File Transfers:

XACS 255

Link to challenge: https://academy.hackthebox.com/module/24

(log in required)

Class: Tier 0 | Medium | Offensive

Before we begin: throughout the module we will be requested to login to target Linux machines, and target windows machines.

The credentials will be provided for us by the module.

For Linux, we will use ssh with the command:

ssh <username>@<target-IP>

and then we will be requested to enter the password.

For windows – we will use xfreerdp with the command:

xfreerdp /v:<Target IP> /u:<username> /p:<password> /dynamic-resolution

Throughout the module, those steps will be referred as ‘login to the Linux/Windows target machine’.

File Transfer Methods

Windows File Transfer Methods:

Question: Download the file flag.txt from the web root using wget from the Pwnbox. Submit the contents of the file as your answer.

Answer: b1a4ca918282fcd96004565521944a3b

Method: running nmap, we can observe the target machine has http service available, which may be enabling file download:

we will run the command:

wget http://<target-IP>/flag.txt

All we have to do is to cat the flag:

Question: Upload the attached file named upload_win.zip to the target using the method of your choice. Once uploaded, unzip the archive, and run "hasher upload_win.txt" from the command line. Submit the generated hash as your answer.

Answer: f458303ea783c224c6b4e7ef7f17eb9d

Method: for this question we are provided with ‘upload_win.zip’ download link.

Lets download it to the pwnbox (by pasting