Hack the Box: Olympus Walkthrough

Today we are going to solve another CTF challenge “Olympus”. Olympus is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.

Level: Easy

Task: To find user.txt and root.txt file

Note: Since these labs are online available therefore they have static IP. The IP of Olympus is 10.10.10.83

Walkthrough

Let’s start off with our basic nmap command to find out the open ports and services.

From nmap scanning result, we found that here port 22 is filtered for SSH but instead of that port 2222 is also open for SSH. Moreover port 53 is open for DNS where it has grabbed banner “Bind” and even it found the port 80 is opened for Apache http server. Therefore firstly, let’s navigate to port 80 in the web browser.

After exploring target IP in the web browser, we was welcomed by zeus picture as shown in the above image. Unfortunately! Here we didn’t find any remarkable clue, therefore further, we decided to run Nikto for scanning vulnerabilities.

Let’s find the list of possible vulnerabilities using Nikto:

Scanning with nikto gave us a clue to move forward which is Uncommon header ‘xdebug’. Searching the keyword ‘xdebug’ on google gave us result about ‘xdebug’ command execution exploit module for metasploit. After that load metasploit on your terminal and use the commands as follows:

Boom!! We have got the meterpreter of the target machine. Then further exploring directories, we noticed a directory /zeus which got a sub directory /airgeddon. As you can relate it with the image below.

Then inside the /airgeddon directory, we opened its sub directory /captured which shows a file captured.cap. It could be another clue, therefore we downloaded this file on our Kali Desktop as you can see in the image below.

After downloading capture.pcap file, we need to analysis it. So when we open this file, it was a wireshark pcap file and by streaming the 1st packet we noticed SSID: Too_clOse_to_th3_Sun as shown in the given below image. This can be probably used as a Password.

Now cracking the file captured.cap using aircrack following command:

After few minutes we have found the key: flightoficarus as shown in the image below.

We thought icarus could be a username too. Because earlier when we search “Too close to the Sun” in the Google, it shows the wiki page of icarus. Therefore the following combination of credentials probably acquired for SSH login via port 2222.

After successfully logging into SSH, on navigating further, we acquired a file “help_of_the_gods.txt”. After reading the file it shows us a domain name ctfolympus.htb as shown in the image below.

We thought of trying dns zone transfer, since dig uses the axfr response to retrieve your zone information.

From the result we figured that pormetheus can be another username and St34l_th3_F1re! could be the possible password. Also there is series of some random port numbers 3456 8234 62431  and  this bring us to ponder on port Knocking that can change the state of SSH port 22 from filtered to open.