Hack The Box :: ServMon

#NVMS-1000 #ArbitraryFileRead #NSClient++

ServMon is an Easy Windows box created by dmw0ng. It was released on April 11th, 2020 and retired on June 20th, 2020. The users rated the difficulty 4.1/10 and gave an appreciation score of 2.1/5.

ServMon Info Card

TL;DR

We access an FTP server anonymously to retrieve some information about a password file in nathan home directory. A directory traversal/arbitrary file read vulnerability on a NVMS-1000 instance allows us to read this file and get nadine password. We can log in through SSH to retrieve the user flag. Another website exposes an NSClient++ instance. We can read the admin password from its configuration file. We then exploit a known authenticated privilege escalation vulnerability to get the root flag.

Note: unless otherwise stated, all commands and scripts you will find below are run on macOS. Especially sed and base64 syntax may slightly differ from Linux versions. Python 3 is the preferred interpreter.

Table of Contents

[1] Reconnaissance & Enumeration
[1.1] Open Ports
[1.2] Web discovery - 80
[1.3] Web discovery - 8443
[1.4] FTP…