A fairly late arrival to Hack The Box (HTB) I’ve started working through some of the content. Just pwned ‘Chemistry’, and looking at some of the write-ups I’ve noticed my way is a lot more direct than the others I’ve been reading – I guess because I’m a bit more web and sysadmin.

The other walkthroughs for Hack The Box Chemistry concentrate on CIFs, Pymatgen, Payloads, and Python 3 – all of which gets you a pointer to the database you could have found by opening the default webpage! So, this is how I went about taking down ‘Chemistry’:

  1. Connect to your Lab VPN, and enumerate services on ‘Chemistry’:
nmap -sV -p0- 10.10.11.38
  • Download database.db and open with SQLite, browse the user table:
  • I tried a few before finding rosa’s password worked for SSH. SSHed to ‘Chemistry’ and got the user flag:

Had a bit of a poke around and could access /etc/passwd, then…

  • Run nbtstat -l and found a local site on http-alt (8080):
  • Curl http://localhost:8080(useful except shown):
  • Noting ‘/assets/’ – curl -s –path-as-is http://localhost:8080/assets/../../../../root/root.txt
  • And bingo:

So that’s Hack The Box Chemistry – a trip through databases, password hash cracking, and path traversal. Rated ‘Easy’ on Hack The Box, it’s only easy when you know how!

Contact me via YDC.