HTB VALENTINE WALK-THROUGH

HackTheBox is an excellent platform for various pen-testers to increase their testing skills and knowledge.
Machine Level -Easy
Machine Name -Valentine
Machine OS -Linux
Machine IP -10.10.10.79
Tools:
Nmap -Nmap is a fantastic tools for scanning the open ports, services and OS detection. You can use other tools other than nmap (which ever you are more comfortable with ) like masscan, SPARTA etc. to scan for open ports.
Method:
Scanning the machine is the first step(i.e. Enumeration).
Use the command sudo nmap -sSVS 10.10.10.79, this will scan for open ports and services on the host.

This box focuses on port 443.
Let's start the enumeration by visiting the IP address 10.10.10.79

Just an image. Nothing else. Is it all for this page?
No, actually this image is an important clue, if you look at the image, there's a heart and its bleeding.
That's the clue, the Heartbleed bug.

This bug allowed the attacker  to steal data, do eavesdropping, read the files etc.
That's what we do in enumeration. Information collection.
I found a python script for Heartbleed bug.
Save it in a file and Use this against the victim.

Command

python heartbleed.py 10.10.10.79 -p 443

(this command launches the heartbleed exploit on the machine at port 443)

We got some text here. But seems like it is encoded.
I decoded it by using base64, the command is

echo "aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==" | base64 --decode

Decoded text is heartbleedbelievethehype
What could this be? Maybe a password.
Let's keep this as a possible password.
So, where do we login in?
Let's do directory busting and see if we find anything.
Using dirb tool command

dirb http://10.10.10.79/

Now what looks interesting to me is the dev directory.
Let's visit this.

There's nothing in notes.txt, let's visit the hype_key.
There's a hex dump data. Let's convert it into the text file using an online hex decoder.

Decoded data is a private key.
(Save this file as rsakey.key)

Let's review what we know, we have
1)Possible password ------  heartbleedbelievethehype
2)Private key
3)Name of the file was hype_key, it's possible that hype is a user.
Port 22(ssh) is open.
Let's try to connect over ssh
Use the command

chmod 400 rsakey.key

(this command gives user read permission and removes all other permissions)
Then connecting command for ssh

ssh -i rsakey.key [email protected]

It asks for passphrase so let's use heartbleedbelievethehype , and try to login.

Login successful.
Let's see what command can we use.
Let's grab the user flag first.
Unlike other Linux boxes, this box has a simpler method to gain root.
Use command cat .bash_history to see the bash commands history.

Seems like a tmux session has been created, let's use this session.
Use command tmux -S /.devs/dev_sess

We are root. It's easy, isn't it.
Grab the root flag.

That's all for this machine.
Take-back ->The heartbleed bug led us to gaining a shell on this machine.

Thanks for reading!