# Ignition (Tier 1)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark>**&#x20;1**
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Common Applications / Magento / Reconnaissance / Web Site Structure Discovery\
  &#x20;             / Weak Credentials

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FewK9w4ltHFJBVyJLiTk6%2Fimage.png?alt=media&#x26;token=99a107e6-49cf-4bff-b588-9f62863b60ab" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=1</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

{% code lineNumbers="true" %}
```bash
nmap 10.129.246.174 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F4618IthAbAbzTxpviNew%2Fimage.png?alt=media&#x26;token=3cda2d94-a641-443d-b122-a5716bc28bb3" alt=""><figcaption></figcaption></figure>

***

* Then I did an exhaustive scan to learn more about the services running on the open ports

{% code lineNumbers="true" %}
```bash
nmap 10.129.246.174 -p80 -sVC -oN serv_scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fie92eahxcldoXOu8eTh9%2Fimage.png?alt=media&#x26;token=6ed39661-a8c7-47d7-8228-696e7166117d" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fb4YjQ7qkqXrrKUA6Lhda%2Fimage.png?alt=media&#x26;token=2ef5a738-1903-416c-ab21-a22271072fad" alt=""><figcaption></figcaption></figure>

> Answer: _**nginx 1.14.2**_

***

* As I found the HTTP protocol running on port 80, I visited the deployed content in the browser. When I tried to reach the site using the IP address, it redirected me to the _ignition.htb_ domain whose content wasn't possible to display

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FlO6NHfsLgRG669Tlh7zo%2Fimage.png?alt=media&#x26;token=76fe703e-15e2-4616-b379-e8decf32a2d0" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* To check what could be happenin,g I used the `curl` command to get information from the response of the petition sent to the web. This could be because I didn't have the domain in our list of known hosts. So to solve that, I added it to the _/etc/hosts and &#x61;_&#x66;ter that visited the site again and it worked properly

{% code overflow="wrap" lineNumbers="true" %}
```bash
curl -v http://10.129.246.174
echo '10.129.246.174 ignition.htb' >> /etc/hosts
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbeeqtN7aXIJhIBx6Xl3B%2Fimage.png?alt=media&#x26;token=f07f1095-ac89-4086-a06e-cb57de68d3d0" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FzsNZzuiv1nlR42SKTtim%2Fimage.png?alt=media&#x26;token=445ffe5a-f620-4023-b899-6b1b0f746171" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fkepxsx9sDCMs1aTmXYAZ%2Fimage.png?alt=media&#x26;token=5a4c1143-5a54-406b-bee7-d50f94414bfb" alt=""><figcaption></figcaption></figure>

> Answer: _**302**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGGZpuRj4wyTrDjEEiSy7%2Fimage.png?alt=media&#x26;token=ea67058c-4bdb-4e06-8bcb-c007360c47cc" alt=""><figcaption></figcaption></figure>

> Answer: _**ignition.htb**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FKHx4uejdhLVzGwA1h70f%2Fimage.png?alt=media&#x26;token=f0766af6-2acc-4823-92fc-493d533cfd6a" alt=""><figcaption></figcaption></figure>

> Answer: _**/etc/hosts**_

***

* I explored the features of the page but didn't find anything relevant, so I tried fuzzing the URL using [_Gobuster_](../../../web-exploitation/tools-and-utilities#gobuster) to find some possible directories and files exposed on the web

{% code overflow="wrap" lineNumbers="true" %}
```bash
gobuster dir -u http://ignition.htb -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -o fuzz.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FVbaJmzUXPhC8BOGvmCYA%2Fimage.png?alt=media&#x26;token=f3bcafa5-4069-49da-b237-712ee652bab4" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* I found some interesting routes, the most relevant being the _/admin_ route, so I navigated there to see the content and found a login page for the [_Magento_](https://business.adobe.com/co/products/magento/magento-commerce.html) CMS

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FKvoTbTYHU29KMz16D9Vv%2Fimage.png?alt=media&#x26;token=0f76b9d1-ad25-45b1-9091-64199ec16e1b" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbSasTm7rTpNG4csazELa%2Fimage.png?alt=media&#x26;token=cbc14cb8-0dd0-4f42-9a0b-2d9b80105a63" alt=""><figcaption></figcaption></figure>

> Answer: _**http://ignition.htb/admin**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FeR6EoK9D22I6yfCaeAXR%2Fimage.png?alt=media&#x26;token=6f29cc01-71a9-455d-bced-0937110e1bf5" alt=""><figcaption></figcaption></figure>

> Answer:&#x20;

***

* As I didn't have any credentials, I tried using some common credentials, and doing a little [research](https://community.spiceworks.com/t/most-common-passwords-of-2023-the-top-10/963430) about this topic, I found that by using the username _admin_ and the password _qwerty123_ I gained access to the administrator dashboard. Finally, looking at the deployed content, I found the flag at first sight

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbeAZBm5PVdX9ii6fsuPW%2Fimage.png?alt=media&#x26;token=b0eb22e6-9ba3-41e2-a50d-a074dfd3f5cc" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7IT97FbkPlTo5KtwskbE%2Fimage.png?alt=media&#x26;token=04037b77-8ec9-429a-87d1-9f8e19d957fe" alt=""><figcaption></figcaption></figure>

> Answer: _**797d6c988d9dc5865e010b9410f247e0**_
