Skip to content
HackIndex logo

HackIndex

SmartHire Writeup - HackTheBox

Medium Linux
HackTheBox Discuss on Discord

Last updated May 16, 2026 • 1 min read

B
Benslates

1. Reconnaissance

Fast TCP Port Scan

Start with a fast scan to identify open ports quickly.

┌──(kali㉿kali)-[~]
└─$ nmap -T5 --open <Target_Ip> 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-17 00:13 +0500
Nmap scan report for smarthire.htb (10.129.26.203)
Host is up (0.21s latency).
Not shown: 991 closed tcp ports (reset), 7 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 4.05 seconds

Service & Version Detection

Run a detailed scan with service detection and default scripts against the open ports.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -sC -p22,80 <Target_Ip> 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-17 00:15 +0500
Nmap scan report for smarthire.htb (<Target_Ip>)
Host is up (0.25s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 41:3c:e3:bb:88:70:99:7f:b8:96:59:48:9b:85:98:69 (ECDSA)
|_  256 d5:9d:fd:6b:be:d8:39:6f:3f:43:ab:0e:f6:3e:22:db (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Overview | SmartHIRE
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Add Hostname to /etc/hosts

┌──(kali㉿kali)-[~]
└─$ echo "<Target_Ip> smarthire.htb" | sudo tee -a /etc/hosts 
<Target_Ip> smarthire.htb

2. Enumeration

Subdomain Fuzzing

Fuzz for hidden subdomains using ffuf.

┌──(kali㉿kali)-[~]
└─$ ffuf -u http://FUZZ.smarthire.htb/ -H "Host: FUZZ.smarthire.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0 
        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://FUZZ.smarthire.htb/
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.smarthire.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 0
________________________________________________

models                  [Status: 401, Size: 137, Words: 11, Lines: 1, Duration: 213ms]
:: Progress: [4989/4989] :: Job [1/1] :: 45 req/sec :: Duration: [0:00:17] :: Errors: 4988 ::

Protected Writeup

This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.