTTP status code reported by Gobuster for the discovered page?

200

The Gobuster enumeration results in Task-7 reveal the HTTP status code.

Submit The Flag

Question: Submit root flag

<redacted-flag>

We navigate to the discovered /admin.php page in a browser to investigate further.

Using a browser, we open http://<target-machine-ip>/admin.php. The page loads a login form requesting a username and password pair.

Given that this is an administrative login page, we hypothesize that the username might be admin.

Testing common default credentials:

• admin:password
• admin:Password
• admin:admin

yields the flag.

Make sure to terminate the target box before you continue with the next machine!