UnderPass (HTB) CTF write-up

Objective

This is a write-up for UnderPass, an easy level difficulty vulnerable machine on HackTheBox. Note that at the time of this publication the machine is still active, so big spoilers and hints are to be used with caution. To access the full document with explanation, please download the PDF file from above.

Skills Learned

• UDP port scanning
• What is daloRadius and how does it work.
• MD5 hash cracking
• Mosh service, operation, and privilege escalation.

Tools Used

• Kali Linux, and through it:
  • nmap
  • snmpwalk
  • hashcat
  • ssh
  • scp
  • manual PE enumeration
  • LinPEAS
  • mosh service
• daloRADIUS

Steps

1. UDP port scanning:

2. daloRADIUS login:

3. Users list:

4. MD5 hash cracking:

5. SSH & User flag:

6. scp file transfer of LinPEAS:

7. LinPEAS result:

8. Mosh as sudo:

9. Mosh connection:

10. Root & the flag