# Sense

This is my write-up for the machine **Sense** on Hack The Box located at: <https://app.hackthebox.com/machines/Sense>.

nmap scan: `nmap -T4 -A -v -Pn 10.10.10.60 -oN sense.nmap`

```
PORT    STATE SERVICE  VERSION
80/tcp  open  http     lighttpd 1.4.35
|_http-server-header: lighttpd/1.4.35
|_http-title: Did not follow redirect to https://10.10.10.60/
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
443/tcp open  ssl/http lighttpd 1.4.35
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 082559A7867CF27ACAB7E9867A8B320F
|_ssl-date: TLS randomness does not represent time
|_http-title: Login
| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US
| Issuer: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2017-10-14T19:21:35
| Not valid after:  2023-04-06T19:21:35
| MD5:   65f8 b00f 57d2 3468 2c52 0f44 8110 c622
|_SHA-1: 4f7c 9a75 cb7f 70d3 8087 08cb 8c27 20dc 05f1 bb02
|_http-server-header: lighttpd/1.4.35
```

There are two ports open, on port 80, we see the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-b3e3e69b4bbe86496686e54e0d051b60941f4045%2Fimage.png?alt=media)

It seems that pfSense is running on the system. I tried the default credentials of **admin**:**pfsense**, but that did not work out. I ran a **dirsearch** command (`dirsearch -u https://10.10.10.60/`) to see what I was able to get access to and found this:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-32c3a33cf4e4734128ea3544391c9cda021df0e3%2Fimage.png?alt=media)

There still seems to be one vulnerability in place. I ran different searches in the directory to try to find something else, but came up short. When I viewed the official write-up to see what I missed, apparently running the lowercase medium word-list in **dirbusters** word-list directory would have shown me an IP\_Address/system-users.txt file:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-f4b5ca10031191da9d59da52bec59db9f79a6eb4%2Fimage.png?alt=media)

The company defaults for pfSense was **pfsense**. The credentials **rohit**:**pfsense** got me into the system:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-fb4d0e41e945b55297266569210d34276158ea84%2Fimage.png?alt=media)

Searching for "pfsense" on **metasploit** showed me a couple of results for exploits. I chose one and then fixed the options to work for this box:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-5bfadf2fc09d82c338d4a02ea57f3537a11bb1ef%2Fimage.png?alt=media)

I then had a reverse shell:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-e7429a22623cfc39d45ef8af03949197d373614d%2Fimage.png?alt=media)

I was then able to find the user.txt flag in **rohit**'s home directory:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-5802a73afc78ca598539716693314d87077e22b1%2Fimage.png?alt=media)

I was then able to get the root flag as well:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-c0bda94a41b35db31907beaa444f33dcae7d48f9%2Fimage.png?alt=media)
