(RETIRED)Lame ~ Hack the box(OSCP)

Brought to you by

Spenge @hackthebox.eu

@SpengeSec on twitter

Today we’re going for a quick and easy root, I’m starting this series of OSCP like boxes as a prep for my road towards OSCP Certification.

Start by editing /etc/hosts

Like always we add the IP(10.10.10.3) of the box to our hosts file as (possible) domain lame.htb

NMAP ~ Enumeration

To begin enumerating i start off with a nmap scan on the target. I’ve gotten a bash script that automates scanning, which comes in very handy if you’re taking the OSCP exam. In all the write ups ill be using this script.
But a nmap -p- -sT -sV -sC -oN initial-scan luke.htb, gobuster & nikito will be sufficient too.
You can find the script i use here: click

Metasploit ~ Exploitation

We use msfconsole to run the exploit we found with searchsploit specifically crafted for metasploit(msf).

Begin by typing a show options, this lists only the RHOST and RPORT option to be set. We can go ahead and set the RHOST <IP> and leave the RPORT default,as it uses the default port as shown in our previous nmap results.

We are greeted with a shell, and a quick whoami shows us we are root!

Getting the flags

I’ve made use of the find command to quickly find the flag files located on the system.

And we do run the same find command to locate the root flag file, and use cat to display its contents!