> ## Documentation Index
> Fetch the complete documentation index at: https://www.nthsec.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Underpass: HackTheBox CTF Walkthrough

> HackTheBox Underpass walkthrough: UDP and SNMP enumeration, daloRADIUS default credentials, cracking an MD5 hash, and a mosh-server sudo privilege escalation.

Platform: HackTheBox · Difficulty: Easy · OS: Linux

Underpass is a clever box from HackTheBox which involved digging deep in the enumeration trenches to find the path forward. Default credentials and weak passwords are the name of the game for Easy machines, lets see how Underpass stands up!

![HTB Box Logo](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=db4c9c807a2c6b3423bb3520ec90baa4)

## **Enumeration / Information Gathering**

As always we’re going to start off with a nmap scan to map out the initial attack surface we’re going up against.

![](https://miro.medium.com/v2/resize:fit:700/1*WWwtqr6PWiiCEEkR4iSkYg.png)

Looks like we only have two ports open, 22 (SSH) and 80 (HTTP Web Server).

Checking out the webpage first, it looks like we have a default apache page, which is usually a sign of poor cyber hygiene.

![](https://miro.medium.com/v2/resize:fit:700/1*VRwlupEezrL33-7IHtn9oA.png)

Anytime I see a default web page, my first instinct is to further enumerate for directories or subdirectories. For directory busting my go-to tool is **gobuster.**

```text theme={null}
gobuster dir -u [URL] -w /usr/share/wordlist/dirb/common.txt -t 50
```

![](https://miro.medium.com/v2/resize:fit:700/1*ewRrlc-AL40uZV3lmmsCNQ.png)

Unfortunately, we don’t get any hits. For subdirectory enumeration, I always go for **ffuf.**

```text theme={null}
ffuf -u [URL] -w /usr/share/wordlists/dirb/subdomains-top1iml-20000.txt -H "Host: FUZZ.[hostname/ip]" -ac
```

![](https://miro.medium.com/v2/resize:fit:700/1*mhhSb1S3NFJN8Oqlp3y8Uw.png)

Similarly to gobuster, we don’t get any hits.

With the lack of progress here, I always revert back to my initial enumeration steps. Clearly, there is something here that we’re missing, we just need to double check all of our boxes before moving on.

Starting again with nmap, to uncover new secrets I tried scanning both TCP **and** UDP ports, which comes back successful!

![](https://miro.medium.com/v2/resize:fit:648/1*_t9xbEPsfjJWYok6ZmaQ6w.png)

We have port 161/udp (SNMP) open and a few other ports which we can work on later. For now, we have a new checklist of attack to work with.

*Note: I like to follow the [Hacktricks guides](https://hacktricks.boitatech.com.br/pentesting/pentesting-snmp) for ports I’m unfamiliar with, which was the case here.*

A common tool for SNMP enumeration is **smmpwalk**, which queries a device’s Object Identifiers (OIDs) to retrieve data about the device.

![](https://miro.medium.com/v2/resize:fit:700/1*djwhapjag2c1Fbi9L9IolQ.png)

Looks like we got some good intel! We have a hostname (UnDerPass.htb, *with UDP cleverly highlighted)**,*** a username, **steve,** and the mention of a “daloradius” server.

Daloradius is a web management application for managing hotspots and general-purpose ISP deployments. Since it is web server, let’s check out if it exists on port 80.

![](https://miro.medium.com/v2/resize:fit:543/1*if8IjWNf2FNw2cYBDdHvCQ.png)

Looks like it does, we just don’t have access. Remember there is always more enumeration to be done, as we can return to directory busting with the new discovery!

![](https://miro.medium.com/v2/resize:fit:700/1*O7vpEKXDmLJR1zR-TQztjw.png)

There are a lot of directories here to explore. In order to save some time, I switched to **ffuf**, which support a recursive directory scan.

```text theme={null}
ffuf -u [URL]/daloradius/FUZZ -w /usr/share/wordlists/dirb/big.txt -recursion
```

![](https://miro.medium.com/v2/resize:fit:700/1*1eJW07lZ9F_3__CaAPM1UQ.png)

After some waiting, it looks like it found something quite interesting! A users page?

![](https://miro.medium.com/v2/resize:fit:700/1*1DfA7CvDTjnxSTmNP9bGmQ.png)

Navigating to this users page, we finally are greeted with a login page.

## **Initial Foothold / Exploitation**

![](https://miro.medium.com/v2/resize:fit:700/1*dQeSpQHhJ-HGGk-jRnmPpA.png)

daloRADIUS /users login page

Remember that we already have **steve**’s username, but with any login page I always like to check default credentials first.

![](https://miro.medium.com/v2/resize:fit:700/1*5ySfB5V4Sa4bAfgMQElTUg.png)

Unfortunately no luck on the users login page.

![](https://miro.medium.com/v2/resize:fit:700/1*uztDIyXVO6cIVQlVpZ2adw.png)

Login error after attempting default credentials

However, this is just the users page. daloRADIUS also has an “operators” page, which is essentially just an admin page. This can be found at `/daloRADIUS/app/operators.`

![](https://miro.medium.com/v2/resize:fit:700/1*-cyiF6lXEXBFSyYSXi9Nqw.png)

Let’s try the same `administrator:radius` credentials at this page… and we’re able to successfully login!

![](https://miro.medium.com/v2/resize:fit:700/1*0xzXzmPt5r8gBAbbVUuQXA.png)

From the admin panel, clicking on the “Go to users list” button in the green box, we are presented with a user `svcMosh` and their md5 password hash!

![](https://miro.medium.com/v2/resize:fit:700/1*WgKkZlap_qcnM4lkUmT0Eg.png)

To crack this md5 password, you can use an online tool like [crackstation](https://crackstation.net/), or I prefer to use a more dedicated tool, like **hashcat**.

```text theme={null}
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
```

![](https://miro.medium.com/v2/resize:fit:678/1*raUvKtTpIYQXVVdZzpH4Mg.png)

Now that we have a password, let’s use it! We can successfully SSH in as **svcMosh** and grab the user flag.

![](https://miro.medium.com/v2/resize:fit:700/1*xr2MK1jJvng8dd8UN7O2tA.png)

![](https://miro.medium.com/v2/resize:fit:364/1*UldEUx39_QdRUqvDA6VGWQ.png)

## **Lateral Movement / Privilege Escalation**

As always, a great first step when trying to escalate our privileges, is to check what privileges we have! This can be done through `sudo -l` .

![](https://miro.medium.com/v2/resize:fit:700/1*RdSXPw0TeRmw__LVmgX1Wg.png)

Looks like we have sudo access over the mobile shell (mosh) server, but not the mosh binary itself. Looking at the mosh binary, we get the following options:

![](https://miro.medium.com/v2/resize:fit:700/1*2y_ZP-m00yn7I0_goSLRCw.png)

I did some digging on these options, primarily into the`--server`flag because that is what we have sudo privileges on — `/usr/bin/mosh-server`. I found an [article](https://www.hackingdream.net/2020/03/linux-privilege-escalation-techniques.html) detailing multiple PrivEsc techniques, including mosh!

We find the following payload:

```text theme={null}
mosh --server="sudo /usr/bin/mosh-server" localhost
```

To give a little more context around this exploit, Mosh (Mobile Shell) is sort of like SSH, but designed for roaming and intermittent connections. It consists of:

* A client on your local machine.
* A server on the remote machine (runs mosh-server).
* It uses SSH to establish the session, but then communicates over UDP (which we got hinted at earlier in the box).

This exploit makes a lot of sense because in theory, because we are running mosh with the `--server="sudo /usr/bin/mosh-server"` flag, which tells mosh to use **our custom server**, which we can run **as root**. The `localhost` tag at the end says to make our current localhost session the SSH client, therefore spawning a root shell on our localhost session.

Running the exploit:

![](https://miro.medium.com/v2/resize:fit:700/1*-bJ626PLRVDEPnadq1bKEg.png)

We pop into a root shell and can claim our flag!

![](https://miro.medium.com/v2/resize:fit:700/1*aiYqhqLVAVqWSaMfEvHgfQ.png)

Hope you enjoyed the box! It’s always fun learning about new technology and protocols, and then being able to break it!

Happy Hacking!


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.