[Protected] Giveback HackTheBox Writeup
[Protected] Giveback HackTheBox Writeup
November 2, 2025

Nmap Scan
Starting Nmap 7.98 ( https://nmap.org ) at 2025-11-02 13:17 +0100
Nmap scan report for 10.129.56.182
Host is up (0.033s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 66:f8:9c:58:f4:b8:59:bd:cd:ec:92:24:c3:97:8e:9e (ECDSA)
|_ 256 96:31:8a:82:1a:65:9f:0a:a2:6c:ff:4d:44:7c:d3:94 (ED25519)
80/tcp open http nginx 1.28.0
|_http-server-header: nginx/1.28.0
|_http-title: GIVING BACK IS WHAT MATTERS MOST – OBVI
|_http-generator: WordPress 6.8.1
| http-robots.txt: 1 disallowed entry
|_/wp-admin/
30686/tcp open http Golang net/http server
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 200 OK
| Content-Type: application/json
| X-Content-Type-Options: nosniff
| X-Load-Balancing-Endpoint-Weight: 1
| Date: Sun, 02 Nov 2025 12:18:15 GMT
| Content-Length: 127
| "service": {
| "namespace": "default",
| "name": "wp-nginx-service"
| "localEndpoints": 1,
| "serviceProxyHealthy": true
| GenericLines, Help, LPDString, RTSPRequest, SSLSessionReq:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest, HTTPOptions:
| HTTP/1.0 200 OK
| Content-Type: application/json
| X-Content-Type-Options: nosniff
| X-Load-Balancing-Endpoint-Weight: 1
| Date: Sun, 02 Nov 2025 12:17:54 GMT
| Content-Length: 127
| "service": {
| "namespace": "default",
| "name": "wp-nginx-service"
| "localEndpoints": 1,
|_ "serviceProxyHealthy": true
|_http-title: Site doesn't have a title (application/json).
[...]
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 40.93 secondsEnter the Password to Unlock Content
Where can I find the password?
For Linux CTF machines, retrieve the root password hash from the /etc/shadow file.
- Access the file:
cat /etc/shadow(requires root privileges). - Example:
root:$y$j9T$Vy...Gp9B:20286:0:99999:7:::
For Windows CTF machines, retrieve Administrator NT Hash from NTDS.DIT if it's a Domain Controller otherwise retrieve the local Administrator NT hash from the SAM database.
- Use
secretsdump.pyfrom Impacket orhashdumpin Meterpreter (requires administrative privileges). - Example:
Administrator:500:aad3b435b...d3b435b51404ee:0b133be956...701affddec:::
Last updated on