Skip to main content

Introduction

This is my second walkthrough for a HTB machine.

While it is rated as "medium", I believe that I have truly learnt a lot from this box as well as gain a deeper understanding into binary exploitation and Local File Inclusion (LFI).

Retired stats

Thoughts​

Overall a tough and interesting machine. It requires a combination of various knowledge from multiple domains spanning from web to binary exploitation and even an interesting privilege escalation vector!

Overview​

This machine was rooted in about 12 hours. As always, I am grateful for the helpful and subtle hints available in the HackTheBox official forum. Here's a breakdown of the chain of events:

  1. Nmap Scans to discover open ports and services
  2. Enumerating the discovered web service
  3. Finding hidden HTML pages via fuzzing
  4. Exploiting Local File Inclusion (LFI) to reveal source code
  5. Discovering internal running services (binaries)
  6. Planning and writing an exploit to pwn the binary
  7. Using soft links to gain arbitrary file read access and escalate to the dev user
  8. Discover about binfmt_misc and learning about its misconfiguration
  9. Exploiting binfmt_misc to gain root!