# Preignition (Tier 0)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 0
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Custom Applications / Apache / Reconnaissance / Web Site Structure Discovery\
  &#x20;             / Default Credentials

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FpThSyRUTZyFWgOJn9QCg%2Fimage.png?alt=media&#x26;token=9929762e-8c43-4e89-956d-744850afcd91" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=0">https://app.hackthebox.com/starting-point?tier=0</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With a little research, I started answering the first questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FkHqFe71OZGAsG91nhuNC%2Fimage.png?alt=media&#x26;token=62db0877-2d08-48a1-88ed-7ac37b2dfe20" alt=""><figcaption></figcaption></figure>

> Answer: _**dir busting**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FMY1h959GDYuqdOIuRWtz%2Fimage.png?alt=media&#x26;token=435ff491-a672-432d-9e02-822c3cd7db3b" alt=""><figcaption></figcaption></figure>

> Answer: _**-sV**_

***

* Then I continue doing an initial port scan of the machine using [_Nmap_](../../../networks/tools-and-utilities#nmap)

{% code lineNumbers="true" %}
```bash
nmap 10.129.218.32 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fys7ES6fCfGEOU2DMYRWs%2Fimage.png?alt=media&#x26;token=8541d889-26f3-4b2f-87b5-778c04be5f0d" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FKmDcF5lJhx8tN7kgFIOk%2Fimage.png?alt=media&#x26;token=16689f90-ba9e-4102-aabf-019c061dff42" alt=""><figcaption></figcaption></figure>

> Answer: _**http**_

***

* I also did an exhaustive scan of the ports we found to get information about the services running

{% code lineNumbers="true" %}
```bash
nmap 10.129.218.32 -p80 -sVC -oN serv_scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FChMTOQufIucyBbHVVS5e%2Fimage.png?alt=media&#x26;token=efd5e25c-0537-422b-a737-b0d62e3da346" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F5ZDw3Pjsc2JR6jOXb3iI%2Fimage.png?alt=media&#x26;token=7efa58ec-92e9-4df9-bd30-5187f145a416" alt=""><figcaption></figcaption></figure>

> Answer: _**nginx 1.14.2**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrYKtjmF8OfI0udPTLJZY%2Fimage.png?alt=media&#x26;token=68d73f81-edb8-4847-8166-9fbfae4af624" alt=""><figcaption></figcaption></figure>

> Answer: _**dir**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FR1dkxYwQCnrdPppdBp4V%2Fimage.png?alt=media&#x26;token=874209b7-1ccf-41fc-a0cf-673c0e23a398" alt=""><figcaption></figcaption></figure>

> Answer: _**-x php**_

***

* As I found a port running the HTTP protocol, I checked the content deployed via the web browser, where I just found a default page for the [_Nginx_](https://nginx.org/en/) server

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZIWCEpea3Q4u2P78mbzD%2Fimage.png?alt=media&#x26;token=7b822c1b-aaa2-44f4-98b7-53ce651d773f" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* Checking the source code didn't give me any relevant information, so I tried to fuzz the URL of the site using [_gobuster_](../../../web-exploitation/tools-and-utilities#gobuster), and with that, I found there was an available route in the _/admin.php_ direction

{% code overflow="wrap" lineNumbers="true" %}
```bash
gobuster dir -u http://10.129.218.32/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -o fuzz.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fo8kq7ZL1bMKWGaMPMcrQ%2Fimage.png?alt=media&#x26;token=f2783baa-0336-4c81-b06a-22ba7b100a49" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FkEKxnUqy4SwZkiJBSeB1%2Fimage.png?alt=media&#x26;token=c54cc049-6891-4b5f-be9b-4ef85da09c7f" alt=""><figcaption></figcaption></figure>

> Answer: _**admin.php**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FHx98NKXJd0LwKYbwn57B%2Fimage.png?alt=media&#x26;token=4f5f0248-60dc-4c78-a505-a96ffbac2d0b" alt=""><figcaption></figcaption></figure>

> Answer: _**200**_

***

* So I went to this site and found there was a login page, where I tried to log in using common credentials, and discovered that using the combination of username _admin_ and password _admin_, I logged in successfully, seeing a message that gave me the root flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FBLnMkhPDG17dkYA1U7d6%2Fimage.png?alt=media&#x26;token=af843535-fa94-4095-9664-3d04a130acad" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F8Qf3nUbhnnse3FQtm4Q5%2Fimage.png?alt=media&#x26;token=72e7bdfb-ac38-4690-bded-d5507437a508" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAJNJA9zQa10PurMdoG1I%2Fimage.png?alt=media&#x26;token=4807d32b-9f75-4295-9941-054c33325e9e" alt=""><figcaption></figcaption></figure>

> Answer: _**6483bee07c1c1d57f14e5b0717503c73**_
