Skip to content

Commit 5eb5c08

Browse files
momenbaselmomenbasel
committed
Add GitHub links to all tool tables + Sink writeup
- Add clickable GitHub/website links to tool names across all 8 challenge categories - Categories updated: Pwn, Reversing, Forensics, Blockchain, AI/ML, OSINT, Hardware, Stego, Mobile - Add Sink (Insane) machine writeup as example submission - Links to external writeup: https://0xmmn.blogspot.com/2023/09/hackthebox-sink-machine-insane.html
1 parent 15ba72b commit 5eb5c08

10 files changed

Lines changed: 129 additions & 73 deletions

File tree

‎challenges/ai-ml/index.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,9 @@ def fgsm_attack(image, epsilon, gradient):
7272

7373
| Tool | Purpose |
7474
|------|---------|
75-
| Garak | LLM vulnerability scanner |
76-
| ART (Adversarial Robustness Toolbox) | Adversarial ML attacks/defenses |
77-
| TextAttack | NLP adversarial attack framework |
78-
| Rebuff | Prompt injection detection |
79-
| LangChain | LLM application framework |
80-
| Ollama | Local LLM deployment |
75+
| [Garak](https://github.com/NVIDIA/garak) | LLM vulnerability scanner |
76+
| [ART](https://github.com/Trusted-AI/adversarial-robustness-toolbox) | Adversarial ML attacks/defenses |
77+
| [TextAttack](https://github.com/QData/TextAttack) | NLP adversarial attack framework |
78+
| [Rebuff](https://github.com/protectai/rebuff) | Prompt injection detection |
79+
| [LangChain](https://github.com/langchain-ai/langchain) | LLM application framework |
80+
| [Ollama](https://github.com/ollama/ollama) | Local LLM deployment |

‎challenges/blockchain/index.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,10 @@ forge create src/Exploit.sol:Exploit --rpc-url http://challenge:8545 --private-k
5454

5555
| Tool | Purpose |
5656
|------|---------|
57-
| Foundry (forge/cast) | Solidity development and interaction |
58-
| Hardhat | JavaScript-based development environment |
59-
| Remix IDE | Browser-based Solidity IDE |
60-
| Etherscan | Block explorer |
61-
| Slither | Static analysis for Solidity |
62-
| Mythril | Symbolic execution for smart contracts |
63-
| Echidna | Fuzzing for smart contracts |
57+
| [Foundry](https://github.com/foundry-rs/foundry) (forge/cast) | Solidity development and interaction |
58+
| [Hardhat](https://github.com/NomicFoundation/hardhat) | JavaScript-based development environment |
59+
| [Remix IDE](https://remix.ethereum.org/) | Browser-based Solidity IDE |
60+
| [Etherscan](https://etherscan.io/) | Block explorer |
61+
| [Slither](https://github.com/crytic/slither) | Static analysis for Solidity |
62+
| [Mythril](https://github.com/Consensys/mythril) | Symbolic execution for smart contracts |
63+
| [Echidna](https://github.com/crytic/echidna) | Fuzzing for smart contracts |

‎challenges/forensics/index.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -42,16 +42,16 @@ Writeups for HTB Digital Forensics challenges.
4242

4343
| Tool | Purpose | Common Usage |
4444
|------|---------|-------------|
45-
| Volatility 3 | Memory analysis | `vol -f dump.raw windows.pslist` |
46-
| Wireshark | PCAP analysis | GUI packet inspection |
47-
| tshark | CLI PCAP analysis | `tshark -r capture.pcap -Y "http"` |
48-
| Autopsy | Disk forensics | GUI disk image analysis |
49-
| binwalk | Firmware/file extraction | `binwalk -e firmware.bin` |
50-
| foremost | File carving | `foremost -i disk.img` |
45+
| [Volatility 3](https://github.com/volatilityfoundation/volatility3) | Memory analysis | `vol -f dump.raw windows.pslist` |
46+
| [Wireshark](https://www.wireshark.org/) | PCAP analysis | GUI packet inspection |
47+
| [tshark](https://www.wireshark.org/) | CLI PCAP analysis | `tshark -r capture.pcap -Y "http"` |
48+
| [Autopsy](https://www.autopsy.com/) | Disk forensics | GUI disk image analysis |
49+
| [binwalk](https://github.com/ReFirmLabs/binwalk) | Firmware/file extraction | `binwalk -e firmware.bin` |
50+
| [foremost](https://github.com/korczis/foremost) | File carving | `foremost -i disk.img` |
5151
| strings | String extraction | `strings -n 8 binary` |
52-
| exiftool | Metadata extraction | `exiftool image.jpg` |
53-
| CyberChef | Data transformation | Encoding, decoding, crypto |
54-
| FTK Imager | Disk imaging | Forensic image creation |
52+
| [exiftool](https://github.com/exiftool/exiftool) | Metadata extraction | `exiftool image.jpg` |
53+
| [CyberChef](https://github.com/gchq/CyberChef) | Data transformation | Encoding, decoding, crypto |
54+
| [FTK Imager](https://www.exterro.com/digital-forensics-software/ftk-imager) | Disk imaging | Forensic image creation |
5555

5656
## Analysis Categories
5757

‎challenges/hardware/index.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,11 @@ Writeups for HTB Hardware hacking challenges.
3737

3838
| Tool | Purpose |
3939
|------|---------|
40-
| binwalk | Firmware extraction and analysis |
41-
| firmware-mod-kit | Firmware modification |
42-
| Saleae Logic | Logic analyzer software |
43-
| PulseView/sigrok | Open-source signal analysis |
40+
| [binwalk](https://github.com/ReFirmLabs/binwalk) | Firmware extraction and analysis |
41+
| [firmware-mod-kit](https://github.com/rampageX/firmware-mod-kit) | Firmware modification |
42+
| [Saleae Logic](https://www.saleae.com/) | Logic analyzer software |
43+
| [PulseView/sigrok](https://sigrok.org/wiki/PulseView) | Open-source signal analysis |
4444
| baudrate.py | UART baud rate detection |
45-
| flashrom | SPI flash reading/writing |
46-
| OpenOCD | JTAG/SWD debugging |
47-
| Audacity | Audio/signal analysis |
45+
| [flashrom](https://github.com/flashrom/flashrom) | SPI flash reading/writing |
46+
| [OpenOCD](https://github.com/openocd-org/openocd) | JTAG/SWD debugging |
47+
| [Audacity](https://www.audacityteam.org/) | Audio/signal analysis |

‎challenges/mobile/index.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -63,11 +63,11 @@ objection> android root disable
6363

6464
| Tool | Purpose |
6565
|------|---------|
66-
| jadx | APK to Java decompilation |
67-
| apktool | APK resource decompilation |
68-
| Frida | Dynamic instrumentation |
69-
| Objection | Runtime mobile exploration |
70-
| MobSF | Automated mobile analysis |
71-
| adb | Android Debug Bridge |
72-
| Genymotion | Android emulator |
73-
| Burp Suite | Traffic interception |
66+
| [jadx](https://github.com/skylot/jadx) | APK to Java decompilation |
67+
| [apktool](https://github.com/iBotPeaches/Apktool) | APK resource decompilation |
68+
| [Frida](https://github.com/frida/frida) | Dynamic instrumentation |
69+
| [Objection](https://github.com/sensepost/objection) | Runtime mobile exploration |
70+
| [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) | Automated mobile analysis |
71+
| [adb](https://developer.android.com/tools/adb) | Android Debug Bridge |
72+
| [Genymotion](https://www.genymotion.com/) | Android emulator |
73+
| [Burp Suite](https://portswigger.net/burp) | Traffic interception |

‎challenges/osint/index.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,11 @@ exiftool image.jpg
6666

6767
| Tool | Purpose |
6868
|------|---------|
69-
| Maltego | Link analysis and visualization |
70-
| theHarvester | Email, subdomain, name collection |
71-
| Sherlock | Username search across platforms |
72-
| SpiderFoot | Automated OSINT collection |
73-
| exiftool | Image metadata extraction |
74-
| Shodan | Internet device search |
75-
| Censys | Internet-wide scanning data |
76-
| OSINT Framework | Collection of OSINT tools |
69+
| [Maltego](https://www.maltego.com/) | Link analysis and visualization |
70+
| [theHarvester](https://github.com/laramies/theHarvester) | Email, subdomain, name collection |
71+
| [Sherlock](https://github.com/sherlock-project/sherlock) | Username search across platforms |
72+
| [SpiderFoot](https://github.com/smicallef/spiderfoot) | Automated OSINT collection |
73+
| [exiftool](https://github.com/exiftool/exiftool) | Image metadata extraction |
74+
| [Shodan](https://www.shodan.io/) | Internet device search |
75+
| [Censys](https://search.censys.io/) | Internet-wide scanning data |
76+
| [OSINT Framework](https://osintframework.com/) | Collection of OSINT tools |

‎challenges/pwn/index.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -71,12 +71,12 @@ checksec --file=binary
7171

7272
| Tool | Purpose |
7373
|------|---------|
74-
| pwntools | Python exploit development framework |
75-
| GDB + GEF/pwndbg | Dynamic debugging |
76-
| ROPgadget | Find ROP gadgets |
77-
| one_gadget | Find one-shot RCE gadgets in libc |
78-
| checksec | Check binary protections |
79-
| ropper | Alternative ROP gadget finder |
80-
| patchelf | Patch ELF binary interpreter/rpath |
81-
| seccomp-tools | Analyze seccomp filters |
82-
| Ghidra | Static analysis/decompilation |
74+
| [pwntools](https://github.com/Gallopsled/pwntools) | Python exploit development framework |
75+
| [GDB](https://www.sourceware.org/gdb/) + [GEF](https://github.com/hugsy/gef)/[pwndbg](https://github.com/pwndbg/pwndbg) | Dynamic debugging |
76+
| [ROPgadget](https://github.com/JonathanSalwan/ROPgadget) | Find ROP gadgets |
77+
| [one_gadget](https://github.com/david942j/one_gadget) | Find one-shot RCE gadgets in libc |
78+
| [checksec](https://github.com/slimm609/checksec.sh) | Check binary protections |
79+
| [ropper](https://github.com/sashs/Ropper) | Alternative ROP gadget finder |
80+
| [patchelf](https://github.com/NixOS/patchelf) | Patch ELF binary interpreter/rpath |
81+
| [seccomp-tools](https://github.com/david942j/seccomp-tools) | Analyze seccomp filters |
82+
| [Ghidra](https://github.com/NationalSecurityAgency/ghidra) | Static analysis/decompilation |

‎challenges/reversing/index.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,15 @@ Writeups for HTB Reverse Engineering challenges.
5454

5555
| Tool | Purpose |
5656
|------|---------|
57-
| Ghidra | Primary decompiler and disassembler (free, NSA) |
58-
| IDA Free | Industry-standard disassembler |
59-
| radare2/rizin | CLI reverse engineering framework |
60-
| GDB + GEF | Dynamic analysis and debugging |
61-
| Binary Ninja | Modern binary analysis platform |
62-
| dnSpy | .NET assembly editor and debugger |
63-
| jadx | Java/Android decompiler |
64-
| x64dbg | Windows debugger |
65-
| Cutter | GUI for radare2 |
57+
| [Ghidra](https://github.com/NationalSecurityAgency/ghidra) | Primary decompiler and disassembler (free, NSA) |
58+
| [IDA Free](https://hex-rays.com/ida-free) | Industry-standard disassembler |
59+
| [radare2](https://github.com/radareorg/radare2)/[rizin](https://github.com/rizinorg/rizin) | CLI reverse engineering framework |
60+
| [GDB](https://www.sourceware.org/gdb/) + [GEF](https://github.com/hugsy/gef) | Dynamic analysis and debugging |
61+
| [Binary Ninja](https://binary.ninja) | Modern binary analysis platform |
62+
| [dnSpy](https://github.com/dnSpy/dnSpy) | .NET assembly editor and debugger |
63+
| [jadx](https://github.com/skylot/jadx) | Java/Android decompiler |
64+
| [x64dbg](https://github.com/x64dbg/x64dbg) | Windows debugger |
65+
| [Cutter](https://github.com/rizinorg/cutter) | GUI for radare2 |
6666
| strace/ltrace | System/library call tracing |
6767

6868
## Approach

‎challenges/stego/index.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -96,13 +96,13 @@ strings output.pdf | grep -i flag
9696

9797
| Tool | Purpose |
9898
|------|---------|
99-
| steghide | JPEG steganography |
100-
| zsteg | PNG/BMP LSB analysis |
101-
| stegsolve | Visual analysis GUI |
102-
| Audacity | Audio analysis |
103-
| Sonic Visualiser | Advanced audio spectrogram |
104-
| exiftool | Metadata extraction |
105-
| binwalk | Embedded file extraction |
106-
| foremost | File carving |
107-
| stegcracker | Steghide brute-force |
108-
| openstego | Various stego techniques |
99+
| [steghide](https://github.com/StefanoDeVuworst/steghide) | JPEG steganography |
100+
| [zsteg](https://github.com/zed-0xff/zsteg) | PNG/BMP LSB analysis |
101+
| [stegsolve](https://github.com/Giotino/stegsolve) | Visual analysis GUI |
102+
| [Audacity](https://www.audacityteam.org/) | Audio analysis |
103+
| [Sonic Visualiser](https://www.sonicvisualiser.org/) | Advanced audio spectrogram |
104+
| [exiftool](https://github.com/exiftool/exiftool) | Metadata extraction |
105+
| [binwalk](https://github.com/ReFirmLabs/binwalk) | Embedded file extraction |
106+
| [foremost](https://github.com/korczis/foremost) | File carving |
107+
| [stegcracker](https://github.com/Paradoxis/StegCracker) | Steghide brute-force |
108+
| [openstego](https://github.com/syvaidya/openstego) | Various stego techniques |

‎machines/insane/Sink/README.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Sink
2+
3+
![Machine Badge](https://img.shields.io/badge/Machine-Sink-blue)
4+
![OS](https://img.shields.io/badge/OS-Linux-orange)
5+
![Difficulty](https://img.shields.io/badge/Difficulty-Insane-red)
6+
7+
| Property | Value |
8+
|----------|-------|
9+
| **OS** | Linux |
10+
| **Difficulty** | Insane |
11+
| **Tags** | #web #http-smuggling #aws #cloud #gitea #secrets-management |
12+
13+
---
14+
15+
## Summary
16+
17+
Sink is an Insane Linux machine featuring HTTP request smuggling through a HAProxy/Gunicorn desync to hijack admin sessions, followed by exploitation of a Gitea instance containing AWS secrets. Privilege escalation involves abusing AWS Secrets Manager and KMS to decrypt sensitive credentials.
18+
19+
---
20+
21+
## External Writeup
22+
23+
- [Full Writeup by 0xMMN](https://0xmmn.blogspot.com/2023/09/hackthebox-sink-machine-insane.html)
24+
25+
---
26+
27+
## Key Techniques
28+
29+
- HTTP Request Smuggling (CL.TE desync)
30+
- HAProxy / Gunicorn misconfiguration
31+
- Session hijacking via smuggled requests
32+
- Gitea repository enumeration
33+
- AWS Secrets Manager enumeration
34+
- AWS KMS key decryption
35+
- Cloud credential chaining
36+
37+
---
38+
39+
## Attack Path Overview
40+
41+
1. **Enumeration** - Discover HAProxy fronting a Gunicorn backend with a web application
42+
2. **HTTP Request Smuggling** - Exploit CL.TE desync between HAProxy and Gunicorn to smuggle requests and steal admin session cookies
43+
3. **Admin Access** - Use hijacked session to access admin panel, discover Gitea credentials
44+
4. **Gitea Exploitation** - Enumerate Gitea repositories, find AWS access keys and secrets in commit history
45+
5. **AWS Secrets Manager** - Use discovered AWS credentials to list and retrieve secrets from AWS Secrets Manager
46+
6. **AWS KMS** - Decrypt encrypted secrets using AWS Key Management Service
47+
7. **Root** - Use decrypted credentials for root access
48+
49+
---
50+
51+
## Lessons Learned
52+
53+
- HTTP request smuggling remains a critical vulnerability in proxy/backend architectures
54+
- Secrets stored in version control (even private repos) can be extracted from git history
55+
- AWS credential chains across services (IAM -> Secrets Manager -> KMS) can lead to full compromise
56+
- HAProxy and Gunicorn have known desync issues when Content-Length and Transfer-Encoding headers conflict

0 commit comments

Comments
 (0)