HackTheBox - Artic Box Writeup

For those who are starting in the cyber security area, the Hack The Box is an online platform that allows you to test your penetration testing skills and you can exchange ideas in the hacking community with thousands of people in the security field.

The platform has a bunch of machines(active and retired) to hack, as also machines to test forensics skills, and when you feel real comfortable you can go for the challenges, pretty awesome.

In this Eigth episode, it will guide you step by step in order to hack the Artic box, Arctic is a beginner-level machine, however the load times on the web server pose a few challenges for exploitation. To get the user flag all you need to do is a basic troubleshooting to get the correct exploit functioning properly, in this case we use the Directory Transversal, getting the password hash and then with a couple of tools decrypt it and login. Once inside the cold fusion, we can create a scheduled task and upload an exploit in order toi get the flag. For the root, we have to use GDSSecurity toa get privilege escalation, anyway, globally, this machine fairly simple to complete. Watch and enjoy, and if you have any comments or suggestions, leave a comment down below.

Have fun...

More to come...

--------------------------------------------------------------

HACK THE BOX SERIES

#1 Hack the Invitation Code -
#2 Hack The Box - Getting Started
#3 Hack The Box - Hacking Lame Box
#4 Hack The Box - Hacking Legacy Box
#5 Hack The Box - Hacking Devel Box
#6 Hack The Box - Hacking Beep Box
#7 Hack The Box - Hacking Optimum Box

--------------------------------------------------------------

USEFUL LINKS:

HACK THE BOX
https://www.hackthebox.eu

DECODERS:
https://cryptii.com
https://www.base64decode.org

EXPLOITS INFO:
https://www.exploit-db.com
https://opendata.rapid7.com/

--------------------------------------------------------------

TOOLS AND EXPLOITS:

NMAP
https://nmap.org

ZENMAP
https://nmap.org/zenmap/

SEARCHSPLOIT
https://www.exploit-db.com/searchsploit

METASPLOIT
https://www.metasploit.com

MSFVENOM
https://www.offensive-security.com/metasploit-unleashed/msfvenom/

NETCAT
http://netcat.sourceforge.net

HASH-IDENTIFIER
https://tools.kali.org/password-attacks/hash-identifier

HASHTOOLKIT
http://hashtoolkit.com

RAINBOW TABLES
https://en.wikipedia.org/wiki/Rainbow_table

SIMPLEHTTPSERVER
https://docs.python.org/2/library/simplehttpserver.html

GDSSECURITY
https://github.com/AonCyberLabs/Windows-Exploit-Suggester

WINDOWS-EXPLOIT-SUGGESTER
https://raw.githubusercontent.com/GDSSecurity/Windows-Exploit-Suggester/master/windows-exploit-suggester.py

MICROSOFT WINDOWS - TRACING REGISTRY KEY ACL PRIVILEGE ESCALATION
https://www.exploit-db.com/exploits/14610

CHIMICHURRI EXECUTABLE
https://github.com/Re4son/Chimichurri

ADOBE COLD FUSION
https://en.wikipedia.org/wiki/Adobe_ColdFusion




--------------------------------------------------------------

FLAVORS OF THE WORLD - Other Videos


"FLAVORS FROM FIGUEIRA DA FOZ from the series Flavors of the world Ep. 4" - https://youtu.be/WF8-be9szLw

"FLAVORS FROM PRAGUE from the series Flavors of the world Ep. 5" - https://youtu.be/VGPVqQB3FwI

"FLAVORS FROM ISTAMBUL from the series Flavors of the world Ep. 6" - https://youtu.be/U9hhCU5-m70

"FLAVORS FROM LONDON from the series Flavors of the world Ep. 7" - https://youtu.be/gQbh3VSNIlE

---------------------------------------------------------------

FOLLOW ME:

FACEBOOK: https://www.facebook.com/paulo.penich...
TWITTER: https://twitter.com/smasher39?lang=pt_pt
INSTAGRAM: https://www.instagram.com/smasher40/?...
500PX.com: https://500px.com/paulopenicheiro

--------------------------------------------------------------