Summary

The findings of the penetration test conducted on “Backdoor” on Hack the Box’s VPN are in the following report.

Key Findings:

A plugin on the main website that allows an attacker to gain access to sensitive information.
Access to internal resources through a publicly exposed debugging server that gives an attacker direct access to the internal network.
A scheduled task running as an administrative user with full access to all resources can be abused by a user at any level to elevate their privilege on the system with a simple command.

These vulnerabilities can lead to a major impact on the confidentiality and integrity of an organizations data. Some recommendations to fix and/or mitigate these types of flaws can be found towards the end of the report.

Preparation

Prior to working on the machine we can start off by creating most of our general working directories with the following script:

#!/usr/bin/zsh

# Ask for target name and IP from user to store as environment for current terminal session
target_machine()
{
  vared -p "Enter the name of your machine: " -c HTB
  vared -p "Enter the target IP address: " -c RHOST

  export HTB="$HTB"
  export RHOST="$RHOST"
}

target_machine

export DOMAIN="$HTB.htb"; # Target domain
export URL="<http://$DOMAIN>" # Target URL http
export URLS="<https://$DOMAIN>" # Target URL https 
export FUZZ="<http://$DOMAIN/FUZZ/>"; # Fuzzing http path
export FUZZS="<https://$DOMAIN/FUZZS/>"; # Fuzzing https path
export SUB="Host: FUZZ.$DOMAIN"; # Fuzzing for subdomains/vhosts

# create baseline directories
mkdir -p $HTB/{creds,enum,files,vulns}; 
cd $HTB; mkdir -p enum/{nmap,fuzzing}; 
mkdir -p files/downloads; 
mkdir -p creds/keys;
mkdir -p vulns/{cves,payloads}

# create baseline files
touch creds/{hashes,creds.txt,passwords.txt,users.txt};

# add host to /etc/hosts
echo $RHOST $DOMAIN | sudo tee -i -a /etc/hosts 1> /dev/null 

echo "[+] $RHOST $DOMAIN has been added to our /etc/hosts file."
echo "[+] We're currently working on the $HTB box on Hack the Box."
echo "[+] Our target IP is $RHOST, at the $DOMAIN domain."
echo "[+] Use $FUZZ as the url for directory brute forcing with ffuf if there is a web-server on the machine."

Recon

Our scan results are shown below.