# Beep

This is my write-up for the machine **Beep** on Hack The Box located at: [https://app.hackthebox.com/machines/Beep](https://app.hackthebox.com/machines/Beep).

nmap scan: `nmap 10.10.10.7`

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-c7717a12fc253ff2a2626d6e7c1a3f31d33086c8%2Fimage.png?alt=media)

There are a lot of ports open, so I will start with port 80 (HTTP) first. We see a login page there:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-aeace61fce034cd2b38c2041349c9f4d873c0b16%2Fimage.png?alt=media)

I went to port 10000 out of curiosity and found a Webmin login page there:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-29980e7b6898e91070dccef6ed955e4ce564cfad%2Fimage.png?alt=media)

I found this exploit on **exploitdb**:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-21865ef7362bd4a94446ea49d838a72a1a7bde8f%2Fimage.png?alt=media)

I had to go read the official Hack The Box write-up for this machine to find out what I overlooked. Turns out the page I was looking at had the exploit all along:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-af3785fdebc0750c9c6b8c8e2b6ab80d982a8cd0%2Fimage.png?alt=media)

Changing the URL to be **/etc/passwd** shows you the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-ac60bc6356f11ea9434859b4dbd0d86582450929%2Fimage.png?alt=media)

Now we know there is a user called **fanis** on the system. Looking in their directory, we are able to find the flag:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-880b450383fe51f37bfcb0bd9bc5c86c533b2095%2Fimage.png?alt=media)

Going back to the LFI page provided in the LFI exploit, we can see a password:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-68d30ad61e31957ea4d2aeb3f28b1ac63852ea7e%2Fimage.png?alt=media)

From this [write-up](https://dalemazza.github.io/htb/2020/07/04/HTB-Beep-OSCP-Walkthrough.html), I understood if we use this password for the root user, we will be able to log in as root:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-01da87e38ff85cc67b42a2f1e5e71533860ea151%2Fimage.png?alt=media)
