text: What's going on, YouTube? This is IPSEC, and we'll be doing Underpass from Hack the Box, which is a pretty easy box once you get past the initial recon because the initial end map gives you absolutely nothing to go off of. But if you scan UDP, you can see SNMP is open with the default community string. And if you do SNMP walk the box, it tells you the server is hosting a Dallow Radius server, which helps you find the login page for the web server. It has default credentials, and for some reason, DO Radius exposes password hashes of users, which you can crack and then login via SSH. Here you can use pseudo to start a mosh server which stands for mobile shell. So you start it then connect to the shell and get root. So with that being said let's just jump in. As always we start off with an end map. So - sc

title: HackTheBox - Underpass


text: for default scripts sv enumerate versions vv for double verbose. This gives us things like the ttl o a output all formats the end mapap directory and call it underpass and then the IP address which is 10101.48. This can take some time to run so I've already ran it. Looking at the results we have just two ports open. And the first one being SSH on port 22 and the banner tells us it's an Ubuntu server. We also have HTTP on port 80.

title: HackTheBox - Underpass


text: Its banner tells us it's Apache also running on Ubuntu and the title page is just the default Apache to Ubuntu it works page. So let's go ahead and take a look at this. So we can do http 101011.48 and we just see this default page. And since we don't have any type of hostname leakage yet, I'm just going to start off with a go buster to see if there's any hidden directories. Right.

title: HackTheBox - Underpass


text: So we can do a go buster directory mode URL http 1010 1148 and the word list we'll use is optse seclist um discovery web content then raft small words.ext and let that go and see if it finds any directories. And then while that goes we can also test other ports.

title: HackTheBox - Underpass


text: So, we only did like the top 1,00 TCP. I like also testing for like um SNMP when I run into an issue like I can't find anything. So, that's port 161 on UDP.

title: HackTheBox - Underpass


text: So, - S capital U and then 10 10 1148.

title: HackTheBox - Underpass


text: And we can see UD uh SNMP is open. And the reason why I test it specifically because if we just did like -V to test the top 10,00 ports, this scan can take quite a while. So, I like just testing like SNMP, TFTP, um, NFS, and like the port mapper service, which I think is 2049 or something. But those are just a few UDP ports I normally test for right off the start. So, let's go ahead and check out what SNMP has to say. So, we'll do an SNMP walk. Uh, the default community string is going to be public, and then I specify version 2C, which is just the default SNMP version. We can do 101011.48, and we get some information back. Now, this isn't exactly human readable. This is just in uh some SNMP format. We could switch the MIBs to all and it's not working. Okay. So, what we have to do is two things. So, we have to

title: HackTheBox - Underpass


text: do pseudo v etsy snmp then snmp.com and then uncomment this MIBs directory. So, now when I run this um it still didn't do it. So there's probably one other thing I have to do.

title: HackTheBox - Underpass


text: So we have that uncommented. I have to now install the SNMP MIBs downloader. So I think it's that's what this name. So we'll do pseudoapp get install SNMP MIBs downloader. I think that's the program.

title: HackTheBox - Underpass


text: Yes, it is. And I think the whole reason behind this is some like licensing thing where they can't just um give all the MIBs on a default install because it's a weird license violation. I don't fully understand the issue, but I think that's what it is. It doesn't really make sense otherwise to me. So once this installs, we can run that SNMP walk command again.

title: HackTheBox - Underpass


text: And then hopefully we get a bit more information. We can see there it's now processing all the SNMP MIBs. And let's run this same SNMP walk command. And there we go. So now instead of all those numbers, we have human readable names. So let's see what is there here.

title: HackTheBox - Underpass


text: So, we have the uptime, which is two days right now. Uh, we have the kernel version, so we can kind of see the last time this box was updated. Um, let's see. Let's just go to the top and let's see, kernel uptime. Um, and email. So, now we have the host name of the box, which is underpass.htb and it's saying it is the only radius server in the basin. So um this is a hint that is running software called dollar radius. If we search dollar radius on um I guess this is duck.go. Hopefully it brings us to the GitHub page. Uh we have that and then we also have this. So it is running deradius which is open source software. And if we went to this page and just diddall radius we have a HTTP forbidden. So, we found a directory in here. Um, so we can kill off this go buster and then I can focus on the

title: HackTheBox - Underpass


text: dollar radius directory to see if we can get any files inside of it. And we could also just easily test for that. So, if we're on GitHub, I like just searching for like one of the files here. So, normally I do like readme.md because most open source programs have that because that's how um GitHub shows like this thing. So, that's why normally just test.mmd and we can see the file. So, we know right now right off the bat the um http server is configured to just block us on getting the dollar radius folder. But if we specify things um inside of the folder, it seems to work. So looking here, I don't see any login. Uh we have a few directories. We have setup.contrib and app. So I'm going to try slapp to see if we get anything. We still have a forbidden. So maybe it's not um blocking us from this directory.

title: HackTheBox - Underpass


text: Maybe it's just saying there's no um index.html to show directory listings.

title: HackTheBox - Underpass


text: Right? So we have opt common operators and users. So if I try app users. Oh, we get a login. So, let's try also operators to see if that is a login. So, everything looks like it is giving us a login required. So, we want to know what the default credential is.

title: HackTheBox - Underpass


text: So, I'm going to Google default credential dow radius. And if this doesn't pull it up, then I just go search the um GitHub installation to see uh let's see administrator and radius.

title: HackTheBox - Underpass


text: So if we search for administrator and then radius, we get logged in. And I spent some time here trying to find a way to get code execution. Like I tried editing a lot of the config because normally like PHP apps will um do a include config file, right? So normally if you put PHP code somewhere in here uh you can get code execution.

title: HackTheBox - Underpass


text: And I forgot to revert the box. So you still see me editing this allow random characters. But if we try this so if we did PHP um we can do echo test. It doesn't actually save this right. So first it wants to match the requested format. So I'm going to get rid of that. We can switch this to go through burpuite. Go proxy intercept is on. Um we will send and then we'll just put the string at the end like that. And then we can also URL encode it just in case we have to since in the post I don't think we have to but it really does not matter.

title: HackTheBox - Underpass


text: So configuration was updated. I'm going to uh refresh. Wait. Okay. And we have just the same exact string. That's not what I was seeing earlier, but let's see test. Okay, so it um did the sanitization. So it's like cross-sight scripting protection. So it didn't put the actual um less than equal. So that's probably why it did not um execute. So I'm just going to try without URL encoding it real quick. So we'll save it without the PHP string.

title: HackTheBox - Underpass


text: Let's intercept on. We have the post. Put that in. Forward it. Configuration has been updated. Go database. Go back to user.

title: HackTheBox - Underpass


text: So it looks like it's doing sanitization less than equal. So I tried doing this on a lot of fields. I never could get it to um do code execution. So I was going around, we looked at management features. Um if I click on like radius log, we have errors reading the log file. All these logs we can't read. So, I was trying to use this with a um like file disclosure if we could change the log file, but it doesn't look like we can because there's no parameter that will um set the file. Right? When I click data radius log, we're actually going to a PHP file that specifies to access dollar radius. If I go to this radius log, same thing. If it was question mark file is equal to, then you may have a file disclosure vulnerability. But in this case, uh we didn't. So, if we go to management users, let's see, and then list users,

title: HackTheBox - Underpass


text: it actually shows password hashes of users. So, I'm going to see how many characters this is. So, we'll do echo this password hash wc- c. I'm going to do dash n so we don't get the line break at the end. And that's 32. So, this is most likely a MD5 sum. So, we just go to crackstation and input this. We could also use a tool like hashcat to crack it. Um, normally if a password is not salted, then I will just quickly go to um, crackstation, submit it real quick to see if it is. So, let's go crackash. And we get the password underwater friends. And that user is, what is it? SVC mosh. There we go. SVC mosh. So, you can try sshing as that user. So if we do SSH svc mosh at under I don't even think I did the host name of the file. So we do 1010 1148 put in that password and it did not accept it. So

title: HackTheBox - Underpass


text: I'm going to do a capital M because on Linux things are case sensitive and we can see it does have a capital M there.

title: HackTheBox - Underpass


text: Put in the password and there we go. We get logged in. If I do a pseudo-l, we can see I can run the mosh server as root. So I'm going to do a man mosh and see what this is. A mobile shell with remote intelligent local echo. So this looks like it's just a shell. Um let's do mosh-server. Is there a page here? Program helper. Find a local interface.

title: HackTheBox - Underpass


text: Default is UDP port operating system pick the available. So let's see I'm just going to do a pseudo mosh server and we see mosh connect on port 60,01 and then we have this string. If I do a mosh uh client, is that installed?

title: HackTheBox - Underpass


text: It is. I'm going to specify 127001. And let's see, it wants the port as well. So, we'll do that. It says mosh key environment variable not found. So, let's just set that. And I'm guessing this is going to be the key. And there we go. We have successfully gotten root. So Mosh is kind of like a just alternative I guess to SSH that just works over UDP. We stamp the server, it gives us the password, we just connect to it and that's how we get in. So um that's going to be the box. Pretty simple. Hope you guys enjoyed it. Take care and I will see you all next

title: HackTheBox - Underpass