search

Skills Assessment

hashtag
Scenario:

CAT5's team has secured a foothold into Inlanefrieght's network for us. Our responsibility is to examine the results from the recon that was run, validate any info we deem necessary, research what can be seen, and choose which exploit, payloads, and shells will be used to control the targets. Once on the VPN or from your Pwnbox, we will need to RDP into the foothold host and perform any required actions from there. Below you will find any credentials, IP addresses, and other info that may be required.

hashtag
Objectives:

  • Demonstrate your knowledge of exploiting and receiving an interactive shell from a Windows host or server.

  • Demonstrate your knowledge of exploiting and receiving an interactive shell from a Linux host or server.

  • Demonstrate your knowledge of exploiting and receiving an interactive shell from a Web application.

  • Demonstrate your ability to identify the shell environment you have access to as a user on the victim host.

Complete the objectives by answering the challenge questions below.

hashtag
Credentials and Other Needed Info:

Foothold:

  • IP:

  • Credentials: htb-student / HTB_@cademy_stdnt! Can be used by RDP.

hashtag
Connectivity To The Foothold

Connection Instructions: Accessing the Skills Assessment lab environment will require the use of XfreeRDParrow-up-right to provide GUI access to the virtual machine. We will be connecting to the Academy lab like normal utilizing your own VM with a HTB Academy VPN key or the Pwnbox built into the module section. You can start the FreeRDP client on the Pwnbox by typing the following into your shell once the target spawns:

You can find the target IP, Username, and Password needed below:

  • Click below in the Questions section to spawn the target host and obtain an IP address.

    • IP ==

    • Username == htb-student

    • Password == HTB_@cademy_stdnt!

Once you initiate the connection, you will be required to enter the provided credentials again in the window you see below:

hashtag
XFreeRDP Login

Login screen for FreeRDP with fields for session, username, and password.

Enter your credentials again and click OK and you will be connected to the provided Parrot Linux desktop instance.

Network diagram with three hosts: Host-01 at 172.16.1.11:8080, Host-02 at blog.inlanefreight.local, Host-03 at 172.16.1.13, and a foothold labeled 'See target spawn'.

Hosts 1-3 will be your targets for this skills challenge. Each host has a unique vector to attack and may even have more than one route built-in. The challenge questions below can be answered by exploiting these three hosts. Gain access and enumerate these targets. You will need to utilize the Foothold PC provided. The IP will appear when you spawn the targets. Attempting to interact with the targets from anywhere other than the foothold will not work. Keep in mind that the Foothold host has access to the Internal inlanefreight network (172.16.0.0/23 network) so you may want to pay careful attention to the IP address you pick when starting your listeners.

  • What is the hostname of Host-1? (Format: all lower case)

First, connect via RDP to the machine on scoop

Once do that, we can see the etc hosts for locate other hosts -->

With it, i run a nmap to 172.16.1.11 to detect ports -->

Here we can see it

  • Exploit the target and gain a shell session. Submit the name of the folder located in C:\Shares\ (Format: all lower case)

This deskto that we connect, it havent firefox or other navegator, so... we need weak up ssh server and do a ssh tunneling -->

Note: This host has two upload vulnerabilities. If you look at status.inlanefreight.local or browse to the IP on port 8080, you will see the vector. When messing with one of them, the creds ” tomcat | Tomcatadm ” may come in handy.

Now create the revershell -->

And connect via ssh to 10.129.204.126 to weak up the nc in 666

Now, upload the file and target him -->

And cd C:\Shares\

  • What distribution of Linux is running on Host-2? (Format: distro name, all lower case)

Go away to us linux machine provided and execute nmap

  • What language is the shell written in that gets uploaded when using the 50064.rb exploit?

Hint : Have you taken the time to validate the scan results? Did you browse to the webpage being hosted? blog.inlanefreight.local looks like a nice space for team members to chat. If you need the credentials for the blog, “ admin:admin123!@# “ have been given out to all members to edit their posts. At least, that’s what our recon showed.

Login admin:admin123!@#

php

  • Exploit the blog site and establish a shell session with the target OS. Submit the contents of /customscripts/flag.txt

Do again ssh tunneling to the website of this host -->

But! he is blind, so... connect via RDP to the linux machine provided and execute msfconsole -->

PreviousWeb ShellsNextUsing the Metasploit Framework

Last updated