https://maxisfront.me/tags/path-traversal/ Recent content in Path-Traversal on MaxisFront Hugo en Sun, 24 May 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-conversor-htb/ Sun, 24 May 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-conversor-htb/ <blockquote> <p>All rights reserved to <strong>Hack The Box LTD</strong>.</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Exploitation of <code>Path Traversal</code> to gain <code>RCE</code></li> <li>Extraction and cracking of hashes <code>MD5</code> via <code>Hashcat</code></li> <li>Reuse of credentials for access via <code>SSH</code></li> <li>Exploitation of the command&rsquo;s SUID <code>needrestart</code> (<code>CVE-2024-48990</code>)</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine.</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port enumeration</li> <li>Use of basic GNU/Linux-based commands</li> <li>Exploitation via UFU and RCE</li> <li>Searching for and using Critical CVEs</li> <li>Exploitation of vulnerable SUID</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>Nmap</li> <li>Caido</li> <li>Netcat</li> <li>Strings</li> <li>Hashcat</li> <li>SSH</li> <li>sudo</li> <li>needrestart</li> </ul> <hr> <h2 id="vulnerability-assessment-and-analysis">Vulnerability Assessment and Analysis</h2> <p>The platform <code>HTB</code> provides us with the <code>IP</code> target, which is the <code>10.129.12.212</code>, an address that can be reached by connecting through the <code>VPN</code> assigned to us by the platform.</p>