Hack The Box - Brainfuck

Difficulty (self‑assessed): tricky
Focus: SSL/TLS enumeration, WordPress exploitation, IMAP enumeration, credential discovery, SSH login

🎯 Objective

Gain initial access and retrieve the user flag on brainfuck.htb using web/app-layer enumeration and misconfigurations. (Root was completed later but is not expanded here.)

🧭 Scope & Notes

• Host added to /etc/hosts: 10.10.10.17 brainfuck.htb
• Primary surface seen: HTTPS (443) and IMAP (143)
• WordPress present on HTTPS virtual host.
• All screenshots preserved from notes.

🔎 Recon & Enumeration

Nmap

nmap -sC -sV -oA nmap 10.10.10.17

SSL certificate review

• Tool used during notes: sslyze --regular 10.10.10.17
• From browser inspection of the certificate:
  • SANs: www.brainfuck.htb, sup3rs3cr3t.brainfuck.htb
  • Email: orestis@brainfuck.htb

These names guided WordPress enumeration and later credential hunting.

🧱 WordPress Enumeration & Foothold (no upload rights)

WPScan

wpscan --url https://brainfuck.htb --disable-tls-checks --enumerate u

• --disable-tls-checks because the cert isn’t valid.
• Detected components included WP Support Plus Responsive Ticket System.

Admin toolbar trick

1. Host a local PoC page (notes used a simple HTTP server and myexploit.html).
2. After clicking “login”, a blank white page loaded:
3. Remove /wp-admin/admin-ajax.php from the URL and go back to https://brainfuck.htb — the admin toolbar appears:

Attempting a standard “Upload reverse shell” path failed because there was no write access via the Theme/Editor: ![No write access]

SMTP plugin clue

While digging around, a SMTP plugin page (not initially flagged by WPScan) revealed credentials in the page source: Extracted password from source:

kHGuERB29DNiNE

✉️ IMAP Enumeration → Forum Credentials

Connected to IMAP on 143 (per Nmap). Example command flow from notes:

a1 LOGIN orestis kHGuERB29DNiNE
a2 LIST "" "*"
a3 EXAMINE INBOX
a4 FETCH 1 BODY[]
a5 FETCH 2 BODY[]

Recovered message content revealed “secret forum” credentials:

username: orestis
password: kIEnnfEKJ#9UmdO

Logged into the forum and found three threads:

🔐 SSH Key Retrieval & Login

A private key was obtained from a protected path:

wget https://10.10.10.17/8ba5aa10e915218697d1c658cdee0bb8/orestis/id_rsa --no-check-certificate
chmod 600 id_rsa
# (Optional) Prepare for cracking if needed:
# python sshng2john.py id_rsa > id_rsa.hash
# john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt

Then SSH as orestis:

ssh -i id_rsa orestis@10.10.10.17

🏁 User Flag

From notes:

cat user.txt:2c11cfbc5b959f73ac15a3310bd097c9

Other captured hash string in notes:

6efc1a5dbb8904751ce6566a305bb8ef

🧠 Lessons Learned

• SSL/TLS certs are loot: SANs and emails frequently expose alternate vhosts and users.
• When WPScan misses a plugin, manual browsing + page-source review can still yield creds.
• Mailbox pivot: IMAP/POP often stores onboarding info, “secret forum” logins, or passwords.
• Keep artifacts: Keys, hashes, and screenshots accelerate re-verification later.

🧰 Commands Cheat Sheet (from session notes)

# Hosts setup
echo "10.10.10.17 brainfuck.htb" | sudo tee -a /etc/hosts

# Recon
nmap -sC -sV -oA nmap 10.10.10.17
sslyze --regular 10.10.10.17

# WordPress enumeration
wpscan --url https://brainfuck.htb --disable-tls-checks --enumerate u

# IMAP (example dialogue)
telnet brainfuck.htb 143
# a1 LOGIN orestis kHGuERB29DNiNE
# a2 LIST "" "*"
# a3 EXAMINE INBOX
# a4 FETCH 1 BODY[]

# Download & use SSH key
wget https://10.10.10.17/8ba5aa10e915218697d1c658cdee0bb8/orestis/id_rsa --no-check-certificate
chmod 600 id_rsa
ssh -i id_rsa orestis@10.10.10.17