{"id":575,"date":"2025-09-01T01:52:20","date_gmt":"2025-09-01T01:52:20","guid":{"rendered":"https:\/\/infosecjake.net\/?p=575"},"modified":"2025-09-01T01:52:23","modified_gmt":"2025-09-01T01:52:23","slug":"hackthebox-dog-walkthrough","status":"publish","type":"post","link":"https:\/\/infosecjake.net\/?p=575","title":{"rendered":"HackTheBox – Dog Walkthrough"},"content":{"rendered":"\n

Back again with another box from HackTheBox. This time, a box called Dog. Let\u2019s see if we can get Fido here to give us the flags we need.<\/p>\n\n\n\n

First off, as usual, we start with an NMAP scan.<\/p>\n\n\n\n

\"nmap<\/figure>\n\n\n\n
\"Adding<\/figure>\n\n\n\n

Above, we also add the hostname & ip address to our \/etc\/hosts\/ file for easy browsing.<\/p>\n\n\n\n

I also ran a different NMAP scan, this time doing some further enumeration. As we can see, there appears to be a git repo hosted on the site and several things in the robots.txt file.<\/p>\n\n\n\n

\"alt<\/figure>\n\n\n\n

So, it looks like we have a web application running on port 80 and an SSH server on port 22. Let\u2019s add the IP and host name to our \/etc\/hosts file and browse the website.<\/p>\n\n\n\n

\"website<\/figure>\n\n\n\n

Quickly browsing the site we see there is a login page, which shows to be powered by Backdrop CMS. So, let\u2019s do some digging into Backdrop CMS and see if there\u2019s any potential vulnerabilities we can exploit to get into the site.<\/p>\n\n\n\n

\"CMS<\/figure>\n\n\n\n

So, after finding the login page and looking up some known vulnerabilities for Backdrop CMS, I also spent some time digging through the items in the robots.txt file.<\/p>\n\n\n\n

\"robots.txt\"<\/figure>\n\n\n\n

One of the things I was also able to find outside of this was a git repository, as shown below.<\/p>\n\n\n\n

\"git<\/figure>\n\n\n\n

So, with this repo being open, I downloaded it to my VM and spent some time digging through it for anything interesting. FYI \u2013 I created a folder called dog on my desktop to store all relevant files from this machine. Good place to put the git repo.<\/p>\n\n\n\n

\"mirroring<\/figure>\n\n\n\n
\"Repo<\/figure>\n\n\n\n

After spending some time, and re-downloading the git repository, I was able to find a settings.php file that contained a password.<\/p>\n\n\n\n

mysql:\/\/root:BackDropJ2024DS2024@127.0.0.1\/backdrop<\/p>\n\n\n\n

Of course, I tried to login to SSH with root and this password, but that did not work. So, I then dug a bit deeper and noticed on one of the JSON files there was a username. Tiffany@dog.htb<\/a>.<\/p>\n\n\n\n

Perhaps this is the username & password for the login page on the website?<\/p>\n\n\n\n

\"logged<\/figure>\n\n\n\n

Bingo, logged in as Tiffany!<\/p>\n\n\n\n

Now that we are in, let\u2019s see what kind of exploits Backdrop has. For this, I\u2019m going to do some searching on exploit DB.<\/p>\n\n\n\n

https:\/\/www.exploit-db.com\/exploits\/52021<\/a><\/p>\n\n\n\n

Went to exploit db and just searched for Backdrop and found the RCE vuln listed above. So, let\u2019s see if we can use this.<\/p>\n\n\n\n

Downloaded the exploit above and ran it as shown below.<\/p>\n\n\n\n

\"exploit<\/figure>\n\n\n\n

However, on the \u2018install modules\u2019 section, noting that we are not allowed to install zip files.<\/p>\n\n\n\n

\"file<\/figure>\n\n\n\n

So, we must unpack and repack as a tar file.<\/p>\n\n\n\n

\"tar<\/figure>\n\n\n\n

Now that we have our file packaged correctly, let\u2019s upload it.<\/p>\n\n\n\n

\"Adding<\/figure>\n\n\n\n

Finally! Now, we just follow what the script said to do and visit the URL where it will trigger the RCE shell.<\/p>\n\n\n\n

NOTE: Do not<\/strong> navigate away from the page above. Open the exploit in a new page. I had to re-install because it didn\u2019t work when I navigated away from the success page above.<\/p>\n\n\n\n

Now, we have a command prompt when we visit the URL the script noted.<\/p>\n\n\n\n

\"Exe<\/figure>\n\n\n\n

Let\u2019s see if we can find any users that have\u00a0 bash access.<\/p>\n\n\n\n

\"Users<\/figure>\n\n\n\n

I ran cat \/etc\/passwd | grep bash and found a user by the name of johncusack and one by jobert.<\/p>\n\n\n\n

NOTE: I had to keep re-uploading the exploit as it would sporadically stop working. This took a bit of time.<\/p>\n\n\n\n

Let\u2019s try SSH with johncusack and the original password we found in the git.<\/p>\n\n\n\n

\"user<\/figure>\n\n\n\n

Well then, I really wasn\u2019t expecting that to work. Now for the user flag!<\/p>\n\n\n\n

\"user<\/figure>\n\n\n\n

For privilege escalation, I did a quick check of \u2018sudo -l\u2019 to see what sudo permissions this user has.<\/p>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

Let\u2019s have a look at this bee file.<\/p>\n\n\n\n

(just kidding\u2026the box stopped responding on me and I had to restart it\u2026oof)<\/p>\n\n\n\n

Ok, back up. Did a bit of research and found this github about Bee. https:\/\/github.com\/backdrop-contrib\/bee<\/a><\/p>\n\n\n\n

Bee is a CLI for Backdrop CMS. I ran Bee and looked at the available command line options as well.<\/p>\n\n\n\n

\"Bee\"<\/figure>\n\n\n\n

Down at the very bottom is an option \u2018ev\u2019. So, let\u2019s give that a try and see if we can access the root flag.<\/p>\n\n\n\n

NOTE: You HAVE to be in the \/var\/www\/html directory as I\u2019m assuming it\u2019s due to Backdrop running there. Otherwise you\u2019ll get a lovely error that the \u2018required bootstrap level for \u2018eval\u2019 is not ready\u2019.<\/p>\n\n\n\n

\"Error<\/figure>\n\n\n\n
\"Root<\/figure>\n\n\n\n

And we have the root flag! Ideally, we would want to login as root. But, that should be easy to do from here by either changing root password or grabbing the hash and cracking it.<\/p>\n\n\n\n

Hope you enjoyed this one! Had several issues throughout this one that made it drag on longer than it should have, but we got it done and that\u2019s all that matters.<\/p>\n\n\n\n

Remember, it\u2019s all about persistence. I may not detail it as well as I should but these can take several hours or more to work through, depending on how hard they are. While the walkthroughs are short, the actual process of doing them isn\u2019t. So, don\u2019t feel overwhelmed or that you can\u2019t do it, take a break, gather your thoughts, and hit it again. You got this!<\/p>\n","protected":false},"excerpt":{"rendered":"

Back again with another box from HackTheBox. This time, a box called Dog. Let\u2019s see if we can get Fido<\/p>\n

Continue readingHackTheBox – Dog Walkthrough<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":600,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[31],"tags":[33,34],"class_list":["post-575","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf-challenge-walkthroughs","tag-ctf","tag-walkthrough"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/infosecjake.net\/wp-content\/uploads\/2025\/09\/Dog.png","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/infosecjake.net\/index.php?rest_route=\/wp\/v2\/posts\/575","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosecjake.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosecjake.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosecjake.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosecjake.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=575"}],"version-history":[{"count":1,"href":"https:\/\/infosecjake.net\/index.php?rest_route=\/wp\/v2\/posts\/575\/revisions"}],"predecessor-version":[{"id":599,"href":"https:\/\/infosecjake.net\/index.php?rest_route=\/wp\/v2\/posts\/575\/revisions\/599"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infosecjake.net\/index.php?rest_route=\/wp\/v2\/media\/600"}],"wp:attachment":[{"href":"https:\/\/infosecjake.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=575"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosecjake.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=575"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosecjake.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=575"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}