Ignition

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 1 Machine: Ignition Released: 06/10/2021

MACHINE SYNOPSIS

Ignition is a very easy Linux machine that features basic enumeration of web applications and virtual host resolution. Upon enumerating open services, an Nginx web server is discovered which requires local domain name resolution to be accessed properly. After enumerating the website and conducting directory fuzzing, a Magento admin panel can be found with weak credentials.

Preparations

There are several methods to connect to the target machine. Throughout this walkthrough, we use the provided pwnbox.

Once our connection is established, we spawn the target machine.

Additionally – though not required – we can set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we access it by prepending $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost
<target-hosts-ip>
user@kali:~$

We can remove the variable with the unset command when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: Which service version is found to be running on port 80?

nginx 1.14.2

We begin the reconnaissance phase with a connectivity check.

user@kali:~$ ping $rhost -c 4
...
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
...
user@kali:~$

Next, we use Nmap to scan the target – here, only the top 1000 TCP ports – for available services.

user@kali:~$ nmap -sV $rhost 
...
PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.14.2
...
user@kali:~$

Task-2

Question: What is the 3-digit HTTP status code returned when you visit ‘http://<machine-IP>/’?

302

We use curl to inspect the HTTP response.

user@kali:~$ curl http://$rhost/ -v
...
> GET / HTTP/1.1
> Host: 10.129.131.157
> User-Agent: curl/7.88.1
> Accept: */*
> 
< HTTP/1.1 302 Found
< Server: nginx/1.14.2
...
< Location: http://ignition.htb/
...
user@kali:~$

Task-3

Question: What is the virtual host name the webpage expects to be accessed by?

ignition.htb

The answer appears in the HTTP response from the previous task.

Alternatively, fingerprinting the server with whatweb yields the same result.

user@kali:~$ whatweb $rhost 
... RedirectLocation[http://ignition.htb/]...
user@kali:~$

Task-4

Question: What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?

/etc/hosts

Attempting to access the webpage – ignition.htb – results in an error.

user@kali:~$ curl http://ignition.htb
curl: (6) Could not resolve host: ignition.htb
user@kali:~$

We resolve this by manually adding the host-to-IP mapping to our hosts file. On the pwnbox, which runs Parrot OS (based on Debian), this file is located at /etc/hosts.

user@kali:~$ echo -e "# ignition box | host -> ip resolution\n$rhost ignition.htb" | sudo tee -a /etc/hosts
# ignition box | host -> ip resolution
10.129.131.157 ignition.htb
user@kali:~$ cat /etc/hosts
...
# ignition box | host -> ip resolution
10.129.131.157 ignition.htb
user@kali:~$

Task-5

Question: Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?

http://ignition.htb/admin

Here we use Gobuster in directory discovery mode – dir – with the common DIRB wordlist – /usr/share/wordlists/dirb/common.txt.

user@kali:~$ gobuster dir -u http://ignition.htb/ -w /usr/share/wordlists/dirb/common.txt 
...
/0                    (Status: 200) [Size: 25803]
/admin                (Status: 200) [Size: 7095] 
/catalog              (Status: 302) [Size: 0] [--> http://ignition.htb/]
/checkout             (Status: 302) [Size: 0] [--> http://ignition.htb/checkout/cart/]
/cms                  (Status: 200) [Size: 25817]                                     
/contact              (Status: 200) [Size: 28673]                                     
/enable-cookies       (Status: 200) [Size: 27176]                                     
/errors               (Status: 301) [Size: 185] [--> http://ignition.htb/errors/]     
/Home                 (Status: 301) [Size: 0] [--> http://ignition.htb/home]          
/home                 (Status: 200) [Size: 25802]                                     
/index.php            (Status: 200) [Size: 25815]                                     
/media                (Status: 301) [Size: 185] [--> http://ignition.htb/media/]      
/opt                  (Status: 301) [Size: 185] [--> http://ignition.htb/opt/]        
/rest                 (Status: 400) [Size: 52]                                        
/robots.txt           (Status: 200) [Size: 1]                                         
/robots               (Status: 200) [Size: 1]                                         
/setup                (Status: 301) [Size: 185] [--> http://ignition.htb/setup/]      
/soap                 (Status: 200) [Size: 391]                                       
/static               (Status: 301) [Size: 185] [--> http://ignition.htb/static/]     
/wishlist             (Status: 302) [Size: 0] [--> http://ignition.htb/customer/account/login/referer/aHR0cDovL2lnbml0aW9uLmh0Yi93aXNobGlzdA%2C%2C/]
...
user@kali:~$

The /admin endpoint appears most promising, so we navigate to it.

We have located the admin login page for Magento.

Task-6

Question: Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?

qwerty123

During our research into Magento password requirements, we encounter the following:

…
Magento requires a minimum of seven characters (both letters and numbers). We recommend using something a bit more robust – a 10–12 character alphanumeric password. Pro-tip: Do not try to think of a password yourself.
…

Thus, the admin password is likely at least seven characters. Additionally, we find the following list of most common passwords for 2023:

Given the seven-character minimum requirement, our list narrows to the following:

Testing these one by one proves successful. The credentials for the Magento instance are as follows:

• Username: admin
• Password: qwerty123

Submit The Flag

Upon logging in, we are immediately greeted with the flag.

Question: Submit root flag

<redacted-flag>

Congratulations – we have completed the challenge. All that remains is to terminate the target box (if not terminated automatically) before proceeding to the next challenge.