HackTheBox Writeup – Luanne

Breadcrumb Abstract Shape
Breadcrumb Abstract Shape
Breadcrumb Abstract Shape
HackTheBox Writeups

HackTheBox Writeup – Luanne

  • October 25, 2024
  • 0
Picture59 — Macksofy Trainings

About the Luanne HackTheBox machine

Operating system: NetBSD  |  Difficulty: Easy  |  Status: Retired

Luanne is a retired Easy-rated NetBSD machine — a refreshing change from the usual Linux targets. Enumeration moves past HTTP Basic authentication and a robots.txt hint to a Lua-powered weather API on port 9001, where a command-injection flaw in the city parameter yields a foothold. Post-exploitation on the unfamiliar BSD userland, Munin enumeration, and a netpgp-encrypted backup lead to root. Great practice for enumerating REST APIs and working outside a comfortable Linux environment.

Greetings from Macksofy Technologies. Below is the detailed walkthrough of the Luanne machine which got retired from HackTheBox

The IP of this box is 10.10.10.218
Port Scan
Running NMAP full port scan on it , we get

There were 3 Open Ports found, Port 22, 80 and 9001 respectively
Web
Checking the web, it asks for basic authentication

Default random credentials didn’t worked here, so checked robots.txt file and got a disallowed entry as /weather

The directory returns a 404 error, but from the robots file it told us its still harvesting cities

Running Gobuster, I found a directory named /forecast

The directory is an API which is returning a 200 status code and also a message saying that no city is specified and also tells us to use the city parameter to list the available cities

Listing out the cities , I got 13 cities listed as shown

Injecting a single quote in the end of the argument value, it returns a Lua error in the response

Using command execution payload for Lua as shown to print the message hello

Now execution shell command to run the id command using the os.execute functionality

Since command execution was confirmed, I took a reverse shell successfully

Enumerating the web, I found a .htpasswd file which has the hash for webapi_user

Using hashcat to crack the hash successfully to iamthebest

Checking locally open ports, it was found Port 3000 and Port 3001 was open

Checking the process running, it can be seen that httpd is running locally on Port 3001

Using curl command to get the contents using the basic authentication locally and found a id_rsa file listed

Getting the contents of the private ssh key using the same way

Connecting to the user r.michaels using the private key successfully

Way To Root
Checking the current user directory, there was a backups folder

Inside the backups directory, was a encrypted zip file which was encrypted using netpgp

Use netpgp tool to decrypt the file and get the zip file

Inside the zip folder there was another .htpasswd hash found

Used hashcat tool to crack the password to littlebear

Used the password to run the sh shell as root and provide the password which I got and it led me to root shell successfully

Tags: ctf, hack, hackthebox, htb, linux, medium

Skills you practise on Luanne

  • Enumerating and abusing a JSON/REST API
  • Discovering hidden endpoints via robots.txt and Gobuster
  • Command injection through an unsanitised parameter
  • Post-exploitation on a non-Linux (NetBSD) system
  • Decrypting a netpgp/GPG backup to recover credentials

How Luanne maps to your OSCP / PEN-200 preparation

The enumerate → gain a foothold through a web or service vulnerability → escalate to root workflow on Luanne mirrors the exact methodology assessed in the OSCP exam. If you want to build this skill set under expert mentorship with an exam-focused lab environment, explore Macksofy’s OSCP (PEN-200) training and certification programme.

More HackTheBox writeups from Macksofy

Browse every walkthrough in our HackTheBox writeups collection, or go deeper with our penetration testing articles.

Macksofy Expert Trainers

Macksofy Expert Trainers is the collective byline for certified cybersecurity instructors at Macksofy Trainings. Our trainers hold OSCP, OSWE, OSEP, CEH, CPENT, SOC-200, CompTIA, and other industry certifications, and bring combined hands-on experience in commercial penetration testing, red team operations, SOC analysis, threat hunting, and DFIR engagements across Indian BFSI, government, and enterprise clients. Articles under this byline are collaborative pieces written, reviewed, and fact-checked by multiple Macksofy trainers to ensure technical accuracy and exam-relevance.


Active practitioner certifications across the trainer cohort: OSCP, OSWE, OSEP, OSED, OSCC, CEH v13 AI, CHFI, CTIA, CPENT, ECIH, CCISO, SOC-200 (OSDA), CompTIA Security+ / Network+ / CySA+ / Linux+. Commercial engagement experience covers penetration testing, red team operations, SOC analysis, threat hunting, and DFIR for Indian BFSI, fintech, government, and MSSP clients.

HackTheBox Writeup – Passage
HackTheBox Writeup – Time