Obscurity,a Linux box created by HackTheBox user clubby789, was an overall medium difficulty box. Initial foothold was finding the code for the webserver code and analyze it to figure out RCE. which get us low privilege shell. In User directory there is a python encryption script we can use to figure out users password. As user we can run a python script meant to replace SSH that we can use to gain access to roots password hash. using which we get Root.
Postman,a Linux box created by HackTheBox user TheCyberGeek, was an overall easy difficulty box. You had to get the config from the redis and use that to set our ssh-key in authorized keys and get a SSH connection as redis user. Enumerating you will find an encrypted ssh key cracking that will give you a passphrase but using that with the key doesn’t work. but that passphrase work as User on Webmin. The Webmin have a authenticated RCE using which we get the root shell.
Traverxec,a Linux box created by HackTheBox user jkr, was an overall easy difficulty box.The initial enumeration expose that the web-server is vulnerable to an Directory traversal to RCE attack using which we can get a Reverse Shell as www-data. Later we enumerate and find public_www folder which contain the user david ssh key using which we can get user. Privilege Escalation on this box was very simple gtfobins journalctl.
Wall,a Linux box created by HackTheBox user askar, was an overall medium difficulty box.The initial foothold was finding the cred for centreon server and the seeing the version is vulnerable and have a RCE using that, we get the reverse shell and user. Privilege Escalation was super simple after enumerating we find screen is a SUID and have a exploit on SearchSploit for that version. Using that we get the root shell.