Hack The Box - Haircut Part 1

🎯 Objective

Gain a foothold on the target via command execution, upgrade to an interactive TTY, and retrieve the user flag.

🧩 Environment & Tools

• DirBuster / gobuster for content discovery
• Burp Suite (Repeater) for tampering requests
• Python HTTP server to host payloads
• Netcat for reverse shell listener
• Python3 TTY upgrade for an interactive shell

🔎 Recon

Directory brute force

Wordlist:

/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Results revealed a few interesting endpoints worth manual testing.

🧨 Exploitation

1) Host a payload locally

I spun up a quick web server to stage payloads:

python -m SimpleHTTPServer 8081
# (or) python3 -m http.server 8081

Created a simple shell/payload to pull or trigger from the target:

2) Command execution via the vulnerable endpoint

Using Burp Repeater, I verified OS command execution with basic commands (e.g., ls, pwd) and then leveraged it to fetch/execute the payload from my HTTP server.

Proof of directory listing from the vulnerable endpoint:

Shell obtained:

🧰 Post‑Exploitation

Upgrade to a TTY

The target only had Python 3 readily usable, so I upgraded the shell:

python3 -c 'import pty; pty.spawn("/bin/bash")'

From there, navigation and interaction became much smoother.

🏁 Proof / Flag

Navigated to the user’s home directory and read the flag:

🧪 Commands Used (Quick Reference)

# Recon
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

# Stager
python3 -m http.server 8081     # or: python -m SimpleHTTPServer 8081
nc -lvnp 1337

# TTY upgrade
python3 -c 'import pty; pty.spawn("/bin/bash")'

🛡️ Mitigations (Defender Notes)

• Validate and sanitize all user inputs; do not pass unsanitized data to system commands.
• Prefer parameterized calls or safe libraries (avoid system(), exec*(), backticks, etc.).
• Apply allow‑lists for expected values; reject everything else.
• Run web apps with least privilege; restrict egress to prevent payload fetching.
• Centralize logging & alerting on suspicious command patterns or outbound fetch attempts.

🏷️ Tags

HackTheBox, Command Injection, Burp Suite, TTY Upgrade, Recon, Linux