Introduction

This is an easy web challenge from Hack The Box. The goal is to analyze the application, identify any exposed functionality, and use it to retrieve the flag.

Recon

Viewing the source code revels three interseting files:

<script src="/static/terminal/js/commands.js" type="module"></script>
<script src="/static/terminal/js/main.js" type="module"></script>
<script src="/static/terminal/js/game.js" type="module"></script>

main.js revels a API endpoint in fetchOption function

const fetchOptions = () => {
  fetch("/api/options")
    .then((data) => data.json())
    .then((res) => {
      availableOptions = res.allPossibleCommands;
    })
    .catch(() => {
      availableOptions = undefined;
    });
};

Upon visiting http://<ip_addr>:31388/api/options it revels a secret Blip...<SNIP>...shmack

NOTE: Replace <ip_addr> with your challenge IP address

Flag Retrieval

Visit http://<ip_addr>:31388/ in browswer and enter start to start the game

NOTE: Replace <ip_addr> with your challenge IP address

Enter the secret value and grab the flag HTB...<SNIP>...??}