Compiled Discussion [HTB] [HINTS]

HackTheBox
1

Let’s discuss Compiled

2

I am just starting to solve it. Give me some time.

3

For initial foothold, I’ll try to exploit CVE-2024-32002. If the server clones recursively, we can get a RCE. Now looking for a PoC.

4

I am using this but can’t get a shell.

5

Okay, I figured it out. You just need to paste a domain name into the compile site, not an IP. I got the reverse shell and was enumerating the machine when I found a .db file. I’m extracting hashes from it.

Use this script to convert to Hashcat format:

import base64

salt = bytes.fromhex('SALT_HEX')
hash = bytes.fromhex('PWD_HEX')
rounds = 50000

base64_hash = base64.b64encode(hash)
base64_salt = base64.b64encode(salt)

print(f"sha256:{rounds}:{base64_salt.decode()}:{base64_hash.decode()}")

Then run:

hashcat -m 10900 -a 0 -o cracked.txt hash.txt rockyou.txt
6

Privilege escalation to root is a death.

7

Reset the machine if the root exploit does not work, even after you have modified and rebuilt it.

8

Want to add here that Evil-WinRM will not work on the last steps of this box.