2024 Business CTF - Vault of Hope: Swarm

Challenge Information

Summary

Swarm is a full penetration test challenge involving comprehensive enumeration of multiple HTTP services running on different ports (80 and 5000) and SSH access (port 22). The challenge requires systematic reconnaissance, vulnerability identification, and exploitation. The extensive reconnaissance phase provides detailed information about service versions, technologies, and potential attack vectors.

Analysis

Discovered Services:

1. SSH (Port 22):

   • Service: OpenSSH
   • Used for: Remote shell access
   • Exploitation methods: Brute-forcing, credential abuse, SSH key injection

2. HTTP (Port 80):

   • Service: nginx
   • Technology: Static website or application
   • Enumeration targets: Directories, virtual hosts, file extensions

3. HTTP (Port 5000):

   • Service: Alternative HTTP service
   • Potential frameworks: Flask, Node.js, Python web application
   • Discovery paths: Web root enumeration, technology identification

Enumeration Strategy:

The challenge notes include comprehensive enumeration commands for both ports:

# Port 80 enumeration
feroxbuster -u http://swarm.htb:80 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r

# Port 5000 enumeration
feroxbuster -u http://swarm.htb:5000 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r

Solution

Phase 1: Initial Reconnaissance

1. Port Scanning:

   nmap -sC -sV swarm.htb
   # Identifies open ports and services

2. Service Enumeration:

   # Check HTTP response headers
   curl -I http://swarm.htb:80
   curl -I http://swarm.htb:5000

Phase 2: HTTP Enumeration (Port 80)

1. Technology Identification:

   whatweb http://swarm.htb:80
   nikto -h http://swarm.htb:80

2. Directory Enumeration:

   feroxbuster -u http://swarm.htb:80 -t 10 \
     -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
     -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r

3. Virtual Host Discovery:

   ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
     -u http://swarm.htb -H "Host: FUZZ.swarm.htb" -fs 187

Phase 3: HTTP Enumeration (Port 5000)

1. Service Identification:

   whatweb http://swarm.htb:5000
   nikto -h http://swarm.htb:5000

2. Application Directory Scan:

   feroxbuster -u http://swarm.htb:5000 -t 10 \
     -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
     -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r

Phase 4: SSH Enumeration (Port 22)

1. Version Detection:

   nmap -sV -p 22 swarm.htb
   ssh -v swarm.htb

2. Brute-Force Attempts:

   hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
     -P /usr/share/seclists/Passwords/darkweb2017-top100.txt \
     -e nsr -s 22 -o hydra_ssh.txt ssh://swarm.htb
   
   medusa -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
     -P /usr/share/seclists/Passwords/darkweb2017-top100.txt \
     -e ns -n 22 -O medusa_ssh.txt -M ssh -h swarm.htb

Phase 5: Vulnerability Identification

Based on enumeration results:

1. Known Vulnerabilities:

   • Research identified service versions
   • Check for public exploits
   • Test common misconfigurations

2. Web Application Vulnerabilities:

   • Test discovered endpoints for injection flaws
   • Check for authentication bypass
   • Identify upload functionalities

Phase 6: Exploitation

Depending on discovered vulnerabilities:

1. Remote Code Execution:

   • Via web application vulnerability
   • Via service-specific exploit

2. Authentication Bypass:

   • Weak credentials
   • Credential stuffing
   • Authentication flaws

3. File Inclusion/Traversal:

   • Access sensitive files
   • Retrieve application source code

Phase 7: Post-Exploitation

1. Privilege Escalation:

   sudo -l
   find / -perm -4000 2>/dev/null

2. Proof of Compromise:

   cat /root/root.txt

Enumeration Commands Reference

feroxbuster (recommended for recursive enumeration):

feroxbuster -u http://swarm.htb -t 10 -w wordlist.txt -x extensions -v -k -n -e -r

gobuster (alternative):

gobuster dir -u http://swarm.htb -w wordlist.txt -x php,html,txt

nikto (CGI and server vulnerabilities):

nikto -h http://swarm.htb:80

whatweb (technology fingerprinting):

whatweb http://swarm.htb:80

Key Takeaways

• Multiple HTTP services on different ports require independent enumeration
• SSH brute-forcing should use relevant wordlists with common credentials
• Technology fingerprinting helps identify version-specific vulnerabilities
• Recursive directory enumeration reveals deeper application structure
• Virtual host enumeration may expose additional attack surfaces
• Service-specific tools (nikto, whatweb) complement generic scanners
• Credential bruteforcing against SSH may succeed before exploitation
• Systematic approach to enumeration prevents overlooking attack vectors
• Documentation of all enumeration results aids in exploitation planning