---
description: In this Writeup we Learn how to hack into Responder
---

# HackTheBox Responder Writeup

{% hint style="success" %}
pwned link to verify :- [_<mark style="color:red;">**https://labs.hackthebox.com/achievement/machine/2028448/461**</mark>_](https://labs.hackthebox.com/achievement/machine/2028448/461)&#x20;
{% endhint %}

## NMAP SCAN&#x20;

```
# Nmap 7.95 scan initiated Sat Jul  5 22:55:31 2025 as: /usr/lib/nmap/nmap -vvv -sVC -p- --min-rate 1000 -oN responder_scan.txt 10.129.231.241
Nmap scan report for 10.129.231.241
Host is up, received echo-reply ttl 127 (0.14s latency).
Scanned at 2025-07-05 22:55:31 IST for 198s
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE    REASON          VERSION
80/tcp   open  http       syn-ack ttl 127 Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
5985/tcp open  http       syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
7680/tcp open  pando-pub? syn-ack ttl 127
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jul  5 22:58:49 2025 -- 1 IP address (1 host up) scanned in 198.59 seconds

```

We see that Port 80 , 5985, 7680 are Open , we also see that the OS Running is Windows OS&#x20;

as we visit ip address 10.129.231.241 on web browser we see that the page is being redirected to&#x20;

```
http://unika.htb 
```

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FTwjmdT3j0zbbJpDhY3ak%2FScreenshot%20From%202025-07-05%2022-56-13.png?alt=media&#x26;token=c1d9f6d3-b068-4a15-8523-b24c1ee885a3" alt="" width="563"><figcaption></figcaption></figure>

then we add the entry of our ip in our /etc/hosts file and save it  using the commands&#x20;

```
nano /etc/hosts 

10.129.231.241 unika.htb

[CTRL + S] TO SAVE THE CHANGES IN FILE 

[CTRL + X] TO EXIT 

```

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FGZPBjLLqYIAyK7GQO2pR%2FScreenshot%202025-07-05%20at%2023-43-51%20deb9dbf0-392b-4088-b40e-fad8a3694145.png?alt=media&#x26;token=8bb768f0-6cb5-4907-82d6-5e112471b2c8" alt="" width="563"><figcaption></figcaption></figure>

Checking the site out, we see nothing of particular interest. Although, we notice a language selection option\
on the navbar EN and changing the option to FR takes us to a French version of the website.

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FlPo1bwwRQb6UrT3Aq6CF%2FScreenshot%202025-07-05%20at%2023-45-54%20deb9dbf0-392b-4088-b40e-fad8a3694145.png?alt=media&#x26;token=d901afad-1b7e-40b4-b146-c3dbd1b96bed" alt="" width="563"><figcaption></figcaption></figure>

Noticing the URL, we can see that the french.html page is being loaded by the page parameter, which\
may potentially be vulnerable to a Local File Inclusion (LFI) vulnerability if the page input is not sanitized.
