> For the complete documentation index, see [llms.txt](https://harisqazi.gitbook.io/portfolio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://harisqazi.gitbook.io/portfolio/write-ups/hack-the-box/solidstate.md).

# SolidState

This is my write-up for the Hack The Box machine called **SolidState** located at: <https://app.hackthebox.com/machines/SolidState>.

nmap scan:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-a83757451bd7097b030c1fb22deb3ec189e52d77%2Fimage.png?alt=media)

The basic nmap scan shows 4 ports open. However, in the machine tags, we see the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-d62938e5b721b1473ca882efc7ec5034c2518710%2Fimage.png?alt=media)

It seems that our basic nmap scan did not catch any web ports (80 or 443). I then ran a deeper nmap scan (`nmap -T4 -A -v -Pn 10.10.10.51 -oN solidstate.nmap`)which led me to find out port 80 is open as well:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-17a380fdedd76fc485a78d192165b22c671965f8%2Fimage.png?alt=media)

Going to the the website, we see a message submission box:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-af2325ea5a29378fe9ee7ee08c8bb02992afc1cd%2Fimage.png?alt=media)

Maybe this might be used for command execution or a reverse shell process? I then ran **dirsearch** (`dirsearch -e php,html,js,cgi,bak,txt -u http://10.10.10.51 -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt`) on the IP Address to see if there are items we have access to:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-f00002a2b3dc414cddc0b578cefdb066acd68d05%2Fimage.png?alt=media)

Looking at the files in those directories led me to a dead end. I then wanted to enumerate the smtp users to see that maybe there is a user whose mailbox I can get access to. I ran the command `smtp-user-enum -M VRFY -U rockyou.txt -t 10.10.10.51` for this. After the program ran for a while, I turned it off, since I had not gotten any result from this. I then found an exploit on Metasploit that had an exploit exactly for this version:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-1d99d7e3e3d6c850a75a182e3a5a2d1028e97ef9%2Fimage.png?alt=media)

I tried various settings to get it to work, however I was not able to do so. While browsing this exploit on Metasploit, I realized the default credentials loaded into the exploit were **root**:**root**. I had a hunch that I should try this out, but I did not follow it. Looking at the official Hack The Box write-up for this machine, I realized that I was right. Also, I had found out that my nmap scan had missed port 4555. I was able to login into the port using those credentials:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-7d1a1f1c845b2d69b05759e423b171085170033f%2Fimage.png?alt=media)

When we run **listusers** we see the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-35ae0462b0ba376c906025a47c392265751603ca%2Fimage.png?alt=media)

After I was stuck for a while, I found out from the official write-up that I was looking at the wrong exploit, and the correct one was: <https://www.exploit-db.com/exploits/35513>. I then also learned that we have to modify this exploit to make it to work. If we got to [this GitHub page (swisskyrepo)](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#bash-tcp) we can see commands we can use for reverse shells. I then added one of the Bash TCP payloads and edited the python file:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-8e4894c26387c929cffd073a08a3006794ef2c67%2Fimage.png?alt=media)

On another terminal, I ran a netcat listener to wait for the reverse shell:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-d6a224c93275dc0235df171e63e4f4ac5ee0d867%2Fimage.png?alt=media)

After you run the python script (on another terminal), you get the following message:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-869e867911c300157cb40c92bd8e9e428d39698c%2Fimage.png?alt=media)

The payload was submitted, but I was not able to get a shell. I realized the netcat listener was not going to come in handy for this, so I closed it. The official write-up stated that I should change the password for the user **mindy** and then login to her account:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-c4b48738d11e2dcb668775af3c8314488bc974b9%2Fimage.png?alt=media)

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-58a119b93869415cd7ba429a9e8793e398a0a479%2Fimage.png?alt=media)

Reading the second email shows us the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-7064691b996394faaa67121e64cddabcb2e83cdc%2Fimage.png?alt=media)

We can then use these credentials to login to SSH and get the user flag:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-ecfaf7823f1592e8a9221dbba9d46b715c6d15e9%2Fimage.png?alt=media)

Running commands like **wget**, was showing me an error:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-64dbc1197376a113e626097868705d7c3d8dff5e%2Fimage.png?alt=media)

I then found [this website](https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/) that showed me the way to get out of rbash restricted shells:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-58501fb5b83fb0299aacf14ed06df07935e8b2c1%2Fimage.png?alt=media)

I then uploaded **linpeas.sh** to the machine using **python3**:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-1b41754bb0a4eef989e36a60de59087282a89629%2Fimage.png?alt=media)

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-0f032b0c33c3275bacfbb983c2d192b0259f5851%2Fimage.png?alt=media)

For some reason, unknown to me, the **linpeas.sh** script would not run all the way through. I then tried the **LinEnum.sh** script, and that was able to go through. However, it did not show me files that I was able to read/write to on the system. I then viewed the official write-up and [this write-up](https://0xdf.gitlab.io/2020/04/30/htb-solidstate.html) to then learn that there was a python file in the **/opt/** directory:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-ff5e5e0cd570f4ac50333616f233c023245d3d32%2Fimage.png?alt=media)

I tried to overwrite the file with my own, but I did not have permissions to do so:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-abf744a867f1b7075900d2159200b34b3c3bf2dc%2Fimage.png?alt=media)

I found out I can **echo** strings into the file:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-f3d39f66502f2941acf568bae41ccba504cdaec0%2Fimage.png?alt=media)

I had a netcat listener setup on another terminal. Then, one line at a time, I **echo**-ed commands into the file until I had this:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-967b2cd1f9ea3e220f072c419a836f1e3408cad0%2Fimage.png?alt=media)

After a minute, I had the root shell:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-bcf9c8803d31551ea44a175c76c5ff852379aa88%2Fimage.png?alt=media)