// -

Craft is a medium difficulty Linux box, hosting a Gogs server with a public repository. One of the issues in the repository talks about a broken feature, which calls the eval function on user input. This is exploited to gain a shell on a container, which can query the database containing a user credential. After logging in, the user is found to be using Vault to manage the SSH server, and the secret for which is in their Gogs account. This secret is used to create an OTP which can be used to SSH in as root.

CCTV is a medium difficulty Linux machine from Hack The Box. Nmap Scan As usual, we start with an nmap scan. 1nmap -sT -sV -sC -oA nmap/cctv 10.129.3.52 Port 80 is open. The webpage itself is relatively static. Following the staff login link we land on a ZoneMinder instance. ⚠ Machine Still Active This machine is currently active on Hack The Box. The full writeup will be published once it retires.

Interpreter is a medium difficulty Linux machine from Hack The Box. Nmap Scan As usual, we start with an nmap scan. Port 22 is open running OpenSSH on Debian, and ports 80 and 443 are also up. 1PORT STATE SERVICE VERSION 222/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0) First thing I check is whether HTTP and HTTPS return the same content, and they do.

CriticalOps is a web challenge from Hack The Box. The goal is to find a JWT signing key that was left exposed in client-side TypeScript code, then use it to forge a token with elevated privileges and grab the flag. What is a JWT? A JSON Web Token (JWT) is a compact, URL-safe way for two parties to pass claims between each other. You see them a lot in web authentication: after you log in, the server gives you a token that proves who you are, and you send it along with every request so the server knows to trust you.

Underpass is a beginner-friendly CTF from Hack The Box. It’s a great challenge for testing essential skills like basic reconnaissance and Linux privilege escalation. Initial Recon As usual, we begin with an nmap scan. I performed a SYN scan using the -sS flag for detailed output, but a regular TCP connect scan (-sT) would work just as well. To be thorough, I also ran a full UDP scan. Since these scans can be time-consuming and I’m taking these screenshots after completing the challenge, I specified the port numbers manually to speed up the process.