7th Annual Saranac Lake Cybersecurity Conference

During the 7th Annual Saranac Lake Cybersecurity Conference, a student and I worked together to solve an easy Hack The Box challenge. The objective was to identify weaknesses in a web application and obtain the flag. The exercise demonstrated the importance of securing backup files, protecting credentials, and properly restricting access to sensitive information.

Enumeration

Our initial reconnaissance revealed that only port 80 was open, indicating a web application was likely the primary attack surface.

To discover additional content and directories, we used Gobuster: gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

The scan returned several interesting directories:

/backups (Status: 301)

/dashboard (Status: 403)

/login (Status: 200)

/static (Status: 301)

The /dashboard directory returned a 403 Forbidden response, suggesting it was protected. The /login page was accessible and appeared to be the application's authentication portal. The most interesting discovery, however, was the /backups directory.

Investigating the Login Page

While examining the application, we used curl to inspect the login page source: curl http://154.57.164.79:32767/login

Within the response, we discovered a reference to a SQL backup file: href="mflow_sales_management_20240404.sql"

This immediately suggested that a database backup may have been exposed through the web server.

Accessing the Database Backup

We navigated to the backup location and downloaded the file: curl -O http://154.57.164.79:32767/backups/mflow_sales_management_20240404.sql

After reviewing the SQL dump, we found user account information, including the administrator account and a hashed password.

This represented a serious security issue because database backups should never be publicly accessible from a web server.

Password Recovery

The password hash was identified and submitted to crackstation.net. The hash had previously been cracked and was available in public databases, allowing us to recover the plaintext password.

Once the password was recovered, we had valid administrator credentials.

Gaining Access

Using the recovered administrator username and password, we authenticated through the application's login page.

After successfully logging in, we gained access to the administrative area and located the challenge flag, completing the objective.

Key Findings

This challenge highlighted several common web application security weaknesses:

1. Publicly Accessible Backups
   • Sensitive database backups were stored in a web-accessible directory.
   • Backup files contained user account information and password hashes.
2. Weak Credential Protection
   • The administrator password hash had already been compromised and was easily recoverable.
3. Information Disclosure
   • References to sensitive files were exposed within application content, making discovery straightforward.

Lessons Learned

Organizations should:

• Store backup files outside the web root.
• Restrict access to backup and administrative directories.
• Use strong, unique passwords.
• Enforce password policies and multi-factor authentication.
• Regularly audit web servers for exposed files and sensitive information.
• Monitor for leaked credentials and require password resets when necessary.

Conclusion

This challenge was an excellent demonstration of how seemingly small misconfigurations can lead to a complete compromise of a web application. Through enumeration, discovery of an exposed backup file, recovery of administrative credentials, and successful authentication, we were able to obtain the flag and complete the challenge. The exercise reinforced the importance of secure backup management and proper credential security practices.